MUTARIS

Certified. Permanent. Trusted.

Every record Mutaris touches is permanent, provable, and protected.

Laboratory data goes in. A signed, hash-chained submission comes out, ready for the FDA and the FTC. Each document is its own token, with its own key and its own access-control list.

Request pilot accessRead the platform spec
FedRAMP HighNIST 800-53 Rev 5421 controls21 CFR Part 11

Token 1271.320 · labelling claims

CERTIFIED
Content hashb0c48e17a2dd…41f9
SignatureECDSA P-384 · Cloud HSM
Previous event7d21ba04ff90…9e11
Merkle root9f21…c3ab
Anchored root. Verifiable without trusting Mutaris.

Audit trail

09:14 TOKEN_CERTIFIED · a.reyes

08:56 TOKEN_VERIFIED · 0.98

17:02 OBSERVER_READ · did:fda:cber

The platform

Six capabilities that turn a regulatory submission into a permanent, verifiable artifact.

No raw content on the blockchain. No accent colors competing for attention. No marketing language where precision is required. The platform is built for the audit you hope never comes, and the one you know eventually will.

Immutable audit ledger

Every regulated event signed with HSM-backed ECDSA P-384, hash-chained on Hyperledger Fabric, anchored daily to Polygon. Tamper-evident within fifteen minutes.

21 CFR Part 11

AI verification engine

Seven-stage pipeline: schema validation, anomaly detection, cross-test consistency, completeness scoring, regulatory mapping, FTC claim analysis, confidence scoring.

Auto-VERIFIED ≥ 0.95

Dual-agency submission

FDA mandatory and FTC conditional routing in one submission. CDISC SDTM / ADaM and FTC § 5 / Endorsement Guides validated in a single workflow.

16 CFR 255 · 21 CFR 820

Observer DID inspection

FDA and FTC representatives query ledger state directly via decentralized identity. Every read is itself audited. No export packages, no email-and-PDF discovery.

Audit Channel · read-only

FedRAMP High infrastructure

GCP Assured Workloads in us-east4 with us-central1 disaster recovery. Chronicle SIEM. Cloud HSM key custody. NIST SP 800-53 Rev 5 High baseline.

421 controls

Token-per-document architecture

Each regulated document is its own cryptographic token with its own ACL. No raw content on the blockchain. Rejection affects only the failed token, never the whole application.

AES-256-GCM CMEK

The workflow

From bench to federal approval, in four steps.

A single workflow from raw laboratory data through anchored federal submission. Every step is permanent. Every step is provable.

  1. Step 1

    Bind your regulated product

    Create a product token in the ledger. Select CFR scope: 21 CFR 211 (drug), 820 (device), 1271 (HCT/P), 42 CFR 493 (CLIA), 16 CFR (FTC).

  2. Step 2

    Ingest laboratory data

    Lab instruments push data through the LabData chaincode handshake. CDISC SDTM, ADaM, COA, and IRT validated on ingest. Schema failures never reach the ledger.

  3. Step 3

    Verify with AI

    The seven-stage pipeline scores every submission. Confidence ≥ 0.95 auto-VERIFIED. Lower scores route to human review with the specific CFR clause cited.

  4. Step 4

    Submit and anchor

    Authorized signatory ceremony locks the manifest into the AUTHORIZED state. Submission flows to FDA / FTC. The manifest hash anchors to Polygon for permanent verifiability.

Trust architecture

Built for the audit you hope never comes, and the one you know eventually will.

Trust is the product. The platform is designed so that every record is permanent, every key is hardware-protected, every access is audited, and every claim is independently verifiable.

FedRAMP High · NIST SP 800-53 Rev 5

All processing within the Authorization Boundary

Google Cloud Assured Workloads enforces the boundary. us-east4 primary, us-central1 disaster recovery. No data leaves the continental United States. Continuous monitoring under 3PAO oversight.

AES-256-GCM CMEK · Cloud HSM

A unique key per token, never exported

Audit signing (ECDSA P-384), Polygon submitter (secp256k1), and Merkle attestation keys are custodied in Cloud HSM. Keys never leave hardware. Token-per-document architecture keeps raw content off the blockchain.

Polygon · 15-minute Merkle root

A public anchor any third party can verify

A Merkle root of every accepted manifest is posted to the public Polygon chain. Any party with a record and proof can verify inclusion without trusting Mutaris. Tamper detection within fifteen minutes.

Observer DID · Audit Channel

Read-only access for FDA and FTC inspectors

Regulatory agency representatives query ledger state directly: getTokenState, getAuditEvents, getManifest. Every observer query is itself recorded as an audited event. No export packages, no email-and-PDF discovery.

Access tiers

Three submission tiers. One compliance guarantee.

Mutaris serves single-person startups and global pharmaceutical enterprises from one platform. Pricing is finalized per engagement. The tier model below describes the submission shape.

Small business

Tier 1

Independent labs, startups, single-product companies. Submit one subsection at a time. Same compliance guarantee as the enterprise tier.

Submission model

Pay-per-subsection

  • Single product or first submission
  • Per-subsection billing. Only pay for what you ship.
  • AI verification at the ≥ 0.95 confidence threshold
  • Polygon anchor on every accepted manifest
  • Email and TOTP authentication
Talk to us
Most common

Mid-sized company

Tier 2

Regional device and pharma companies with dedicated regulatory teams. Section-by-section submission with predictable billing tied to functional milestones.

Submission model

Section-level

  • Unlimited products in a single tenant
  • Section-level batch submission
  • FTC § 5 claim screening queue
  • Organizational SSO (SAML / OIDC) + TOTP
  • FTC Compliance Officer + QCU roles
Talk to us

Enterprise

Tier 3

Large pharma, biotech, and medical device companies with mature regulatory operations. FedRAMP High and HIPAA are table stakes. Full-document submission with multi-party authorization.

Submission model

Full-document atomic

  • Full-document atomic submission
  • M-of-N MPC ceremony for the AUTHORIZED state
  • FIDO2 + BeyondCorp Zero Trust
  • Enterprise SSO (SAML 2.0)
  • Optional single-tenant deployment
Talk to us

Regulatory Agency users (FDA, FTC, CMS) and platform staff use a separate access tier with no business-data read. The platform spec defines the full user-class model.

Pilot · Tier 1 onboarding open

The record that can't be changed.

Mutaris is onboarding regulated teams ahead of the FedRAMP ATO. If your organization submits to the FDA or FTC, we want to talk.

Request pilot accessEmail the team