Regulated SaaS
Veriport: compliance critical drug and alcohol testing for Canadian administrators, labs and medical review officers.
A 500K line Django monolith on AWS carrying regulated and non regulated test workflows end to end. Chain of custody, lab and eCCF integrations, medical review, audit trails and role based access, under Canadian privacy law and AES 256 at rest.
What it does
Third party administrators, collection service providers and medical review officers all work the same test through one system. A collection starts, a specimen moves under chain of custody, a lab returns a result over an integration, an MRO reviews it, and every hand it passed through is written down permanently.
- DOT regulated and non regulated test workflows, each with their own rules
- Chain of custody from collection through to final disposition
- Lab and eCCF integrations for electronic custody and control forms
- Medical review officer review queues and determinations
- Immutable audit trails and role based access control
What is different about regulated work
Correctness and auditability outrank velocity, and that changes how you build. A migration is not a migration when the old rows are legal evidence. A bug is not a bug when the record it corrupts is somebody's medical result.
Private medical data is encrypted at rest with AES 256 and handled under Canadian privacy law. Every state transition is recorded rather than overwritten, so the system can always answer who did what and when, years later.
Stack