How BatchGlow works

Everything starts with the customer’s order. One order carries any number of products, a line each, and is taken whenever it comes: the rules restrict release and shipment, not taking an order. Payment terms can split it, say half on order and half on shipment: a payment request goes out with a payment link, and the deposit is booked against the order. A plant can set a minimum advance per order, and choose whether confirming production below it only warns or is refused.

The planner turns order lines into a production order. BatchGlow pins each SKU’s approved product spec, its bulk and the approved formula, and gathers the other open lines for the same bulk; a customer’s own formula joins only that customer’s lines. An order on bulk the customer sends ready-made skips compounding and goes straight to buying packaging and filling. A kit order fills each component the plant does not already hold released, then assembles the kit once the components are released.

From then on, every order shows where it stands: materials checked, staging and pre-weigh, compounding, bulk testing, filling and packaging. Customers get three reports from the plant, as PDF or spreadsheet: their order status by step, the certificates and documents for their lots, and their materials and packaging on hand. The final invoice (one per shipment if needed) takes the deposit off, and both go to QuickBooks.

A formula is written in percent by weight and approved with two signatures, R&D and QA. From then on it is locked. A change is a new version, opened only by a change request that records the reason, the risk and whether the change needs a new stability study, and that QA approves with its signature; one approved request authorizes one change, not a series. The old version is archived: still readable, and the batches already started on it finish on it.

Each formula carries what the floor will be held to: its shelf life, a tolerance on every ingredient line, and yield limits, required on an OTC formula. Its list of approved suppliers (supplier and manufacturer, material by material) is a separate document QA signs, the one part that changes without a change request or a new version. The bulk the formula makes is created with it and must have its tests before QA can approve. An OTC formula is refused approval until every raw material in it has an identity test in its specification, and the system names the ones that don’t.

An OTC formula also names its monograph (sunscreen, acne, dandruff) and is checked against the plant’s signed monograph table: QA approval is refused if an active is not in it, if its label claim is outside the allowed range, or if the combination of actives is not allowed. An OTC drug outside its monograph is an unapproved new drug. Each active declares how its assay is read (as is, dried or anhydrous), its salt factor and the band inside which no correction is made, and the ingredient declaration is checked at both edges of that band, because the label is printed before the batch is made.

Mixing procedures are written as ISA-88 phases and steps: instructions, R&D’s reference photographs, hold times, parallel phases with their start triggers, and an in-process adjustment window: pH or viscosity trimmed within a set range, with set solutions. A formula can have several procedures, each for its own range of batch mass, because heating, cooling and mixer speeds do not scale in a straight line; “Copy procedure” starts a new range from any existing procedure, and the author changes only what differs. A procedure can name its main kettle once; a phase can take its own unit and extra instruments, and a step its own.

R&D makes bench samples, customer trial samples and pilot batches from a draft; pilot batches are traceable lots, so they can go on stability. Each sample freezes a snapshot of the composition, so the customer’s approval is attached to exactly what they tried; the formula itself still becomes approved only through the two signatures, with the screen showing how it differs from that snapshot. By default R&D cannot use material reserved for an order.

The rules behind it: 21 CFR 211.100 · 211.186 · 211.137 · 211.84 · OTC monograph M020 · 21 CFR 701.3

The mass is worked out from the order’s lines, their fill weights and the losses, never typed. Confirming the order creates the bulk work order and a filling work order per line, and starts the reservation while there is still time to buy. Each filling work order gets its own packaging BOM, signed by QA right after confirmation: packaging needs, artwork revisions and labeling reconciliation are read only from it, so a later change to the product’s BOM never touches an issued order.

The planner splits the mass vessel by vessel, as many batches as it takes, each inside that vessel’s working window. Every batch is its own lot with its own record, and every batch size has its own signed batch BOM, the only place the floor reads its targets from. After confirmation an order is frozen; more demand means a new production order. It can be canceled with a reason until the first dose is weighed, and QA can move its batches not yet started to a newer approved formula version under a change request.

Component Check (raw materials, in kilograms) and Packing Check (packaging, in units) show each order’s need against what is reserved, staged and truly available, counting only what the floor would actually accept: released, in date, not on hold, and for raw materials from a supplier approved and qualified for that formula. A shortage becomes a purchase request in the same click, and its status follows it all the way to “received, waiting to leave quarantine”. Material the customer supplies is requested from the customer instead.

The planning board lays compounding and filling slots on a Gantt, with an optimizer that weighs lateness, cleaning downtime, hold-time risk and vessel use. Slot lengths come from the formula’s base time with heating and cooling, the line’s speed and the cleaning a changeover needs; a filling slot sits after the bulk’s expected results and before its hold limit, and a what-if run re-plans after a breakdown. Each slot is checked against readiness forecast for its start (material, pre-weigh kit, bulk, packaging, equipment, qualified staff), and two planners can never book the same vessel. Cleanliness and calibration are forecast for the planner; the floor is stopped at the act itself.

The rules behind it: 21 CFR 211.63 · 211.101 · 211.186

The buyer’s dashboard lists every material the open orders need, sorted by its order-by date, the need date minus the supplier’s lead time: red when it is already late, yellow within two days. Under each material it shows which orders need it, and how much each.

One purchase order covers several production orders with one supplier, so the freight is paid once. The order window lifts the quantity to the supplier’s minimum on the total, prices it from the supplier’s price tiers and shows what the next tier would cost; the same material always merges into one line so it reaches the cheaper tier. It shows the total, the arrival date set by the slowest material and the cost of any surplus, and warns when a material will arrive after the order needs it. The order remembers which share of each line belongs to which production order, and the supplier never sees that. When the material passes receiving and leaves quarantine, BatchGlow reserves the weight each order needs by itself.

Suppliers are qualified per material and manufacturer. A new supplier starts as pending: the plant can buy from it, but every lot is fully tested and its certificate is not relied on. After a run of fully tested deliveries that match the supplier’s certificates (five by default), QA can sign it approved, and even then the plant’s own identity test on every lot stays, and the supplier’s results are checked against full testing at intervals. Requalification falls due on a date. Purchasing offers a raw material only from a supplier and manufacturer approved for every order that needs it. Orders and receipts from a disqualified supplier are refused by default (a plant rule, not the law); with it off, QC can test such a lot, but it is not issued until the supplier is approved again.

The order goes to the supplier by email from BatchGlow, or as a PDF, on BatchGlow’s purchase-order form under the plant’s own name and logo. An “On order” tab follows ship dates and tracking numbers, overdue ones in red; an “Insights” tab shows spend, price paid against the price grid, promised against actual lead time, and the share of each supplier’s lots that QC rejected. Buying and receiving stay separate jobs, and the accountant, not the buyer, enters the supplier’s bill.

The rules behind it: 21 CFR 211.84 · 211.184 · FDA’s DEG/EG guidance

Every received lot (raw material, packaging, ready-made bulk, the customer’s own material) goes into quarantine, and there is no switch to turn that off. It gets the plant’s own lot number from the plant’s or the customer’s code scheme, with the supplier’s lot and the printed manufacturing and expiry dates beside it. Each drum or tote gets its own record and QR label, “container k of N”, with its weight; Quarantine, Accepted and Rejected stickers print at each signed QC decision, and a SAMPLED sticker at sampling.

The dock checks each pallet, or each container if the plant prefers: the label matches the order, no damage, seals intact, no visible contamination, a temperature logger where the item travels cold. A damaged container goes on hold by itself and opens a deviation; the rest of the lot carries on. Drum labels print at the press of a button, on the dock’s Zebra or any office printer, with the GHS pictograms and PPE taken from the item, and the safety data sheet stays one tap away.

If the plant weighs at the dock, the receiver scans the scale’s QR code and the net goes into stock in kilograms, while the purchased quantity (55 gal, 570 lb) stays on the receipt for the invoice. A typed weight names its scale and is refused on a scale whose calibration has expired or that has not passed its test-weight check.

Customer-supplied material comes through the same dock and the same quarantine, marked with its owner, and is tested like a purchased lot: the plant’s own identity test and the full specification; taking the owner’s certificate instead is a plant setting, off by default. Ready-made bulk for filling, from the customer or bought from another maker, is tested against its own specification and arrives as a bulk lot whose containers become bulk vessels, scanned at the filler exactly like the plant’s own totes.

The rules behind it: 21 CFR 211.80 · 211.82 · 211.84 · 211.184

The system works out how many containers to sample from the item’s plan: every container by default for an OTC raw material, √N+1 where the plant has justified it. Every container of a DEG/EG high-risk material that is already in an approved OTC formula is sampled and tested on its own, never composited. The plant’s own identity test on every lot of an OTC component cannot be replaced by a supplier’s certificate, and an OTC active is retained automatically at receipt. A lot accepted before its material joined an OTC formula is not issued to an OTC batch until a supplementary inspection adds its identity test, with two QC signatures.

Every item has its own tests and limits. QC records open themselves at the real event (at receipt, when mixing is posted, at filling), so no lot is ever missing one. Results are never overwritten or copied from an earlier lot: a correction is a new entry with a reason, and the old value stays visible, struck through. Outsourced tests are sent to a contract lab from the same screen, with each fee marked billable to the customer or kept as the plant’s own cost, and the certificate cannot pass until their results are in.

Every inspection carries two signatures: the analyst’s on the results, and a second QC user’s on the decision; production roles sign neither. A result out of specification opens an OOS investigation and a deviation by itself, and the analyst who entered it cannot conclude it. Only a result within specification can be corrected; one outside it goes to its investigation and is retested only if a laboratory error is found. That is BatchGlow’s rule, stricter than FDA’s guidance. Packaging is sampled by plan per role, with ISO 2859-1 sample sizes and acceptance numbers per defect class from the plant’s own table, and printed labeling is checked against the approved specimen.

Water is an ingredient of almost every formula. The lab logs water samples against the water item’s own tests; the water step records the latest accepted sample beside the weight, and on an OTC line refuses water without one. A late microbiology failure opens a deviation and finds every batch made on that water.

Bulk is tested once, on its certificate of analysis; the finished lot carries its package tests (fill, torque, seal, print, appearance) plus any test QA decides to repeat after filling, and shows the bulk results without anyone typing them twice. Raw materials have retest dates: a lot past its date is not staged or dosed until it is retested, and a retest never stretches a finished lot’s expiry.

Retain samples are pulled at the start, middle and end of every filling run, each with its own label and archive bin; retains of representative lots, chosen by the plant, are examined at least once a year, and BatchGlow works out the date each may be destroyed from the rule that applies, and refuses it before then. Stability runs on protocol templates (long-term, intermediate, accelerated, photostability); pulls become lab tasks, and a confirmed failure at a long-term or intermediate pull puts every lot of that formula version in that container and closure on hold, for every brand owner it was made for.

The rules behind it: 21 CFR 211.84 · 211.160 · 211.165 · 211.166 · 211.170 · 211.194 · FDA’s OOS guidance · FDA’s DEG/EG guidance

Leaving quarantine is one fact: the lot’s stock moves out of the quarantine warehouse once QC has accepted it. Each container then has one status that nobody types: Quarantine, Released or Rejected. Staging, dosing and the floor’s scans accept only released drums, with one signed exception for an emergency replacement, and material is reserved for an order only once it is released.

Locations run room, rack, shelf and bin, each in a zone (Quarantine, Released, Rejected) with its capacity in drums. Putaway suggests a free bin in the right zone and the storekeeper confirms by scanning it; every move is kept as history (who, when, from, to), and staging shows each drum’s address.

A drum’s balance drops with every dose. When it goes back to the shelf it is weighed again (a BatchGlow rule for every plant): the weighed balance replaces the computed one, the difference is posted, and a difference beyond tolerance (never tighter than the scale can tell) opens a deviation. Mass is kept to 0.0001 kg. Opened boxes of packaging come back counted by weight, not by hand.

Rejected material leaves the Rejected warehouse by one of three signed routes: back to the supplier, destroyed, or put by QA to a use it is still fit for. Lot numbers are unique across the plant and never change, and another customer’s consigned stock is never counted against your order, or even shown.

The rules behind it: 21 CFR 211.80 · 211.89 · 211.142 · 211.184

Play · 56 s

Staging moves drums for the whole work order, and starts as soon as released stock covers the first batch. The Staging Dashboard suggests which drum to take first: the oldest approved stock for an OTC drug, and for a cosmetic the plant’s own rule, oldest receipt or earliest expiry. Taking another needs a reason from a list, kept on that drum’s history. Each time a container is staged or weighed its lot is checked again: accepted, in date, and not on a recall, stability or OOS hold.

The pre-weigh booth is cleared before work: a sealed record of who cleaned it and when, signed with a PIN for an OTC batch, whose kit opens only under that clearance. A batch can use any number of scales, usually one for the small doses and one for the large, each added by scanning its sticker. A scale that cannot take a dose is grayed out with the reason in words: calibration expired, below its minimum weight, above its maximum. Before a scale’s first weighing of the shift BatchGlow asks for a check with a calibrated test weight (a BatchGlow rule a plant can switch off), and a scale that fails is blocked until a check passes, whatever the setting.

Every component is weighed against its target from the signed batch BOM and scanned against it; the wrong item or a lot that is not accepted is refused. The tare is taken in the terminal, and pressing tare on the scale between the two readings blocks the weight until it is re-tared. With a target, the net shows on a tolerance bar and the terminal sounds as the pour approaches it; the server still decides. A dose can be split into several containers, and an overpour goes to waste, never back into the drum. The dose label prints by button with the component, lot, expiry, net weight and its own QR, and for an OTC batch the product, its strength and the batch. The terminal does not move on while a container is unlabeled. The labeled doses of a batch make up its pre-weigh kit.

An OTC active is dosed from one lot per batch, with its weight worked out from that lot’s assay before it is dispensed; a correction outside the band the formula sets is signed by QA. On an OTC batch, a dose too small for the kettle’s scales to check is weighed a second time, by a second person, before the kit closes. A weight taken from a connected scale is kept even when it is refused, in a log nobody can edit.

The rules behind it: 21 CFR 211.82 · 211.86 · 211.87 · 211.101 · 211.68 · FDA’s data integrity Q&A

A tablet at the kettle walks one batch from a clean reactor to a posted bulk lot. The sequence cannot be performed out of order, and the record is created as the work happens. This is the screen your operators live in, and the part I most want a real plant shaping, which is exactly what a pilot site gets to do.

1. Reactor

   The operator scans the unit and inspects it on the plant’s own checklist, signed with a PIN on an OTC batch. The server judges the rest: the type the procedure names, clean and inside its clean hold, in calibration, big enough for the batch, and refuses at the first check that fails, in words.

2. Pre-weigh kit

   Every pre-weighed container is scanned: weighed for this batch and this addition, not yet added, still inside the kit’s hold time.

3. Phases

   ISA-88 phases and steps in their authored order. The kettle’s temperature is taken by itself at every addition and at “Step done”, and water is weighed at its step with the latest accepted water sample beside it. Someone who did no work in a phase verifies it on their own login before the next one starts: required for OTC, off by default for cosmetics.

4. Check

   A read-only gate before the yield: every reading outside its limits, every open deviation or investigation, every phase not yet verified, in one list.

5. Yield

   Containers weighed one by one and labeled “container k of n”; a yield outside the formula’s window opens a deviation and holds the bulk.

Each batch runs on the approved procedure pinned to it, and its record keeps a copy of that procedure, so it shows what the operator was told whatever happens to the procedure later. A value is recorded as it is taken, from a sensor reading no older than three seconds, or typed from a calibrated portable instrument the operator scans, with a reason. That is the manual path small plants live on. A value outside its limits is judged by its kind: a process control is adjusted and measured again; a critical parameter opens a deviation on an OTC batch and needs a supervisor’s sign-off on a cosmetic one; a release attribute opens an OOS investigation. The run goes on, and the lot waits for QA. Changing a saved value needs a reason from a controlled list and a PIN, and both values stay in the audit trail.

For an OTC batch the second-person check is built in, with a crew of two at minimum. The compounding operator re-weighs every closed container blind before adding it (except a dose too small for the kettle’s scales, already re-weighed at the booth) on a scale whose uncertainty is known from its certificate, and the server refuses if that operator also weighed the dose; a refusal never says by how much the weights differed. The weight of an active is set from its lot’s assay before it is weighed, and adding active to a batch already made is reprocessing, which goes through QA’s signed path.

When something goes wrong, the screen has a button for it. “Material lost” records how much of which lot: the loss is written off as waste, only what is left counts as added, and a deviation opens. A charge that cannot be finished is closed as it is by the shift lead, with a reason and PIN, and a deviation records what went in and what was missing. A replacement request shows every place the material exists (warehouse drums with their rack, quarantine lots, drums staged for other orders, doses already weighed) and is signed by the shift lead, and for an OTC batch also by QA; if QA is not available, the shift lead signs in its place, the record says so, and QA reviews it before the bulk is released. Some BatchGlow rules can be lifted with a signed reason (for an OTC component the lawful fast path is QA releasing the lot on its identity test), but an expired lot, a lot rejected by test, or a lot under recall or a stability hold can never be used, and another customer’s material is not even listed. Phase hold limits are shown and logged, never enforced; a batch that cannot be finished is aborted by QA. When the batch posts, the terminal asks one more question: clean the equipment now?

The rules behind it: 21 CFR 211.100 · 211.101 · 211.103 · 211.110 · 211.115 · 211.188

Each line’s tablet shows only the order lines the planner assigned to it. A run starts with a signed line clearance and a scan of the packaging and the first bulk container; when the first tote is accepted, the server assigns the finished lot, the printed lot code and the expiry, and creates the lot in quarantine. The expiry runs from the day the bulk was made, for the shelf life set for that SKU’s container (for an OTC product, the one its stability data support), never from the raw materials’ dates. A run fills one bulk lot into one SKU: the next tote of the same lot swaps in without stopping, and a tote from another lot is refused with an offer to close the run. A bulk lot past its hold time is refused at every scan.

Every code (the received lots, the finished lot, the printed lot) follows a template the plant sets, or the customer’s own: calendar or Julian date, year and counter, product and date, line and date, or bulk lot and run. Packaging comes from the kit cart or staging bin for that order and must match the packaging BOM signed for it, artwork revision included; labels with an expired adhesive are locked out. A lot change on the same SKU stops the line for a checklist: leftover bulk out, labeling reconciled, coded leftovers destroyed, the old lot’s identification removed, the coder reset and the first units checked; a new SKU always means a line clearance; full cleaning only when the plant’s schedule says so. While a bulk lot waits for its micro results, QA can let filling go ahead with a signature that lists the pending tests, and the finished lots stay in quarantine until the bulk passes.

Net contents follow NIST Handbook 133 and the Fair Packaging and Labeling Act, which bind cosmetics and drugs alike. Samples weighed during the run feed a control chart and signal the filler for adjustment; the lot is judged once, by acceptance sampling at the end, against the declared quantity. A product declared by volume is filled on its lot’s measured density. Removal torque and seals are checked every hour or two, and with them, where the product needs one, the tamper-evident feature QA names on its spec: on an OTC product unless QA records an exemption, and on a cosmetic oral-care liquid or vaginal product. The printed lot and expiry are checked every hour, by eye, by camera or by scanning the printed barcode. A failed check stops the run record; units made since the last good check are set aside for QA. BatchGlow never stops the machine itself: the operator does.

At close, a representative sample of the labeling is examined, the filling yield is checked against the SKU’s limits, and the system counts issued against used, destroyed and returned for every packaging line, reconciling printed labeling against limits QA sets from the plant’s history; lot-coded leftovers are destroyed and counted, never returned. On an OTC product a labeling discrepancy over the limit opens a deviation that holds the release, while the run still closes. Case and pallet labels carry GS1 barcodes where the plant uses them: BatchGlow never makes up a GTIN. It keeps the brand owner’s, checks its check digit, and numbers pallet codes, never reused, under the customer’s own GS1 prefix where it has one; a pallet holds one lot. Product kits are their own SKU with their own lot (one lot of each component, the earliest expiry), assembled from released finished lots, with every component’s mandatory label elements on the outer carton. Lot genealogy is a graph: a batch has a parent for every raw-material lot in it, a rework blend or a kit adds more, and a recall query walks them all.

The rules behind it: 21 CFR 211.122 · 211.125 · 211.130 · 211.132 · 211.134 · 211.110 · 21 CFR 701.13 · 700.25

Finished goods are born in quarantine. QA releases a lot on a checklist (the certificates of analysis, the compounding and filling records, the deviations, the lot’s audit trail, the net-content result) and signs; the server then moves the lot to finished goods. A finished lot passes only if its bulk passed, and an OTC lot only with a passing assay of each of its actives; a hospital-use OTC product also needs a passed check of its printed barcode. On an OTC lot, whoever signs the release must not have performed or checked its compounding or filling (a BatchGlow rule, for the quality unit’s independence), and a plant can require a second QA signature.

Everything that was allowed to wait during production waits here: an open item (a missing reading, a cleaning record still to be checked, a deviation still open unless QA has signed that it does not affect this lot) keeps the lot in quarantine until it is closed. In the same signature the server seals the lot’s record (compounding and filling records, results, deviations, signatures), and its hash goes into the audit trail and is printed on the batch record PDF. A bulk lot sold as it is needs its own release, not just its certificate; for a lot filled from ready-made bulk, the bulk maker’s batch record and certificate take the place of the compounding record.

For a contract OTC product, the plant’s release is the facility release: QA sends the brand owner samples and the data package (certificate and batch record), and the lot waits as “pending owner release” until QA records the owner’s decision with their document attached. If the quality agreement provides for it, such a lot can ship before that, but only to the owner’s address in the agreement, marked as quarantine, not released by the owner.

Only released lots ship, and the gate sits on every document that moves a lot out. A pallet becomes “shipped” only when it is linked to its delivery note, and the delivery notes are the recall’s distribution list. Returns come back into a separate returns quarantine and leave it only by QA’s signed decision; if a return points at a problem with the lot, QA holds the whole lot, and if other batches may be touched, an investigation follows. The only way back from a release is QA rejecting the lot, with a reason and a deviation.

The rules behind it: 21 CFR 211.142 · 211.150 · 211.165 · 211.192 · 211.204 · 21 CFR 201.25 · FDA’s quality agreements guidance

Everything with money in it goes to QuickBooks Online by itself: supplier bills and vendor credits, customer invoices and credit memos, payments with what they pay, deposits taken against orders, and a summary journal entry for inventory and cost of goods sold, monthly, daily or at every batch close, as the plant chooses. Suppliers, customers and items are matched or created there; items go over as non-inventory or service items, because the lot-tracked stock lives in BatchGlow, so cost of goods sold is never counted twice. Your accountant keeps working in QuickBooks (the books, the reports, the taxes) on complete data, and “invoice paid” comes back, so the status shows in BatchGlow too.

Sales tax is QuickBooks’ job: invoices go without tax lines and QuickBooks’ automated sales tax computes it, so it is never counted twice. Customers’ resale-exemption certificates are kept on the customer in BatchGlow, with the exemption set on the customer in QuickBooks. Customer-supplied stock goes over at zero value, so no false payables appear.

Nothing financial lives only in QuickBooks: every bill, invoice, payment and journal entry also exists in full in BatchGlow, where cost rides with the lot. Raw materials are costed by the actual weighed quantity, by lot; a bulk lot costs what it consumed, a finished lot its bulk plus its packaging, and at shipment that cost goes to cost of goods sold. Money follows the stages, one account each (raw materials, packaging, WIP, bulk, finished goods, reject), and every loss goes to a named account by its reason. Material R&D uses goes to R&D expense, or is carried as billable when the customer funds the work. Labor and overhead can be added from the records’ own times.

Connecting takes a “Connect to QuickBooks” press by the plant’s administrator, who then confirms the company name within 24 hours; the plant registers nothing with Intuit. The chart of accounts loads with one button, and the accountant maps it. Connecting does not resend the past: the accountant can send any earlier posted document by hand, and a document canceled in BatchGlow is removed from QuickBooks too. Before re-sending anything BatchGlow reads it back from QuickBooks, so a retry never makes a duplicate. If the link is down, sending waits and retries, and nothing else stops; a send that keeps failing lands on the accountant’s problems tab, and the accountant’s dashboard flags goods that arrived with no bill.

Every unit (kettle, tank, homogenizer, filler, scale, pH meter) carries a QR sticker every screen accepts, with its capacity, working window and contact material. Its status is always on screen: Sanitized, In Use, Dirty, Clean Hold Expired. The clean hold, how long a cleaned unit stays fit to use, runs from the moment cleaning is marked finished and pauses while the unit is in use; a unit used for an OTC batch is treated as OTC equipment from then on.

When a batch posts, the terminal asks whether to clean now. Yes opens a cleaning panel for each unit: the plant’s own procedure (a minor cleaning by default, a full one from a list), a tick for each step, the detergent lot, the rinse readings, and one PIN. The readings (final-rinse conductivity, total organic carbon, swabs) and the second person’s check can follow later; until they do, every lot made on that unit carries an open item to its release. A late reading out of limits sends an unused unit back to Dirty, and for a unit already used opens a deviation listing the batches made on it. The limits come only from the plant’s approved cleaning template: FDA sets no numbers. Each type of equipment sets how long a used unit may wait dirty, and the template how many batches or hours may run between full cleanings.

A changeover matrix compares the last product on a unit with the next: a new product, or a new fragrance or allergen class, demands a full cleaning, and a scan is refused until it is done. On OTC equipment a manual cleaning is checked by a second person, never the one who cleaned, from their own tablet. Totes go Empty, Occupied, Waiting for washing, Empty again. The cleaning dashboard shows every unit with its countdown, and what waits for cleaning, readings or a check.

Each unit can carry its maintenance schedule; the law asks for one on drug equipment. Jobs are recorded and signed with a PIN, the next due date counts from the day the work was done, and on OTC equipment a non-routine job is checked by a second person. Overdue maintenance never stops the plant: every screen that names the unit shows it in red, and every weighing on an overdue scale is marked for good. Calibration is checked at the moment of use, and the equipment log (dates, products, lots, cleaning, maintenance, who did it and who checked) is a report built from these records, never typed twice.

The rules behind it: 21 CFR 211.63 · 211.65 · 211.67 · 211.68 · 211.182

BatchGlow Connector is a small program on a shop-floor PC (Windows, Linux or macOS) that the plant’s instruments plug into. It makes only outbound connections; nothing on the internet connects in to it. Each PC gets its own key, an administrator confirms its fingerprint, and every reading it sends is signed.

BatchGlow works with scales from Mettler Toledo (MT-SICS, IND570, IND360), A&D GX/GF, Rice Lake 1280, Siemens SIWAREX and OPC UA weighing, ST,GS indicators, and scales behind an MQTT gateway; Zebra label printers; USB and camera barcode scanners; Vaisala HMT330 and Brookfield DV-II+ Pro sensors. Each profile is built from the manufacturer’s own documentation, and the list grows as plants need it: tell us what you run, and we connect and verify it on your equipment during the pilot. Scales, sensors, printers and serial-mode scanners plug into the Connector; a tablet’s camera, or a USB scanner typing into the screen, scans without it.

A scale or sensor gives readings only after an administrator has matched a live reading against the device’s own display; a change to its setup ends that check, and a device belongs to one unit, re-bound only by the administrator with a reason. Every weight keeps which scale produced it and whether it was read or typed, and a number read from a device cannot be edited. If a scale shows nonsense, “enter the weight by hand” is there, with a reason that stays with the weighing, but not on a scale blocked by a failed test-weight check. A reading remembers what it was taken for (this dose, this tare), and only the person who took it can use it, only for that.

Screens show each sensor live. While a batch is open on a kettle, the kettle’s temperature is logged for the whole batch (every change past the device’s threshold, a sign of life every five minutes, gaps shown as gaps), and the value is taken by itself at each addition and at “Step done”. BatchGlow writes down what the operator sees; it is not an environmental monitoring system. Devices never act on their own. Every command is one person’s press at that moment, and the only command in the first version is printing a label; BatchGlow starts, stops and sets nothing.

If the internet drops, the tablet says so and never shows an old value as current. Nothing is weighed, signed or released without a connection; steps of a batch already started can still be recorded by hand, and each is checked again against holds before it is posted, and the Connector keeps its scans and print records until the line is back. Terminals update themselves: a supervisor’s tablet sees each dose as it is recorded, and a second person’s approval reaches the operator’s screen without a reload.

The rules behind it: 21 CFR 211.68 · 21 CFR 11.10 · FDA’s data integrity Q&A

The rule BatchGlow runs on: record everything the rules call for, but stop the work only where a regulation requires the condition before the act, where the data can be captured only at that moment, or where a mistake could not be fixed later. Everywhere else the work goes on, and the lot’s release gets an open item: what is missing, who enters it, by when, and the rule behind it, with its strength: “required by”, “FDA’s position”, “industry standard”, “BatchGlow rule” or “plant setting”.

Every refusal says in plain words what is not allowed, why, and the document and paragraph behind it (or that it is a BatchGlow rule or a plant setting), and what to do next. On a shop terminal it is one short line with a “Why?” button that says why the rule applies here and links to the paragraph in the regulation library built into BatchGlow: the full text wherever the publisher allows it, otherwise a card linking to the publisher, each with its edition and the date it was last checked, open to every member of staff.

Deviations open themselves: a damaged container, an out-of-specification result, a failed scale check, a yield outside its window, a drum loss beyond tolerance, material lost at the kettle, a critical parameter out of limits, a late cleaning reading out of limits. QA rates it, the system proposes the other lots it may touch (same formula, same raw lot, same equipment), and QA decides lot by lot: use, retest, rework, reject, return to the supplier. The system carries the decision out, and a corrective action follows where it is needed, with an owner, a deadline and a check that it worked (FDA’s position for drugs, a BatchGlow rule for cosmetics). A deviation also finds every brand owner whose lots it may touch, through the production order’s lines, even before filling, and opens a notice task for each, due by its quality agreement, or the same business day without one.

Approved master data (formulas, procedures, items, specifications, BOMs, the test catalog) changes only through a new version opened by a change request QA has signed. Rework of in-spec remnants needs QA’s authorization and is capped, 5 % by default, and by default never rework of rework. Off-spec material goes into a new batch only where the plant’s policy allows it: on by default for cosmetics, off for OTC unless QA turns it on with a signature. Reprocessing a rejected batch needs a closed investigation and a signed procedure. Competencies are signed by QA, and a signature that needs one is refused to anyone not currently qualified.

Complaints are logged with their source, lot and photos; for an OTC product, QC reviews every complaint that may mean a failure to meet specifications and records its decision on an investigation. A health complaint is checked against the law’s seriousness criteria for its product type; a serious adverse event gets the hand-over deadline from the quality agreement, with the brand owner’s 15-business-day legal clock shown beside it, and a signed package for the brand owner: report, label, genealogy, certificates and batch record. Every adverse event report is kept, serious or not; new medical information within a year becomes a follow-up with its own 15 business days, and the plant files with FDA only when it is the responsible person on the label. Similar complaints on one bulk lot are counted, and three in 90 days (the plant’s default) alert QA and propose a hold and a recall evaluation.

A recall is a signed event. The moment it opens, the source lots and everything made from them that is still in stock go on hold in the same transaction; QA rules on the wider family; the distribution list comes from the delivery notes. Genealogy answers both ways, from a finished lot back to every supplier lot and from a suspect drum forward to every customer, and is designed to answer in under five seconds. Each brand owner is notified within its quality agreement’s deadline, or the same business day without one.

The rules behind it: 21 CFR 211.100 · 211.115 · 211.192 · 211.198 · 211.204 · 21 U.S.C. 364a · 364g

BatchGlow issues a single-use signing token that expires in 90 seconds, binds it to the meaning of that specific signature, and, where a competency is defined for that step, refuses it if the operator is not currently qualified.

Signing asks again for the signer’s password or signing PIN at the moment of signing; it is never carried over from the login, and a one-time code is asked at sign-in, never at signing. The PIN is separate from the password, set by each person on an on-screen keypad, and batch release, assay compensation, line clearance and weighing accept only the PIN. Every failed attempt is logged; after three in a row each try waits longer, and QA and the security contact are alerted at once. There is no timed lockout, so the line never stops; after five wrong PINs on a colleague’s tablet, that person sets a new PIN with their password.

Each electronic signature is its own record: who signed, the date and time taken from the server, and the meaning of the signature, bound to the one document it signs. It cannot be deleted, copied or moved to another record. Where the signer approves a computed result (a batch BOM, an assay correction, a move to a new formula version), the signature covers exactly the preview shown, and is refused if the result changed in between. On a night shift with one qualified person, the plant chooses which co-signatures may follow later: the record waits, the batch does not move on, and an overdue one goes to QA; the second-person check at weighing and adding is never among them.

The audit trail covers every GMP record BatchGlow keeps, and the core records that carry GMP data (batches, stock entries and reconciliations, receipts, delivery notes, work orders, BOMs, quality inspections, the GMP fields of items, user roles), for every act from creation through each save, submission, change, cancellation, rename and deletion, with old and new values, each written in the same transaction as the act itself. Every five minutes the new entries are sealed into a SHA-256 chain, and the chain’s head is written to write-once storage that not even the account owner can delete, with an independent time stamp applied on a schedule. That anchor is BatchGlow’s own rule (Part 11 prescribes no cryptography), and a plant cannot switch it off.

The chain is checked every day, and in full every week; a failed check opens a quality deviation, and the chain can be exported and checked outside BatchGlow. It is tamper-evident, not tamper-proof: someone able to write to the database could still alter what was sealed after the last anchor, and the anchor narrows that to minutes. It covers the audit trail, not every row in the database; deleting a record keeps a full copy of it, and the security page says exactly what the chain covers.

The rules behind it: 21 CFR 11.10 · 11.50 · 11.70 · 11.200 · 11.300

An OTC monograph product gets full 211 gating: the active’s weight set from its lot’s assay, a second person checking each weighing and addition, the plant’s own identity test on every lot, release on a passing assay. On a cosmetic line, cosmetic law stops work outright, and so do a few BatchGlow rules that say so: quarantine at receipt, lot traceability, two owners’ material never mixed. Every other control borrowed from drug cGMP or ISO 22716 (clean hold, line clearance, release discipline, stability) is a plant setting marked “not required by law”: most on by default, any of them yours to switch off. Checks that exist only for drugs, such as the second person re-weighing every dose, do not apply to a cosmetic.

FDA has not issued the cosmetic GMP rule MoCRA calls for. Every plant setting is its own switch, and says what it does, whether the law requires it and what it defaults to; a setting that turns a control off for cosmetics says what the plant risks under cosmetic law: a product made or held under insanitary conditions is adulterated, and FDA can order a recall and suspend the facility’s registration. A refusal that comes from a setting says “plant setting, not required by law”; on an OTC line the same refusal cites the paragraph. That is also how to read the rules listed on this page: 21 CFR 211 and Part 11 bind OTC drug products, and on a cosmetic line the same controls are plant settings, unless the rule cited is cosmetic law (21 CFR 700–740 or the FD&C Act’s chapter VI) or a BatchGlow rule.

The whole system is organized around this split: a formula becomes OTC by itself the moment one of its ingredients is an OTC drug component. Pick a product and see its regime.

The rules behind it: 21 CFR Part 211 · 21 U.S.C. 364b (MoCRA §606) · 364g

BatchGlow builds the ingredient declaration from each raw material’s composition statement and orders it as 21 CFR 701.3 requires; an ingredient without a composition statement cannot be declared. An ingredient the brand holds as a trade secret, with FDA’s letter, is printed on the label as “and other ingredients”.

It keeps each facility’s registration and builds each cosmetic product listing as SPL XML, the file format FDA accepts, from the signed ingredient declaration, checked against FDA’s published schema before it is attached, and follows it through upload, confirmation and renewal. For customers who export to the EU, it works out the fragrance allergens from the raw materials’ composition statements.

For an OTC product, it builds the Drug Facts panel from the approved formula and refuses to sign it while an active-ingredient row lacks a required field or a required section is blank; inactive ingredients run alphabetically on a pure drug, and in the cosmetic order on a product that is both. A plant that qualifies for MoCRA’s small-business exemption gets a warning instead of the registration and listing stop. Each product’s VOC content is checked against its category limit at formula approval, and a lot-code template for a product regulated by California’s air board cannot be saved unless the date of manufacture can be read from the printed lot.

The rules behind it: 21 CFR 701.3 · 720.8 · 21 U.S.C. 364c · 21 CFR 201.66

For a contract manufacturer this is a security control. Formulas carry their owning customer, customer-owned material carries title, and combining material belonging to two different owners into one lot is a hard error that no one can click past.

A quality agreement per customer records who gives final release, the deadline for notice of a deviation, the lot-number format, and who owns expiry, samples and complaints. For another brand’s OTC product it is required before a lot can be released (a BatchGlow rule following FDA’s guidance); for cosmetics the plant decides, and the plant’s own brand needs none. Shared tablets hold only the steps and targets of the batch in hand, never a customer’s whole formula.

The rules behind it: FDA’s quality agreements guidance

Each plant gets its own site with its own database. The database’s transaction log is copied continuously to another zone, against two targets: lose no more than 15 minutes of data, and be back within four hours from a standby server. Your data is yours to take: one command exports the whole site (batches, signatures, audit history, genealogy, master data, attachments) in CSV and JSON, with the audit chain checkable from the exported files and no password or PIN hashes or site keys in it, and handing the instance over to another provider is a documented procedure the agreement refers to. On-premises installation is a separate offer.

Every tier has unlimited users and terminals, and Part 11 signatures and lot traceability are in the base tier. Official printouts carry your company’s name and logo, never BatchGlow’s. Logins, logouts and failed attempts are kept for three years, read-only for everyone; shop terminals sign out after 15 idle minutes by default. No custom scripts run on a plant’s site, for anyone, because a script could read a PIN. There is no System Manager on a plant’s site: the plant’s administrator assigns roles and changes plant settings, but cannot grant System Manager, change its own roles or sign in as someone else. Support signs in only under a named account the plant enables for that request, and BatchGlow’s own emergency access is logged with a reason.

BatchGlow is built to support 21 CFR Part 11; validating it for your intended use stays with you, and the release cycle is built for that. OTC plants, and any plant that chooses it, get a release channel built for their validation: three planned releases a year, each with a package four weeks ahead (release notes, an impact assessment by GMP function, the changed requirements and the test evidence), and a pre-release copy of their site to test it on. For each release BatchGlow documents the installation on its hosting and supplies the test evidence; acceptance testing on your processes and the decision to go live stay with you. Security fixes come outside the schedule with the same package, and a release can be put off one cycle.

The rules behind it: 21 CFR Part 11 · FDA’s data integrity Q&A

Systems that treated a formula as a parts list and could not express a phase or a percentage. And audits turning into week-long emergencies because the records existed only on paper, in a binder, in three places that disagreed. BatchGlow is my attempt to build the system that plant needed, and to build it for the plants that cannot buy their way out of the problem. Who builds it.