One page to forward
to Supplier Quality.
What we accept, what we document, and what we guarantee as a software supplier to a regulated manufacturer. Your process, not ours. Where a fact is not on this page, it is sent with the NDA.
Your NDA, your MSA, your quality agreement
We sign yours. Change notification, defect notification, right to audit, records retention, complaint and inspection support, and named subcontractors are all acceptable clauses.
Questionnaire, then a remote audit
Supplier questionnaires answered in full. A remote audit of our software lifecycle against ISO 13485 7.4, IEC 62304 and your SOPs, with findings closed before work starts.
Background checks, your devices, your training
Both principals and any named member of the circle: background-checked, on your managed devices or VDI, trained on your design-control and SCM procedures, with training records kept.
Work for hire. No PHI. Your AI policy.
Everything written for you is assigned to you. No production or patient data in test environments. No client source goes to an external model without your written permission.
SOUP records and safety class
Identification, version, functional requirements fulfilled, known anomalies evaluated against your hazards, verification evidence, and a change notice before every release.
SBOM in CycloneDX or SPDX
Transitive dependencies, support status and end-of-support dates, a coordinated disclosure process, and a vulnerability notice inside thirty days.
Applicability table
Which alarm-system clauses a phone can meet, which it cannot, and why. An argument your risk file can cite, not a mapping that pretends a phone is equipment.
Devices, builds, settings, results
Every Kit run and every Reach Report states the device, the OS build, the setting and the result. Tool validation records for the Kit are supplied so its output can enter your file.
What happens if one of you is unavailable?+
Two principals, both on every engagement, both able to sign. Licensed code is held in escrow with release triggers you define. Embedded work is documented so that a handover is a checklist, not an archaeology. The circle is named in the quality agreement and can be brought in with your approval.
Do you hold ISO 13485?+
We work to your quality system under a documented, IEC 62304-conformant lifecycle that is open to audit. Certification of our own is on the roadmap for the first licence customer who requires it; until then, the audit is the evidence.
Insurance, entity, banking?+
Certificates of professional indemnity and cyber cover, the legal entity, registered address and identifiers are sent with the NDA, together with what your vendor-creation process needs.
Agents wrote it. Who read it?+
A person specified it, reviewed the diff, verified it on the device and signed it, under a written procedure we hand over with the SOUP record. In your repo, your AI-tooling policy applies, not ours.
You spent ten years inside Abbott's app.+
Everything from those years stays with Abbott, under their agreements and ours. Reach is built clean-room from the public standards and our own devices. Where a conflict of interest exists, we say so before the first call and decline the work.
Time zones and coverage?+
San Francisco and Palma. Between them, a working day that overlaps the Americas in the morning and Europe in the afternoon. Coverage windows are written into the SOW, and so is what happens outside them.
Payment terms?+
Invoice against your purchase order, net 30 to net 60. Fixed fees for scoped work; monthly per product for Embedded and for SDK maintenance. No change orders on a fixed scope; a new scope gets a new number.
Send the questionnaire.
We fill it in before the first call, so the call is about the alert path.