traceunified

Requirements, architecture, tests, risk, and SBOM on one live graph.

Retire the stack. Keep the thread.

Try for free Book a demo

30-day trial · no payment · your own workspace

The Traceability panel of user requirement PMS-UR-002 Real-time Vital Signs Display: downstream, test PMS-TC-002 and system requirement PMS-SYS-002, both flagged suspect, then constraint PMS-CBK-001, software requirement PMS-SWREQ-001, block PMS-BLK-003 and test PMS-TC-018. Six downstream links, two suspect.
One requirement in the app: everything it drives, and two links flagged for re-verification after a change.

The problem

Your traceability lives in the gaps.

Five disciplines, five tools, one hand-built matrix before every audit. The link that broke between systems is the one the auditor finds.

Requirements
Authoring tool
Architecture
Modeling suite
Tests
Test manager
Risk
Spreadsheet
SBOM
Scanner export

Each tool is good at its own part. None of them holds the links between them.

Try it on the real thread.

A 30-day trial opens your own workspace in about a minute, with a populated sample project already linked. No payment.

Try for free Book a demo

How it works

Five core modules, connected by traceability. One system of record.

Requirements, architecture, tests, risk and SBOM are linked records on one model. Review, approval, versioning, training, audit, reporting, import and release work the same on every module — and a governed AI assistant reads across the whole connected model: it proposes, you decide, on a model you bring, and never edits the record.

Traceability between modules AI reads across the model Available on every module Change → re-verify
Click any core module to see what a change makes suspect across the connected model.
On every module
Tap a module to see what a change makes suspect across the connected model.
On every module
Platform

Scope & licensing

Take one module. Or all five.

traceunified is licensed per module. If requirements are all you need, license Requirements — nothing else appears, and nothing else is billed. Add tests, risk, architecture, or SBOM when the work asks for them. Two engineers or two hundred; the platform doesn't care how big the project is.

Requirements
Author, version, baseline, trace
license on its own
Tests
Plans, runs, defects, coverage
license on its own
Risk
Score, mitigate, residual risk
license on its own
Architecture
SysML models, allocation matrices
license on its own
SBOM
CycloneDX / SPDX, vulnerabilities
license on its own

Included with any license, however few modules you take:

TraceabilityReviewsReleasesReportsImportsComplianceTrainingE-SignaturesAudit Trail ExportAPI AccessSSO (SAML/OIDC)

Taking several? Core (Requirements + Tests), Professional (+ Risk) and Enterprise (+ Architecture) bundle them at a lower rate than buying each alone. See how licensing works →

Compliance is a switch, not a toll gate.

Signatures, approvals and controlled states are configuration. Electronic signature is a checkbox on a workflow, and it ships off — turn it on for the workflows that need it, and only those.

Normal project Controlled project
Traceability & impact analysis On On
Versions & change history On On
Reviews & comments On On
Electronic signature Off On
Approval chains Off On
Controlled states & locks Off On

Same data, same graph, same tool. The team shipping a consumer app runs the left column and never sees a signature dialog. The team filing a 510(k) turns the right column on — and because the history was there all along, the evidence is already written.

Governed AI

AI you can turn on in a validated environment.

traceunified's AI is a governed advisory layer. The agents analyze and propose — they never write to your records. A human applies every change through the signed, audited workflow. AI is additive, never authoritative — the thread stays deterministic, every link still explicit and human-made.

Advisory by design
Agents surface issues and propose improvements — they never edit your records. Humans apply every change.
Fail-closed & license-gated
AI starts off at every level and cannot be enabled without an active AI license. Turning it off is always allowed.
Layered control
Org master switch, per-agent on/off, and per-project delegation — you decide exactly where AI runs.
Your key, your model
OpenAI, Azure OpenAI, Anthropic, or your own endpoint. No shared model sits over your data.

OpenAI · Azure OpenAI · Anthropic · your own endpoint

See how the governance works →
The Advisor panel on requirement PMS-UR-003: Intelligence tab, a Quality Advisor run, a 62/100 score with 3 errors and 2 warnings, and proposed rewrites of the description, acceptance criteria and rationale.
Advisor → Intelligence on a live requirement. The rewrite is a proposal; the record is untouched until someone applies it.

The derivation engine

Derive the whole thread from your requirements — grounded, cited, and yours to accept.

Point the engine at a set of requirements and it proposes the downstream work products they imply. Every item cites a real source; you accept what's right. The record only ever changes by human action.

Requirements Requirements
Requirements Tests
Requirements Architecture
Req + Arch Risks (FMEA)
Architecture SBOM
See how derivation is governed →

See it in action

The real product, screen by screen.

No mockups: every view is the live app, on a real demo project. Click any screen to see it full size.

traceunified Dashboard view
The project dashboard — completion by module, approval progress, approval and trace readiness, and the traceability chain, live.
traceunified Requirements view
A requirement in review — its identity, version and workflow, with Approve and Reject on the record and an e-signature required.
traceunified Architecture view
A SysML use case diagram — the clinicians and technicians who use the system and what they do with it, native MBSE on the same governed model.
traceunified Tests view
A test case with its steps and expected results, governed like every other record.
traceunified Risk view
A risk scored for severity and probability, with a mitigation traced to its control and its test.
traceunified SBOM view
A component with its package URL, supplier, SPDX license and SHA-256 integrity hash.
traceunified Traceability view
The traceability dashboard — every relationship rule across requirements, risk, architecture, SBOM and test, with link counts, coverage and suspect links at a glance.
traceunified Review Center view
A completed review session — every item in scope with its decision, who reviewed it, and the record beside it.
traceunified Approvals view
Multi-step electronic signature chain — who must sign, signature history, e-sig enforced.
traceunified Releases view
Releases as governed bundles — the modules and items each one carries, tracked from draft to released.
traceunified Reports view
The report library — 67 built-in reports across 13 categories, and a drag-and-drop builder for your own.
traceunified Ask AI view
Ask AI answers from the project itself — here, the 7 user requirements no test verifies yet, grounded in 51 cited records. Records change only when you accept a proposal.
traceunified Advisor view
Advisor Intelligence scores a requirement, names its errors and warnings, and proposes an EARS rewrite. Nothing changes until you act on it.
See the full platform tour →

Compliance spine

Audit-ready when you need it. Never bolted on.

The controls a regulated submission depends on are part of the data model, not a plug-in — so turning them on is configuration, not a migration. Projects that don't answer to a standard leave them off and lose nothing. Projects that do switch them on and find the evidence already written.

Available on every project · enforced only where you enable it

  • Tamper-evident audit trail — every entry hash-chained to the one before it
  • Electronic signatures with required meaning-of-signature and password re-authentication
  • Baselines, locks, and release re-verification gates
  • Formal reviews with decisions, participants, and revision snapshots

One spine, configured to the standard you answer to:

21 CFR Part 11IEC 62304ISO 14971ISO 13485EU MDRISO 26262IEC 61508DO-178CIEC 62443
The project audit trail filtered to e-signatures: the chain last verified intact across 99 rows, counts by entry type, filters by date, type, module and user, Verify chain and Export CSV, an item owner's signature on PMS-SYS-006 recorded with its meaning, Reviewed, and the training-completion signatures before it.
The project audit trail. Every entry is hash-chained to the one before it, and Verify chain walks the whole chain.
An item's approval chain, 1 of 3 signed: the item owner has signed as Reviewed, Engineering is next with Sign as Reviewed and Reject submission, Quality is waiting, and on full approval the item moves to Approved. Below it, the signature history: signed by Josh Kirk at step 1, Item Owner, on 10/9/2026 at 5:40:43 PM, meaning Reviewed, with its signature hash recorded at signing.

Approvals & electronic signatures

Every approval an item needs, signed in order.

An approval chain lists who must sign and in what order: here the item owner, then Engineering, then Quality. Each step shows whose turn it is, and the item moves to Approved only when the last one signs.

With electronic signature on, the signer re-enters their password and states what the signature means. The signature is recorded with that meaning, the time, and a signature hash computed at the moment of signing, so an edited record no longer matches it.

Security

Controls live in the architecture, not in a policy.

What a security review looks for — isolation, encryption, access, and how we run it on AWS.

Isolation

  • Isolated database per customer
  • Dedicated: own database cluster and KMS key
  • Self-hosted and air-gapped option

Data

  • Encrypted at rest with KMS and in transit
  • AWS Backup plans
  • Restore drills on production backups

Access

  • SSO, SAML, SCIM, role-based access
  • Server-enforced Part 11 re-auth
  • Tamper-evident audit trail

Monitoring

  • AWS WAF in front of the app
  • GuardDuty, CloudTrail, Security Hub
  • 100+ build gates and dependency audits

Runs on AWS: containers on ECS, PostgreSQL on RDS clusters, infrastructure defined as code. AI is bring-your-own-model and advisory only; no customer data trains a shared model. Trust Center →

Built for your industry

The same platform, tuned to your standards.

One traceability model. Configure it to the standard you answer to — or leave the compliance controls off when you don’t need them.

Strongest fit

Medical devices

IEC 62304 · ISO 14971 · ISO 13485 · 21 CFR Part 11
  • Hazards linked to mitigations and tests
  • SBOM traced for cybersecurity submissions
  • Signed releases for design history

Aerospace & defence

DO-178C · SysML · air-gapped
  • SysML models on the same trace as requirements
  • Self-hosted in secure, offline networks
  • Import from DOORS and Cameo

Automotive & industrial

ISO 26262 · IEC 61508
  • Safety requirements traced to verification
  • Jira and GitHub kept in sync for software teams
  • Change impact visible before release

Everything else. Software, hardware, internal tools — same modules and traceability, with signatures and approvals switched off.

See it for yourself

Judge it on the work.

Start a free trial and land in your own isolated workspace with a populated sample project — the whole thread, already linked.

Try for free Book a demo

yourteam.traceunified.com