IMGIAINFO

Frequent questions

What a visitor
wants to know

Short answers. If yours is not here, we want to hear it — write to us.

What exactly do you do?
Tailor-made platforms. We take a process that lives on paper or in a spreadsheet and turn it into a system that does the work for real, with the trace that goes with it. One team, from the workstation to the server.
What does ALCOA++ mean?
The rule that governs everything we deliver: the nine attributes of data integrity — attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available — plus two things we put on every line: the identity of the machine, and the verification of the chain. The acronym is written with two plus signs in all our documents. The full page is here.
How do you put an LLM in the loop without breaking ALCOA++?
The model creates nothing and signs nothing. Actions are written and validated in advance by humans; the model builds patterns out of those pre-prepared blocks, it chooses and it orders. Nothing enters a record without a named person validating it, and that validation is itself an entry in the log. The detail is here.
Will it pass an audit?
We answer with the trace, not with a promise. Four jurisdictions concern us: the FDA (21 CFR Part 11, functional requirements), China (NMPA, management and technical measures), Japan (PIC/S PI 041-1 and its nine attributes) and Health Canada. All four are technologically neutral: they state what the record must say, not the brand of the tool.
Is hardware on an approved list required?
No — none of the four jurisdictions has an approved-hardware list. What exists are lists of certified cryptographic modules (FIPS 140-3 from NIST and Canada, Common Criteria) that some quality departments like to cite. The real subject is not the list: it is the substance. A SHA-1 era chip cannot be defended, because SHA-1 was withdrawn from the algorithms approved for signatures.
How do you know who wrote what?
Through named accounts, one per employee. A shared account that creates or changes a batch value cannot be traced back to the person who acted — that is written plainly in PIC/S PI 041-1 and in Annex 5 of WHO TRS 996. The administrator role remains: it is simply carried by people.
What if three operators share the same workstation?
It is the same problem, one level lower — and the texts cover network environments too. That is where the two identities separate: the person is a named account, the machine is a key. The record names both.
How is the machine identified?
On first contact its key is pinned, and that key signs the actions afterwards. The machine identity becomes a fact rather than a declaration — with no list of approved machines to maintain.
Is a hash chain enough?
No, and we say so ourselves: it detects a change, it does not prove one. Anyone who can write the file can recompute the chain. Non-repudiation requires a signature that demands a secret. We add that where the stakes justify it, and we do not sell a chain as proof.
Can the model be wrong?
Yes, and the system is built for it. A wrong proposal is a wrong proposal: it does not enter the record until a human validates it, and the log keeps the proposal as well as the decision.
Where do your models run?
Where your rules demand it: on your hardware, inside your network, or with a provider you choose. No dependency on a service you do not control.
Do you take over an existing system?
Yes. We start from what already runs — an application, a paper process, a set of files — and we add what is missing: structure, traceability, safeguards, validation. A full replacement is possible, but it is not the starting point.
How do you cut the dependency on American companies?
By replacing what can be replaced with free software installed at your site: Linux instead of Windows, Droidian instead of Android and its services, our own self-hosted git forge instead of GitHub, open models on your hardware instead of paid APIs. The sovereignty page lists what goes and what comes in.
Does a large model require a new server?
No. A model does not have to fit inside the graphics card: only the part that is active needs to be within immediate reach, and the rest can live in system memory and on disk. An 11 GB card and 30 GB of system memory run a large mixture-of-experts model — and on targeted tasks it does the work usually asked of a paid service, with the data staying at your site.
What language do you work in?
French and English. Client documents can be delivered in either.
How do we reach you?
info@imgiainfo.com — IMGIAINFO inc., Québec, Canada.