An MHRA inspection passed with no findings on communication retention

Castleton Labs run analytical and stability testing for pharmaceutical clients. Their internal communication had grown up on a consumer messaging tool with no retention control, no export capability and message history sitting outside the UK.

An MHRA inspection was scheduled. Their quality team could not answer, with evidence, what internal discussion had taken place around specific batch decisions — and could not have produced it if asked.

What we did

The engagement started with a policy workshop rather than a deployment. Retention differs by channel at Castleton: seven years on channels touching batch decisions, considerably shorter elsewhere. Agreeing that with their quality team before building meant the configuration matched the written policy rather than approximating it.

We deployed Mattermost into their own infrastructure with per-channel retention, object storage under their control, and SSO with directory sync so leavers lose access on the day they leave.

Compliance export was the part that mattered for the inspection. We configured scheduled exports in the format their auditors expect and, critically, the evidence trail showing each export ran and was complete. An export you cannot prove ran is not a control.

History from the previous tool was migrated where it existed, with a mapping report stating plainly what could not be recovered.

The outcome

The inspection passed with no findings against communication retention. The quality team were able to produce the discussion around a specific batch decision during the inspection itself.

Message history is in Castleton’s own database, in the UK, under a retention policy their quality team wrote and can evidence.

The migration mapping report — including what could not be recovered from the old tool — was itself disclosed to the inspector, which their quality director considered more useful than a clean-looking gap.