AQUALAB 5TE technical FAQs
The AQUALAB 5TE is a bench-top water activity (aw) and moisture content meter. It can run as a standalone instrument or connect to AQUALAB Cloud, a browser-based application for storing and managing readings. This page answers common questions from IT, quality assurance, and validation teams. It covers how the AQUALAB 5TE and AQUALAB Cloud handle data, user access, audit trails, and 21 CFR Part 11 requirements.
For general product questions, see the AQUALAB 5TE product page.
System architecture and connectivity
Please provide the complete system architecture diagram showing instrument, PC/workstation, application software, database and network connectivity.
See figure 1 below
Figure 1: AQUALAB 5TE and AQUALAB Cloud system architecture
Is the system standalone or network-based?
The AQUALAB 5TE can operate either standalone or network-connected. Three operating modes are available:
- Standalone, without internet connection
- Standalone, with internet connection – the connection is used for over-the-air (OTA) software updates.
- Connected to AQUALAB Cloud
Does the application support Windows 10/11 Pro?
Yes. The AQUALAB 5TE supports direct data export to a connected computer via USB, and both Windows 10 and Windows 11 are supported.
AQUALAB Cloud is a browser-based application and requires no local installation.
Data storage, backup, and export
What database technology is used?
AQUALAB 5TE:
The AQUALAB 5TE stores its data in SQLite 3.38.5, an embedded database inside the instrument. The data includes readings, products, users and settings. The database is in the instrument's internal storage at /data/customer. It is not exposed on the network. Write-ahead logging (WAL) protects the database from damage if power is lost during a write.
The instrument does not make its own backups. When the instrument is connected to AQUALAB Cloud, it uploads its data, and the cloud copy is the backup. When it is not connected, you can export data to a connected computer.
AQUALAB Cloud:
AQUALAB Cloud stores data in Amazon RDS for PostgreSQL 15, a database service managed by Amazon Web Services (AWS). Your data stays in the region you select:
- US: Ohio, us-east-2
- EMEA: Frankfurt, eu-central-1
- APAC: Singapore, ap-southeast-1
Encryption: data is encrypted at rest with AWS Key Management Service (KMS), and in transit with TLS.
Availability: each production database runs in Multi-AZ mode. AWS keeps a standby copy in a second data centre in the same region and switches to it automatically if the primary fails.
Backups: AWS backs up each database automatically every day and keeps the backups for 30 days. Transaction logs are kept too, so the database can be restored to any point in time within those 30 days, to the nearest 5 minutes.
Protection: each database has deletion protection. Its backups are kept even if the database is deleted.
Access: the database is in a private network, with no public internet access. Only the AQUALAB Cloud application can connect to it.
Does the instrument application support data backup?
Yes:
- When the AQUALAB 5TE is connected to AQUALAB Cloud, all reading and verification data is automatically backed up to the cloud.
- In standalone mode, all reading and verification data can be manually exported to a connected computer.
Is automatic backup available?
Yes, for AQUALAB 5TE instruments connected to AQUALAB Cloud, which automatically sync their data to AQUALAB Cloud. Standalone instruments require manual export (see A16).
Can the complete database be restored to a replacement PC?
No. Database export is not supported. AQUALAB 5TE and AQUALAB Cloud support export of reading and verification data in PDF, XLS, and CSV formats.
Users, roles, and passwords
Does the application support user management, including user creation, modification, disabling, locking, and unlocking? Is there any limitation on the number of users?
Yes. Both AQUALAB 5TE and AQUALAB Cloud support user management for Admin and Technician users, including user creation, archiving, and unarchiving. All users must log in with their own credentials.
There is no limit on the number of users.
Does the application support privilege matrix configuration, including user roles and the mapping of users to roles/groups?
Both AQUALAB 5TE and AQUALAB Cloud provide fixed role-based access control with two predefined roles: Admin and Technician. Custom role-based access management will be supported in an upcoming release.
Does the system support password policies, including minimum password length, password complexity, password expiry, password history, and handling of invalid login attempts?
Yes, AQUALAB Cloud enforces the following minimum password requirements:
- 8 characters
- 1 uppercase letter
- 1 lowercase letter
- 1 special character (e.g. @_!#$%^&*()?)
Password and PIN expiration policy is supported (None, 90 days, 180 days, 365 days) and documented.
Password history is not currently supported.
Failed login attempts are not currently recorded.
Can an administrator disable or remove users without deleting their historical records?
Yes. Users can be archived without affecting any historical records. Reading and verification history on both AQUALAB 5TE and AQUALAB Cloud is immutable and cannot be deleted. Each reading record remains permanently attributed to the user who created it, even after that user has been archived.
Does the instrument/application have a Super Administrator account? If so, can such accounts be used by service engineers? How does the OEM control and monitor access to such accounts?
Addium-authorized service technicians can log in to the AQUALAB 5TE to perform instrument calibration. Customer data remains read-only for these accounts.
Audit trail and records
Does the software provide a secure, computer-generated audit trail?
Yes. Every reading and verification is recorded with a timestamp, user, and result. Readings cannot be altered or removed. In addition, the event log can be exported from AQUALAB Cloud.
Does the audit trail record the user ID, date and time, old value, new value, reason for change, and action performed?
Yes. The AQUALAB Cloud event log captures the date and time, user, device, event (action performed), old value, and new value.
Can audit trail records be edited or deleted by users or administrators?
No. Records and event logs cannot be edited or deleted by any user, including administrators.
Can users with administrator privileges modify or disable the audit trail?
No. The event log cannot be modified or disabled.
21 CFR Part 11 and electronic signatures
Does the system support electronic signatures?
No. Electronic signatures are not currently supported. Signature requirements are met through a documented hybrid (paper signature) process where data is stored and protected electronically, and signatures are applied by hand to exported reports.
Are the Instrument/application 21 CFR Part 11 compliant?
Yes, AQUALAB 5TE and AQUALAB Cloud provide technical controls that support 21 CFR Part 11 compliance, including unique user logins, role-based access control, immutable reading and verification records, and a secure, computer-generated audit trail. Electronic signatures and password expiry are not currently supported; where these are required, they can be addressed through the customer's procedural controls
Date and time
Is the instrument/application date and time controlled?
Yes. On AQUALAB 5TE instruments connected to AQUALAB Cloud, date and time are set automatically from AQUALAB servers (UTC) and cannot be changed by users.
On standalone instruments, the user can manually set date and time.
Is the instrument/application date and time synchronized with an NTP server?
Yes. AQUALAB 5TE instruments connected to AQUALAB Cloud synchronize date and time (UTC) with AQUALAB servers.
Need help with a vendor assessment?
Our team can answer questions that are not covered here.