A customer-controlled application changes the security conversation, but it does not eliminate the need for a strong security program. REMETREX PQMS provides an application foundation; the customer controls many of the surrounding operational controls.

The strategic model places the production application inside the customer’s infrastructure, allowing the customer to apply its own infrastructure, network, identity, monitoring, backup, and security controls.

The organization can establish its own policies for user access, role assignment, privileged access, review, and deprovisioning.

The customer’s environment becomes the primary operational boundary for complaint data. Data retention, backup, encryption, disaster recovery, and related controls should be defined by the customer’s security architecture.

Application changes should move through the customer’s development, testing, security review, approval, and release processes.

AI-assisted development should be governed by organizational policies covering code access, confidential information, tool permissions, review, testing, and approved development environments.

The strategic materials emphasize no ongoing vendor access to the production environment after delivery. Any support arrangement requiring access should be explicitly defined, approved, and controlled.

Security is shared across the application and the environment. During evaluation, Quality and IT should review the technical architecture, deployment model, controls, support boundaries, and customer responsibilities.