Veeva validates their release.
You still have to validate your configuration.

Questions from validation, QA and IT security

Does Lastest replace our validation process?

No. Lastest is a test runner, not a validation system and not a quality management system. It executes the scripts you already own and produces evidence inside your existing process — your change control, your approvals, your validation summary report. Nothing about Lastest changes who signs, what your SOPs require, or how you assess risk. It changes how the execution step is performed and how the resulting evidence is captured.

Where does our Vault data live when we run this?

On your infrastructure. Lastest self-hosts via Docker inside your own network — the runner, the screenshots, the baselines and the reports all stay on disk you control. Nothing is uploaded to a third-party service to be diffed, and it can run air-gapped. That matters here because prerelease Vault screens contain the same regulated content as production.

What happens to our tests if we stop using Lastest?

You keep them. The output is plain Playwright code in your own git repository — readable TypeScript, not rows in a vendor database and not a proprietary model format. You can hand it to an auditor, to a CRO, to a new validation partner, or to whichever vendor replaces us, and it runs without Lastest installed.

Does AI run while the tests are executing?

No. AI is used at authoring time — when you record a flow or repair a broken step. What it produces is a Playwright script. Replay executes that script with no model call in the path, which is why the same run against the same build produces the same evidence. You also supply your own model endpoint (a hosted provider or a local one), so no test content is sent anywhere you did not choose.

How does this relate to Veeva's Release Impact Assessment?

It sits downstream of it. The RIA tells you which features changed, their GxP risk rating, and which are auto-on. It does not know your Vault configuration, your document types and lifecycles, your policies, or how your users actually work — Veeva publishes it as a general assessment. You read the RIA to decide scope; Lastest is how you then execute that scope against your own configuration and capture what the screens actually did.

Can it run against a prerelease Vault?

Yes — a prerelease Vault is a URL your team can reach, and Lastest drives it through a real browser. The usual pattern is to baseline the flows in your current general release, then replay the same flows against the prerelease Vault and review the differences screen by screen before the general release date.

Does Lastest provide electronic signatures or a Part 11 audit trail?

No, and we will not claim otherwise. Lastest is not an electronic records or electronic signature system: it does not provide Part 11 signature manifestations and it does not maintain a regulator-facing immutable audit trail. It generates deterministic, timestamped test artifacts. Retention, review, approval and signature stay in the systems and SOPs you already use for those things.

Do we still need to write PQ and UAT scripts?

Yes. Your scripts encode your intended use, and that is exactly the part a vendor cannot do for you. Lastest does not invent test coverage — it records the steps of the scripts you already have and replays them on demand, so the third and fourth execution of the same script costs you a scheduled run rather than another week of people clicking.