Validation of Bitbucket for use in safety-critical development

[GlenLarson]

For use in a safety-critical medical device, the tools that affect product development need to be valid for their use. This includes the revision control system and issue tracking system.

We're using git with Bitbucket and the Bitbucket issue tracker for an FDA Class IIb device with software that is Class C per IEC 62304.

Are there any validation reports available from Atlassian for these tools? Are there any test protocols available to help us test them ourselves?

[Matteo Gubellini _SoftComply_]

Hello Glen,

We have some experience in the validation of Atlassian tools, but not for Bitbucket in particular.

Anyway we can help you in defining the approach if you like.

Matteo

[JimmyVanAU]

Hi Glen,

While I don't have any direct documentation, you might like to post this question in the Life Sciences group to see if anyone can help there:

https://community.atlassian.com/t5/Life-Sciences/ct-p/life-sciences

I can see on community a lot of chatter about e-signatures and document sign off (https://community.atlassian.com/t5/Confluence-questions/Confluence-for-FDA-Regulated-Document-Management/qaq-p/78273, https://www.midori-global.com/blog/2018/05/22/creating-complete-and-accurate-records-for-fda-inspections-from-jira, https://softcomply.com/must-have-apps-on-atlassian/ and https://www.slideshare.net/GoAtlassian/innovation-regulation-how-eli-lilly-customizes-atlassian-to-find-the-balance), but I can't see anything related to your particular issue or any validation test reports. I think raising a support ticket with Atlassian directly would be your best bet. 

[GlenLarson]

Thanks, Jimmy.

The need to validate tools in common across multiple domains like vehicle control and aerospace. Validating a cloud-based system is challenging as users have zero control over the programs and systems being used.

I'll file a ticket.

[JimmyVanAU]

Forgot to mention this earlier - Atlassian's Trust page https://www.atlassian.com/trust might be helpful, but it's mostly to do with information security compliance more than anything. There may be something helpful?

[laurenkeith]

Hi Glen - Wondering if you got resolution on this, as I have similar questions.

[GlenLarson]

No.

I ended up writing a test protocol. Automated test scripts (bat files) perform the operations we use and then diff the file trees to  check for being same and different as appropriate.