FAQ

MasterControl Integrations FAQ

Companies worldwide understand the benefits of integrating business systems

together to achieve greater quality and automation within their digital ecosys-
tem. This frequently asked questions (FAQ) document provides an overview of
MasterControl’s approach to systems integration.

Integrations Basics
How do I integrate MasterControl with my third-party systems?

MasterControl understands that integration is crucial to improve efficiency

and reduce rework and errors. MasterControl supports integrations in two
ways:

• MasterControl-led integration: You may choose for MasterControl

to lead the integration between our software solutions and your
system(s). If you select this option, MasterControl will use pre-built,
standardized MuleSoft connectors to facilitate an integration that
meets your requirements.

• Customer-led integration: Depending on the maturity of your/your

partners’ IT organization, you may decide to lead your integration.
In this case, MasterControl will provide Integration Architecture
Services to consult, advise, and onboard customers or third-party
system integrators on the best way to build your integrations to
communicate, connect, and exchange information with MasterControl.

What third-party systems can MasterControl connect to?

MasterControl can be connected to virtually any system that has APIs or

data connectivity. If MasterControl manages the integration, we will use
the MuleSoft Integration Platform as a Service (iPaaS) platform, which has
several pre-built connectors:

• To learn more about available MuleSoft connectors,

visit https://www.mulesoft.com/exchange/.

• Other connector providers, such as CDATA, have libraries

MasterControl can access. For more information, visit https://www.
cdata.com/mule/.

• There are also generic connectors, for example HTTP/REST,

database, and message queue connectors, that can be customized
and used to connect MasterControl to virtually any system.

MasterControl Integrations FAQ 1

 FAQ

What are some of the common integration scenarios customers

have implemented?
• User Sync Integration
• As users are onboarded, offboarded, or change locations and
roles within your HR management system, MasterControl users
need to be provisioned and deprovisioned, or otherwise adjusted in
MasterControl to reflect those changes. Additionally, users need to
be assigned the appropriate MasterControl roles associated with
their status and their security groups configured in the third-party
system.
• Document Sync Integration
• Your third-party system has documents that need to be pushed into
MasterControl or you have documents in MasterControl that need
to be pushed to specific locations within the third-party system
and that depend on criteria such as document type, whether the
document was recently released, etc.
• Form Launching Integration
• An event or a process in your third-party system needs to trigger
a new quality process in MasterControl, such as a complaint,
corrective actions/preventive action (CAPA), nonconformance,
deviation, or even a custom process, etc. Data from the third-party
system can be used to fill out initial fields.
• Data Structure Sync Integration:
• Data in your third-party system needs to drive drop-down and
lookup information within MasterControl’s quality processes
(products, sites, contacts, equipment, etc.). When that data
changes in the third-party system, MasterControl needs those
drop-down fields updated as well.
• ERP-Manufacturing Excellence Integration: Launching Production
Records, Material Verification/Production Bill of Material (BOM)
Inclusion, Material Reconciliation/Backflush
• When a work order is created, an electronic production record can
be launched with the finished lot number and quantity from the
work order. When the electronic production record is complete, the
work order can be marked as complete and trigger move orders.
• Raw material information can be brought into the electronic
production record. Additionally, before using raw materials
on your manufacturing line, operators may need to verify that
those materials are valid. The integration can verify that the raw
materials are the correct lots issued to the work order. Other
checks, including quarantine status or expiration dates, can be
verified as well.
• Also known as a ”backflush.” Material and ingredient usage
information needs to be updated in your third-party system,
including scrapped materials, materials used for samples, etc.

MasterControl Integrations FAQ 2

 FAQ

Who will maintain my integrations?

• Built by MasterControl: If the integration was led/built by
MasterControl, we maintain the integration. This includes testing
before and after production upgrades. Customers will be notified.
MasterControl will not adjust the integration due to changes in the
third-party system. Though, many times, MasterControl’s testing can
discover if something could break due to a change in the third-party
system.
• Built by third-party integrators or customers: MasterControl will only
provide support for the MasterControl API.

Can MasterControl integrate with my homegrown system, such as

a QMS or EAM?
If the internal software or system has been maintained and the needed
endpoints can be exposed, it’s very likely that MasterControl can integrate
with your homegrown system, such as a quality management system (QMS)
or enterprise asset management (EAM). For some clients, integration
business logic can exist directly in the homegrown system, which removes
the need to use middleware.

How do I keep my integration protected from upgrades of my

third-party system?
MasterControl maintains any integration that is built by MasterControl.
However, if there are changes to your third-party system, including system
upgrades, we recommend you maintain industry-standard best practices
around “Dev” and “Test” environment deployments. These practices allow
time for testing and can reveal when the change could cause integration
failure before that failure is realized in production. It is rare, but sometimes
changes to third-party systems are considerable and may require
engagement with MasterControl Integration Services.

MasterControl-Led Integration Projects

I would prefer that MasterControl build my integration. What
access to my third-party system(s) do I need to provide for my
integration to be successful?
MasterControl will use our cloud-based integration platform (MuleSoft) to
accomplish your integration(s). If the third-party system(s) is in the cloud as
well, typically it is just a matter of providing appropriate credentials for the
platform to connect. If there is any IP whitelisting or other restrictions that
would prevent our platform from reaching your system(s), then we will need
our platform IP addresses to be whitelisted.

If the third-party system is within the customer’s network, access will need
to be provided to MasterControl’s system. Standard types of access include:

MasterControl Integrations FAQ 3

 FAQ

Push Integration Design

The third-party system schedules an active import or export of files from a
protected, cloud-hosted location. This prevents the need for our system to
reach your internal system altogether.

Reverse Proxy
Customer will expose a very limited set of APIs with internet protocol
(IP) restrictions through a reverse proxy in a DMZ. This limits the potential
security impact and gives control of what is accessible operationally.

Firewall Punching/IP Restrictions

In rare cases, customers allow access via firewall exceptions. For
customers that have their own on-prem middleware, access to on-prem
third-party systems become somewhat trivial. Access to MasterControl
– as a cloud-based system – is over the hypertext transfer protocol secure
(HTTPS) protocol and can easily be done from on-prem middleware.

How do I make changes to my MasterControl-managed

integration?
MasterControl integration architects typically design your integration to
be configurable, which prevents the need for frequent adjustments to your
integration and saves you time and money. In some cases, changes to your
integration(s) are needed; most often we see one of the following scenarios:

1. Existing Scenario Modification: If an existing integration scenario needs

to change, there is a one-time fee for MasterControl to make that
change.
• You have a Salesforce Complaint Launching Integration that
creates complaints in MasterControl on a nightly schedule based
on Salesforce cases. You want to change the integration to be
triggered near real-time from the Salesforce Case. This is a change
to the current scenario.
2. New Scenario: If a new integration scenario is needed, MasterControl
can add it to the integration with minimal to no effect on current
scenarios through our standard integration process.
• You have a Salesforce Complaint Launching Integration. You want
to add the ability for the status of the complaint to update the case
in Salesforce when the complaint is dispositioned. This is an added
scenario.

MasterControl Integrations FAQ 4

 FAQ

How much does a MasterControl-led integration cost?

Integrations can vary in complexity, from small and straightforward to
complex with multiple scenarios. Integrations are priced based on the
number of integration scenarios between MasterControl and another
system.
• The first integration scenario will usually include some additional
work to set up connections, monitoring, testing, etc., for the
third-party system that will provide a foundation for the first
scenario, as well as any future scenarios.
• Additional integration scenarios are typically easier to add after the
first one is set up. For this reason, pricing for multiple integration
scenarios will include an initial integration and then a lower price for
any additional scenarios.

For example, the pricing for an integration with Salesforce that 1) updates
customer drop-down lists in MasterControl forms with customer data from
Salesforce and 2) automatically launches complaints in MasterControl
based on Salesforce cases will be based on the first integration scenario,
plus the cost of one additional scenario. Typically, the second integration
will be more streamlined and be offered at a lower cost.

What does a MasterControl-led integration project look like?

While some integrations require unique engineering, all projects are initiated
in the same way and follow similar processes:
1. Kickoff between the client, their MasterControl project manager, and
an integration architect. The purpose of the kickoff is to introduce the
teams and define the needs of the integration project.
2. A discovery and design session with the integration architect. This
meeting is used to discuss the details of the integration so the architect
can build out the requirements in a format that can be consumed by the
integration engineer.
3. An integration architect creates a solution design document that details
the scope of the integration work and scenario(s); the project manager
works with the client for approval.
4. A MasterControl integration engineer configures and builds the
integration in MuleSoft according to the solution design document.
If the client’s requirements are similar to common scenarios
MasterControl has built before, the integration can be in place in a
matter of hours. However, more complex integration scenarios may
take several weeks to build and configure.
5. User Acceptance Testing (UAT) is completed in the Dev environment by
the client with support from the MasterControl integration engineer.
6. The integration scenario(s) go live in the client’s PRODUCTION
environment.

MasterControl Integrations FAQ 5

 FAQ

Design Develop Operationalize

1 3-4 weeks 2 4-10 weeks 3
Ongoing
• Discovery • Development Creation • Hosting
• Create Design Doc • Installed onto Dev • Management
• Approve Design Doc • User Acceptance Testing • Maintenance
• Feedback & Approval • Support
• Validation
• Installed onto Prod

How does MasterControl use MuleSoft to integrate with

production equipment?
MasterControl uses an operator-triggered data capture process that
integrates with IoT Gateways, supervisory control and data acquisition
(SCADA) systems, and/or OPC Unified Architecture (OPC UA) servers. The
key is there needs to be a software layer (for example, MuleSoft) that the
MasterControl integration platform can access to grab the needed real-time
data. If you choose to do the integration yourself, typically middleware or an
IPaaS will need to be in place so MasterControl can receive the information
from production equipment through that middleware.

Some equipment has the capability to connect directly to workstations and

emulate keystrokes as if it were a keyboard. These HID-compliant devices
can sometimes be used to trigger the entry of data into the user interface
of a MasterControl Production Record. The MasterControl system simply
responds as if a human were typing. Customers are encouraged to work
with their equipment vendors to understand keyboard emulation capabilities
and test how that data can be entered directly into MasterControl.

What is MasterControl’s approach to validating integrations?

MasterControl provides optional validation services for an additional cost.

If you choose a validation package, a validation expert will review your
integration design document, determine the validation needs, and review
them with you and your colleagues. When the integration project testing is
complete, MasterControl’s Services Technology team will install the API
integration into the ”Test” environment of MuleSoft and the validation expert
will run the validation scripts in order to validate the API for customer use.
Once this validation is complete, the integration will be considered validated
and then installed into production.

MasterControl Integrations FAQ 6

 FAQ

What is MasterControl’s approach to ensuring integrations are

secure?
MasterControl Integration Access and Security
Typically, actions performed in MasterControl via integration are done as a
MasterControl user, commonly referred to as a “service user.” For security
reasons, these service users are identified by the customer and created by a
system administrator in MasterControl. Service users are assigned only the
roles and rights needed to handle the integration.

Data Security
MasterControl integrations follow the same data-in-transit and data-at-rest
standards as the rest of the MasterControl platform (see the Cloud FAQ).
It is rare that an integration stores any additional data at rest (or state),
further increasing data security.

What are the next steps to initiate a MasterControl-led integration?

As outlined, there is a standard process that MasterControl follows when
kicking off an integration. If you are interested in starting this work, please
reach out to your account representative.

Client-Led Integration Projects

I am going to build my integrations myself. What access to my third-party

system(s) do I need to provide MasterControl for my integration to be
successful?
MasterControl typically connects to other systems by middleware or an
iPaaS, like MuleSoft. That system will need to have access to both the
MasterControl cloud and the third-party system.

I have the resources to build an integration, but we would like to

use your platform to do so. Can you provide us access to do so?
MasterControl is currently looking into solutions where customers can
manage their own integrations within our iPaaS platform. Currently, we do
not support customer-managed integrations on our platform.

I have an integration platform, but no resources to build my

integrations. Can MasterControl build the integrations on my
platform?
Unfortunately, MasterControl cannot build integrations on your platform
using your middleware. It introduces supportability and service-level
challenges that lead to unsuccessful integrations. However, we are happy to
provide consultation and advisory services to facilitate a more efficient and
rapid integration with MasterControl.

MasterControl Integrations FAQ 7

 FAQ

Can I integrate with a BI tool/data warehousing tools?

As part of MasterControl Insights, there is an ever-growing export API
capability, which is designed for these exact scenarios. Currently, the
maturity of this product may not have all the data elements your company
may want. Today, there are three options:
1. Evaluate MasterControl Insight’s Export API. See documentation of
current capabilities.
2. Use the API. The MasterControl API was designed for ”transactional”
integrations, which are typically not helpful for business intelligence
(BI) extraction scenarios. There is a search API and a Manufacturing
Excellence data extraction API that are helpful for limited scenarios.
3. Purchase an integration. MasterControl uses an integration platform
that allows the MasterControl Integration Services team to build
custom extraction data flows or APIs that regularly update your
third-party data warehouse/BI tools.

About MasterControl

MasterControl Inc. is a leading provider of cloud-based quality and

compliance software for life sciences and their regulated industries. Our
mission is the same as that of our customers – to bring life-changing
products to more people sooner. The MasterControl Platform helps
organizations digitize, automate, and connect quality and compliance
processes across the regulated product development life cycle. Over
1,000 companies worldwide rely on MasterControl solutions to achieve
new level of operational excellence across product development, clinical
trials, regulatory affairs, quality management, supply chain, manufacturing,
and postmarket surveillance.

For more information visit www.mastercontrol.com.

© 2022 MasterControl Inc. All rights reserved.

DSXXUSENLT-4/22

MasterControl Integrations FAQ 8