Company: VEEV
Filing Date: 2025-03-24
Form Type: 10-K
Source: 0001393052-25-000022
Chunk: 366

Company: VEEVA SYSTEMS INC
Filing Date: 2025-03-24
Form: 10-K
Item: Item 1
Chunk 366
---
 on multitenant architectures that apply common, consistent management practices for all customers using our solutions. We enable multiple customers to share the same version of our solutions while securely partitioning their respective data. Certain of our other applications rely on technology platforms provided by third parties. For example, our commercial data warehouse application utilizes Amazon Redshift and our digital engagement application utilizes Zoom.

Veeva Systems Inc. | Form 10-K5

Table of Contents

Quality and Compliance Program

Veeva maintains a quality management system certified to ISO9001 to ensure process controls conform to established industry standards for our cloud software offerings that are subject to good practice regulations for the life sciences industry. Robust audit trail tracking, compliant electronic signature capture, data encryption, and secure access controls are required for these software offerings, and they must be thoroughly tested for compliance with applicable life sciences industry regulations, which include:

RegulationRegulation Description21 CFR 820.75U.S. FDA device regulation on system validation21 CFR 211.68U.S. FDA pharma GMP regulation on system validation21 CFR 11U.S. FDA requirement for maintenance of electronic recordsEU Annex 11EU Good Manufacturing Processes (GMP) requirement for maintenance of electronic records21 CFR 203Drug sample tracking as required by the Prescription Drug Marketing ActPFSB Notification, No. 0401022 (Japan)Use of Electromagnetic Records and Electronic Signatures for Approval of, or License for, DrugsOECD No. 17Application of Good Laboratory Practice (GLP) Principles to Computerised SystemsICH E6(R3)Good Clinical Practice (GCP) Validation Principles

Privacy Program

Veeva maintains a data privacy program aligned to applicable laws such as the European Union’s General Data Protection Regulation (EU GDPR), the United Kingdom’s General Data Protection Regulation (UK GDPR), the California Consumer Privacy Act (CCPA), and the U.S. Health Insurance Portability and Accountability Act (HIPAA). We have a Chief Privacy Officer who collaborates with our Chief Information Security Officer and business and product leaders throughout our organization. Our program focuses on the implementation of policies, procedures, and agreements to facilitate compliance with applicable data privacy laws and regulations as well as data privacy requirements of customers and partners; the creation and maintenance of privacy documentation to demonstrate compliance with applicable data privacy laws and regulations, including legal transfer mechanisms; the processes by which we obtain personal information through lawful and transparent means; the processes by which we process personal information; the processes by which we notify customers and data subjects