Keystone
by CloudVoro
HACCP execution · in production

HACCP traceability software for food manufacturers.
Run your plan in the system, not on a clipboard.

Your HACCP plan is a serious document. The moment it lives in a binder and the monitoring records live on a clipboard, the audit gap opens. Keystone executes your HACCP plan inside the production system itself — every CCP is a monitored step, every deviation triggers a corrective action, every record is signed and time-stamped against a real user.

  • CCPs configured per process step — temperature, pH, time, weight, allergen check
  • Deviation captures auto-route to the responsible owner with a corrective-action queue
  • Every record is signed, time-stamped and immutable
  • One-click HACCP record bundle for FSAI / SFPA / BRCGS inspection
The honest gap most producers carry

A HACCP plan that is not executed in real time is half a plan.

Every food producer has a HACCP plan. Most also have a HACCP monitoring binder updated at the end of the shift, partly from memory. The plan and the binder usually disagree about something — a missing temperature check, a deviation that was acted on but never recorded, a corrective action that everyone remembers being raised but no one can prove. None of this means you have a bad food-safety culture. It means HACCP is being executed in two systems (head + paper) that do not reconcile.

How Keystone closes the gap

CCPs become workflow steps, not documents.

CCP monitoring step
Every CCP defined in your HACCP plan becomes a required step in the relevant batch/process workflow. The system will not allow the batch to advance without a captured measurement.
Critical limits & deviations
Each CCP carries its critical limit. Out-of-spec readings auto-trigger a deviation record and route to the owner you have nominated — usually the QA Manager.
Corrective actions queue
Deviations open a corrective-action record with a required outcome. The batch stays locked until the action is closed. No quiet release.
Verification & validation
Scheduled HACCP plan reviews are tracked. The system reminds you when validation is due and keeps the version history of plan changes.
Allergen control
Per-batch allergen declarations, with cross-contamination checks on shared equipment. Mis-match attempts block dispatch.
Why this sits beside your accounts package

Finance stays in finance. HACCP execution stays in operations.

Your accounts package — Sage, AccountsIQ, Xero, QuickBooks — should never be where HACCP records live. They were not designed for it and the auditors never accept it as the system of record. Keystone is the operational layer that owns HACCP execution, batch traceability and dispatch. Your finance team is unaffected.

FAQ

Questions buyers actually ask.

Is Keystone a HACCP-certified system?
Certification of HACCP plans is performed by certification bodies on producers, not on software. Keystone is designed to support FSAI, HACCP and BRCGS workflows with immutable monitoring records, signed audit trails and verifiable corrective-action logs — which is what auditors actually look for.
Can we capture monitoring on a tablet on the production floor?
Yes — Keystone runs on any modern browser. Tablets at vat, packing line, dispatch and intake are the common deployment.
What happens if the network drops mid-shift?
Recent monitoring entries cache locally and re-sync when connectivity returns. No HACCP records are lost.
Can we have separate HACCP plans for different lines?
Yes — multiple HACCP plans, each tied to one or more product/process families, with their own CCPs and critical limits.
Does this replace our HACCP coach or consultant?
No. Keystone is the execution and record-keeping platform. Your HACCP coach designs the plan; Keystone runs it day-to-day.

Ready to see if Keystone fits your floor?

20-minute discovery call. No sales pitch. Written scope within 48 hours if we fit — referral to someone better if we don't.

Talk to us
Compliance & trust

How we keep your
data and your audits safe.

We are honest about what's certified and what's in progress. Anything marked "in progress" reflects active work towards a recognised standard — never marketing decoration. Privacy queries go to privacy@cloudvoro.com. Sub-processor list at /legal/sub-processors. Full security posture at /site/security.

Live
Hosted in EU / Ireland
Customer data resides on AWS Ireland (eu-west-1) — never leaves the EU.
Live
GDPR · Privacy Contact named
Internal Data Protection Lead handles subject access requests. Owner is ADPO Ireland member.
In progress
NIS2 · building toward readiness
Tenant isolation, audit trails and MFA support customers in NIS2 scope. CloudVoro itself is below the size threshold; not yet certified.
In progress
ISO 27001 · alignment
We map our controls to Annex A but hold no third-party certificate. Formal certification on the 2026 roadmap.
In progress
Cyber Essentials · planned
UK Cyber Essentials assessment is on our roadmap. We will name the assessing body (IASME) and a confirmed date here once scoped.
Live
Encryption · at rest & in transit
TLS 1.3 in transit, industry-standard symmetric ciphers at rest, KMS-managed keys.