OpenQMS.net QMS Software Review

Research completed in August 2026. We have not implemented OpenQMS.net for a customer and did not run a production trial. This is a desk-research buyer’s review based on the public source repository and C-realize’s product material—not a firsthand product testimonial.

Short version: OpenQMS.net is one of the few things in this market which really is open-source QMS software. The public application is licensed under AGPL-3.0, the repository contains recognizable quality workflows, and C-realize also offers commercial licensing and services. That makes it materially more credible than a download page which merely calls itself “open source”.

The catch is maturity. The public repository is small, deployment documentation is thin, and the free edition is not the same thing as a validated, supported production system. OpenQMS.net is interesting for a technical life-sciences team willing to own the application. It is not a magic free eQMS which makes hosting, validation and support disappear.

OpenQMS.net review: key facts

What OpenQMS.net actually is

There are two related offers. First, the public OpenQMS repository: a .NET web application with source code under AGPL-3.0. Second, C-realize’s commercial offer around hosting, licensing, implementation and “business level” functionality. The repository README explicitly describes dual licensing, so this split is not something we inferred from a pricing page.

The public code contains models and screens for application documents, training, CAPAs, changes, deviations, assets, materials, processes and products. That is enough to call it QMS-specific software rather than a generic file store wearing an ISO 13485 hat.

C-realize positions the product for biopharmaceutical quality standards such as GxP, 21 CFR Part 11 and Annex 11. It advertises digital signatures and employee training, while the business offer adds areas such as risks, audits, asset maintenance, notifications and support. Buyers should therefore ask which exact screens are in the AGPL edition, which are commercial, and whether the hosted demo matches the code they can download.

OpenQMS.net features

Documents, signatures and training

The vendor says OpenQMS.net can manage documents across the product or service lifecycle, sign them digitally and train employees. The public release notes say version 1.1 added document files to the database plus attendance and training-certificate reports.

That is the right basic shape. We could not establish from public documentation how strong the day-to-day document experience is: collaborative authoring, review comments, signature meaning, controlled-copy distribution, periodic review and training retriggering all need a live demonstration. The directory records no built-in rich-text editor because the public evidence points to managed document files, not a modern collaborative authoring environment.

Quality events

The source includes CAPA, change and deviation objects. Those are more useful than trying to assemble a QMS from unlabeled GitHub issues. Still, the presence of a model and CRUD screens does not prove a mature workflow. During evaluation, take one real nonconformity from intake through investigation, root cause, actions, effectiveness check and closure. Then inspect permissions, immutable history and reports.

Requirements management

We found product records but no demonstrated medical-device requirements module with user needs, design inputs, risks, verification and validation linked in a traceability graph. OpenQMS.net therefore gets “no requirements management” in our structured comparison. A team could customize an open-source system, of course. That customization then becomes software you must specify, test and maintain.

Is OpenQMS.net really open source?

Yes, the public edition clears the basic evidence test. The repository includes source code and a complete AGPL-3.0 license; GitHub identifies that license; and the README says users may redistribute and modify the program under the AGPL. This is conventional open-source licensing, not merely “we let customers look at PHP files”.

The AGPL has obligations, particularly when modified software is offered over a network. C-realize offers a commercial license for buyers who do not want the AGPL terms. That dual-license model is common and reasonable, but your legal team should decide which path fits. This review is not legal advice.

OpenQMS.net pricing

The public edition has no software license fee under the AGPL. That does not make a production deployment cost zero. You still need infrastructure, backups, monitoring, upgrades, security response, user support and validation. You may also need commercial licensing or C-realize services depending on how you deploy and modify it.

We found no public numeric price for the commercial license, hosted service or implementation. Ask for these as separate lines: license, hosting, installation, configuration, migration, validation support, training, ongoing support and upgrade work. “Free software” and “free operating model” are two completely different sentences.

Deployment, maintenance and project maturity

The repository is a .NET application and release 1.2 moved it to .NET 8 with SQLite. SQLite makes a small deployment approachable, but it does not define your production architecture. You still need documented environments, secret management, TLS, authentication, email, backups, restore tests, monitoring and an upgrade path.

Repository activity is unusual: when checked on 12 August 2026, it showed only six commits, each representing a relatively large release, and 23 stars. The latest commit was labelled release 1.4.0 on 13 April 2026. There were no packaged GitHub Releases. A low commit count is not proof of poor software, but it reduces the public evidence available for review and makes maintainability questions more important.

Before adoption, build it from a clean environment rather than accepting a mystery server image. Record every dependency, run a vulnerability scan, confirm the backup contains both database and documents, restore it, and rehearse an upgrade with realistic data. If one developer is the only person who understands the deployment, your “vendor independence” has simply changed names.

Validation, security and medical-device fit

Open source is useful for assurance because your team can inspect the code and pin the exact version. It is not a substitute for validation. FDA’s Computer Software Assurance guidance supports a risk-based approach to establishing confidence in production and QMS software. Your intended use, configuration, hosting and changes determine the work.

For medical device teams, the product’s document, training and quality-event scope could cover a meaningful part of an ISO 13485 QMS. The missing public evidence is design-control traceability and a ready-to-use validation package. Ask C-realize what test evidence and configuration documentation come with the commercial offer. For the AGPL edition, assume your company owns installation qualification, functional testing, access review, electronic-signature assessment, backup/restore evidence and change control unless a supplier contract says otherwise.

Data access is better than in a closed SaaS product because a self-hosting customer controls the SQLite database and stored documents. We did not find a polished one-click migration export. Verify how records, files, users, relationships, signatures and audit history can be extracted before treating “we have the database” as a complete exit plan.

OpenQMS.net pros and cons

Who should consider OpenQMS.net?

Shortlist it if source access and self-hosting are real requirements, your team has .NET and operations capability, and you are willing to validate a relatively young application. Compare the AGPL and commercial paths before building anything.

Start elsewhere if “open source” really means “we have no budget or IT owner”. The license can be free while the implementation is still a software project. Also start elsewhere if integrated medical-device design traceability is central and you do not want to build it.

Our verdict

OpenQMS.net is a real and interesting open-source QMS project. That already puts it ahead of many search results. Its current evidence supports a cautious shortlist, not a blanket recommendation. The key buying question is whether you want to become partly responsible for a QMS software product—or pay C-realize to carry more of that responsibility.

We are leaving it unrated. Source inspection tells us what exists; it does not tell us how pleasant the application is to use or how a production implementation behaves.

Disclosure: OpenRegulatory builds Formwork, a commercial eQMS for medical device teams. We therefore compete for some of the same buyers and are not neutral. Formwork is hosted and opinionated; OpenQMS.net offers source access and self-hosting. Choose based on the operating model you actually want.

Sources and methodology

Sources were checked on 12 August 2026. Vendor claims describe advertised scope; they do not independently prove compliance or outcomes.