VALIDATION PACK
IQ and OQ protocol for the Kionel offline package 1.0.4
Print this page, or save it as PDF, to get a protocol with space for results and signatures. It supports your validation and does not replace it: the intended use, the risk decisions and the approval remain with your quality unit.
1. Scope
| Product | Kionel offline package (sending PC; also receiving computer with a webcam) |
|---|---|
| Version | 1.0.4, released 2026-09-25 |
| File | kionel-offline-1.0.4.html |
| SHA-256 | 8105241ed08cbd6371403ab65374059a804725190a52ffd794cd847ed4b02416 |
| Built from | commit a5bc502 |
| Browser | Chrome or Edge 137 or later, Windows 10 or 11 |
| Receiving phones | Use kionel.com, which is updated continuously. For a fixed receiver, use the same offline package on a computer with a webcam. Record the build shown at the bottom of the page in every OQ result. |
2. Suggested classification and risk
A standard product used as supplied, with options a user switches on or off but no configuration or code of your own. We suggest assessing it as GAMP 5 Category 3 (non-configured product). Its job is to move a file from an isolated PC and leave signed evidence of what moved, which is where EU GMP Annex 11 (2011) §5 applies: systems exchanging data with other systems should include appropriate built-in checks for the correct and secure entry and processing of data.
What it does not do is as important for the risk assessment: it does not scan file content for malware, does not identify people (it signs with device keys), and uses device clocks unless trusted timestamps are switched on. The full list is on kionel.com/limits.html.
3. User requirements and traceability
| ID | Requirement | Verified by |
|---|---|---|
| URS-01 | Runs on the isolated PC from a single file, with no installation, network access or administrator rights. | IQ |
| URS-02 | The installed file can be identified by version and checked against a published SHA-256; it does not change itself. | IQ |
| URS-03 | File content is encrypted before it is shown, so that only the intended receiving device can open it. | OQ-01 |
| URS-04 | A transfer cannot be opened with a wrong code. | OQ-02 |
| URS-05 | The received file is identical to the sent file; a different or incomplete file is not accepted. | OQ-01, OQ-03, OQ-06, OQ-13 |
| URS-06 | The sending device signs a record of the file's SHA-256, size, work order, classification and target system. | OQ-01, OQ-04 |
| URS-07 | The receiving device signs a delivery receipt that includes the sender's record. | OQ-01 |
| URS-08 | Records can be verified independently of Kionel, and any change to them is detected. | OQ-05, OQ-06 |
| URS-09 | A human-readable report of each record can be printed or saved as PDF. | OQ-04 |
| URS-10 | Business functions are available only with a valid licence; records stay verifiable after a licence ends. | OQ-07 |
| URS-11 | Every user action ends with a visible success or failure message. | OQ-01, OQ-02, OQ-07, OQ-11 |
| URS-12 | An unsupported browser is reported clearly before any transfer is attempted. | OQ-12 |
| URS-13 | Optionally, received files and receipts are written to a chosen folder without overwriting existing files. | OQ-09 |
| URS-14 | Optionally, receipts carry an independent trusted timestamp; its failure never blocks a delivery. | OQ-10 |
| URS-15 | A signed record can be made for a file without transferring it (seal). | OQ-08 |
| URS-16 | Loaded files and licences can be removed, and codes shown on screen can be hidden. | OQ-07, OQ-11 |
| URS-17 | Users are warned about flashing images before the first transfer. | OQ-12 |
| URS-18 | Several files can be sent as one transfer, with a signed list of each file's SHA-256. | OQ-13 |
4. Installation qualification (IQ)
| # | Action | Expected | Result | Initials, date |
|---|---|---|---|---|
| IQ-01 | Download the package from kionel.com/offline-package.html on a PC with internet access. | File name matches the version in scope (section 1). | ||
| IQ-02 | Compute its SHA-256 (for example certutil -hashfile <file> SHA256). | Value equals the SHA-256 in section 1. | ||
| IQ-03 | Copy the file to each target PC through the site's approved route. | Route and change reference recorded. | ||
| IQ-04 | Place it in a folder users cannot write to. | Path and permissions recorded. | ||
| IQ-05 | Check the browser version (edge://version or chrome://version). | Chrome or Edge 137 or later. | ||
| IQ-06 | Open the file. Read the line at the bottom of the page. | Shows Kionel offline package with the version and build in section 1. | ||
| IQ-07 | On a computer that will receive, open Receive with its webcam. | The camera picture appears; no error message. | ||
| IQ-08 | Press Load licence file and choose kionel-license.json. | Licensee and expiry date are shown and match the licence. | ||
| IQ-09 | On the PC, disconnect or confirm the absence of any network, then reload the file. | The page works unchanged. |
5. Operational qualification (OQ)
Use a non-production file for each test. Record the build shown at the bottom of each device's page, attach screenshots or printed reports as evidence, and mark each test Pass or Fail.
OQ-01 · Send a result file with a typed code
Requirements: URS-03, URS-05, URS-06, URS-07, URS-11
- On the receiver choose Receive → Show a code.
- On the PC choose a small CSV result file, enter work order
OQ-01, type the code, press Send with this code. - Point the receiver's camera at the PC screen until the file arrives.
- Compute the SHA-256 of the source file on the PC and of the received file.
Expected: The receiver shows “received and verified”. Both SHA-256 values are identical. The receipt names OQ-01.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-02 · A wrong code is refused
Requirements: URS-04, URS-11
- Repeat OQ-01, but change one character of the code typed on the PC.
Expected: The receiver does not open the transfer and says the code does not open it. No file is offered.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-03 · Larger file by recording the screen
Requirements: URS-05
- On the PC choose Fast and a file of about 500 KB; send with a code.
- On the receiver choose Record the screen now and film for the time the PC shows.
- Let Kionel read the recording.
Expected: The file arrives and is verified. If the recording was too short, the receiver says how many seconds more to film.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-04 · Transaction details in the signed records
Requirements: URS-06, URS-09
- After OQ-01, print the transfer report on the receiver (Print transfer report).
Expected: The report shows the work order, classification, target system, file size and SHA-256, and both signatures as valid.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-05 · Independent verification
Requirements: URS-08
- Open kionel.com/verify.html (or the saved verify page) on any computer.
- Add the receipt from OQ-01 and the original file.
Expected: All checks pass: delivery signature, dispatch signature and file content.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-06 · Tampering is detected
Requirements: URS-08, URS-05
- Edit one character of the receipt JSON (for example the size) and verify it again.
- Verify the unmodified receipt with a different file.
Expected: The edited receipt is reported Not valid. With a different file, the signatures pass and the file content check fails.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-07 · Licence controls business functions
Requirements: URS-10, URS-16, URS-11
- Press Remove licence from this browser and confirm.
- Try the seal or the recording mode.
- Load the licence again.
Expected: Without the licence the function is refused with a message naming the business licence. After loading, it works. Records made earlier still verify (OQ-05).
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-08 · Seal a file without transferring it
Requirements: URS-15
- On the PC choose a file, enter a work order and press Seal without transferring.
- Scan the seal code with the receiver's live camera.
Expected: The receiver reports the sealed record received and its signature verified; the file itself is not transferred.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-09 · Save to a folder without overwriting
Requirements: URS-13
- On a receiving computer press Save received files to a folder… and choose an empty test folder.
- Receive the same file twice.
Expected: The folder holds name, name.makbuz.json, name (2) and name (2).makbuz.json; nothing is overwritten.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-10 · Trusted timestamp (website version only)
Requirements: URS-14
- On a receiver using kionel.com, switch on Add a trusted timestamp and receive a file.
- Verify the receipt on the verify page.
- Disconnect the receiver from the internet and receive again.
Expected: The first message shows a trusted time from DigiCert, and the verify page passes the trusted-time check. Offline, the delivery completes with a warning that no timestamp was added.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-11 · Remove a file and hide codes
Requirements: URS-16, URS-11
- Choose a file and start sending, then press Remove file.
- Show the licence as a code, then press the same button again.
Expected: Sending stops and the codes disappear with a confirmation. The licence code is hidden with a confirmation.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-12 · Warnings before risk
Requirements: URS-17, URS-12
- In a fresh browser profile, start the first transfer.
- Open the package in a browser older than version 137, if one is available.
Expected: A flashing-images warning appears first; cancelling it sends nothing. The old browser shows a message naming the required versions.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
OQ-13 · Several files in one transfer
Requirements: URS-18, URS-05
- On the PC select two result files together and send them with a code.
- On the receiver, download the ZIP and unpack it.
- Check each file against MANIFEST-SHA256.txt (for example
sha256sum -c MANIFEST-SHA256.txt) and against the SHA-256 of the source files.
Expected: One ZIP arrives and is verified. It holds both files and MANIFEST-SHA256.txt; every SHA-256 matches the source files.
| Actual result | |
|---|---|
| Pass / Fail | |
| Build on each device | |
| Tester, date |
6. Vendor testing of this version
Before a version is published, its code passes automated tests: 381 unit tests, and end-to-end tests that drive the real application in a browser, including the offline package opened from disk. The end-to-end scripts are kept in the source repository under tools/e2e/ and can be shown under a confidentiality agreement.
| End-to-end suite | What it checks | Checks |
|---|---|---|
| Free edition | Sending, receiving and every message of the free edition | 21 |
| Licence | Loading, moving and removing the licence | 10 |
| Seal and paper seal | Sealing, scanning and printing a seal | 11 |
| Film now, read later | A recording read later on another device, with a wrong code refused | 8 |
| Open and close | Removing files and licences, hiding codes | 22 |
| Start over | Restarting a transfer for a receiver who missed the start | 7 |
| Folder saving | Saving files and receipts without overwriting | 14 |
| Trusted timestamp | A real DigiCert timestamp, its verification, and failure without blocking | 11 |
| Offline package | The package opened from disk: licence, sending, no outside connection even if a script is injected | 7 |
| Package acceptance | A real browser download from kionel.com checked by SHA-256, then used as sender and as two receivers (recording and live camera); receipt checked by the offline verifier | 12 |
| Old browser | The message on browsers without the required cryptography | 4 |
| Several files | Two files sent as one ZIP; contents and manifest checked with an independent ZIP reader | 8 |
Cryptographic protocols are also checked formally with ProVerif; the models are published at kionel.com/formal.
7. Change control
A published version is never changed. A new version is a new file with its own name and SHA-256, listed on the download page with the commit it was built from; earlier versions stay downloadable so a validated installation can be re-checked or restored. What changed is in the changelog. Assess each new version under your own change control before replacing a validated one.
8. Approval
| Role | Name | Signature | Date |
|---|---|---|---|
| Prepared by | |||
| Reviewed by | |||
| Approved by (QA) |