GxP Compliance¶

Configure GxPSign for FDA 21 CFR Part 11 and other regulatory compliance.

What is GxP?¶

GxP refers to "Good Practice" regulations in life sciences:

• GMP - Good Manufacturing Practice
• GLP - Good Laboratory Practice
• GCP - Good Clinical Practice

GxPSign is designed to meet GAMP5 Category 4 requirements for computer systems used in regulated environments.

Enabling GxP Mode¶

GxP compliance features are available to all organizations — there is no plan upgrade required. Any organization can enable GxP mode and complete the formal qualification process.

Prerequisites¶

Before enabling GxP compliance:

1. Configure a signing certificate
2. Train users on compliance requirements
3. (Optional) Purchase SignatureManager seats for users who will create GxP-critical signature requests

Enable GxP Compliance¶

1. Go to Settings > Organization
2. Find GxP Settings
3. Check Enable GxP Compliance
4. Select your Qualification Status
5. Click Save

GxP Features¶

When GxP mode is enabled, the following features activate:

Signature Meaning Required¶

Every signature must include a meaning:

Enhanced Audit Trails¶

All actions are logged with:

• User identity
• Timestamp (server time)
• IP address
• User agent
• Action description
• Before/after values for changes

Re-Authentication¶

Configurable password re-entry for:

• Multiple signatures in a session
• Sensitive operations
• Extended sessions

Document Integrity¶

• SHA-256 hash calculated on upload
• Hash verified before signing
• Digital signatures with timestamps
• Long-term validation (LTV) data

Qualification Status¶

Qualification Levels¶

Setting Qualification Status¶

1. Go to Settings > GxP Settings
2. Select the appropriate Qualification Status
3. Click Save

Re-Authentication Settings¶

Purpose¶

Re-authentication ensures the person signing is who they claim to be, even in shared computer environments.

Configuration¶

1. Go to Settings > GxP Settings
2. Enable Re-authentication Required
3. Set Timeout Minutes (default: 15)
4. Click Save

How It Works¶

1. User signs their first document normally
2. Authentication is cached for the timeout period
3. For additional signatures within timeout: no re-auth needed
4. After timeout expires: password re-entry required

Recommended Settings¶

21 CFR Part 11 Compliance¶

Electronic Signatures¶

GxPSign provides:

Electronic Records¶

GxPSign ensures:

Controls¶

Document Types¶

GxP Critical Documents¶

Documents that directly impact product quality or patient safety:

• Batch records
• Deviation reports
• CAPA documents
• Validation protocols
• Release certificates

Settings:

• Signature meaning required
• Full audit trail
• Re-authentication (if enabled)
• Long-term archival

GxP Non-Critical Documents¶

Documents with less regulatory impact:

• Meeting minutes
• Training records
• General procedures

Settings:

• Signature meaning required
• Audit trail maintained
• Standard retention

Audit Trail¶

Accessing Audit Logs¶

1. Go to Settings > Audit Log
2. Filter by date, user, or action type
3. Export as needed

Logged Events¶

Audit Log Protection¶

• Logs are append-only (cannot be modified)
• Logs are retained according to policy
• Access to logs is controlled by role

Training Management¶

Training Status¶

Track user training status:

1. Go to Settings > Users
2. Click on a user
3. Update Training Status

Training Statuses¶

Training and Signing¶

Validation Support¶

System Validation¶

GxPSign provides supporting documentation for validation:

• Functional specifications
• User requirements
• Test protocols
• Traceability matrix

Contact support for validation packages.

Ongoing Validation¶

Maintain validation through:

• Regular system reviews
• Change control procedures
• Periodic testing
• User training updates

Best Practices¶

1. Enable early - Set up GxP mode before production use
2. Train users - Ensure all users understand compliance requirements
3. Document everything - Maintain qualification and validation records
4. Regular audits - Review audit logs periodically
5. Keep training current - Track and update training status
6. Test re-authentication - Verify timeout settings work as expected
7. Review access - Regularly audit user permissions

Signing Re-authentication Policy¶

GxPSign provides three re-authentication paths at signing time. Selection is automatic based on the user's enrolled credentials and your tenant policy.

Methods¶

Smart card alone, PIN alone, and "rely on the existing session" are never accepted (§ 13.3).

Tenant Setting: webauthn_required¶

In your Organisation Settings → Security:

The sending tenant's policy applies. If a signer from Org A signs a request created by Org B, Org B's webauthn_required setting governs the event — not Org A's.

Per-Signature Re-authentication¶

Effective for all GxP-enabled tenants: every signature event requires a fresh re-authentication. There is no time-window during which subsequent signatures skip the prompt. With WebAuthn, this is a sub-second biometric tap, so the operational cost is minimal while compliance with EU Annex 11 § 13.3 is unambiguous.

Audit Trail Fields¶

For every signing event, the following are recorded in SignatureAuditLog:

These columns are queryable directly (not buried in JSON metadata), so inspectors can ask "show me all signatures applied with a non-platform authenticator last quarter" and the answer is one SQL query.

Cloned-credential Detection¶

WebAuthn authenticators advertise a sign counter that must increase on each use. GxPSign refuses any assertion whose counter does not strictly advance and emits a failed_reauth security audit event. This is the FIDO2-spec recommended clone-detection check.

Regulatory Mapping¶