GxP Compliance¶

Configure GxPSign for FDA 21 CFR Part 11 and other regulatory compliance.

What is GxP?¶

GxP refers to "Good Practice" regulations in life sciences:

• GMP - Good Manufacturing Practice
• GLP - Good Laboratory Practice
• GCP - Good Clinical Practice

GxPSign is designed to meet GAMP5 Category 4 requirements for computer systems used in regulated environments.

Enabling GxP Mode¶

GxP compliance features are available to all organizations — there is no plan upgrade required. Any organization can enable GxP mode and complete the formal qualification process.

Prerequisites¶

Before enabling GxP compliance:

1. Configure a signing certificate
2. Train users on compliance requirements
3. (Optional) Purchase SignatureManager seats for users who will create GxP-critical signature requests

Enable GxP Compliance¶

1. Go to Settings > Organization
2. Find GxP Settings
3. Check Enable GxP Compliance
4. Select your Qualification Status
5. Click Save

GxP Features¶

When GxP mode is enabled, the following features activate:

Signature Meaning Required¶

Every signature must include a meaning:

Enhanced Audit Trails¶

All actions are logged with:

• User identity
• Timestamp (server time)
• IP address
• User agent
• Action description
• Before/after values for changes

Re-Authentication¶

Every signature event requires a fresh authentication — the existing logged-in session is never accepted on its own (EU Annex 11 § 13.3). The fastest path is a WebAuthn passkey: one biometric tap (Touch ID, Face ID, Windows Hello, Android biometric, or a hardware security key). Password re-entry and SSO step-up are accepted as fallbacks when a passkey is not enrolled, unless webauthn_required is set for the tenant.

WebAuthn intrinsically satisfies the MFA-on-remote-critical-systems requirement (Annex 11 § 11.6) by combining possession (the device that holds the private key) with inherence (the biometric or device PIN that unlocks it) — no second factor needs to be layered on.

See Signing Re-authentication Policy below for the full method matrix, audit-trail fields, and clone-detection behaviour.

Document Integrity¶

• SHA-256 hash calculated on upload
• Hash verified before signing
• PAdES B-B digital signatures (detached CMS, tamper-evident)

Qualification Status¶

Qualification Levels¶

Setting Qualification Status¶

1. Go to Settings > GxP Settings
2. Select the appropriate Qualification Status
3. Click Save

21 CFR Part 11 Compliance¶

Electronic Signatures¶

GxPSign provides:

Electronic Records¶

GxPSign ensures:

Controls¶

EU GMP Annex 11 Compliance (2025 Draft Revision)¶

GxPSign is built to the tightened e-signature clauses in the EU GMP Annex 11 draft revision, not just the legacy 2011 text. The clauses below are the ones most often missed by legacy e-signature systems; GxPSign satisfies each by design.

Authentication for Signing¶

Signing-Event Audit Trail¶

Cloned-Credential Detection¶

Document Types¶

GxP Critical Documents¶

Documents that directly impact product quality or patient safety:

• Batch records
• Deviation reports
• CAPA documents
• Validation protocols
• Release certificates

Settings:

• Signature meaning required
• Full audit trail (including WebAuthn authenticator method, credential ID, AAGUID, userVerified flag, and sign counter)
• Fresh re-authentication at every signing event
• Long-term archival

GxP Non-Critical Documents¶

Documents with less regulatory impact:

• Meeting minutes
• Training records
• General procedures

Settings:

• Signature meaning required
• Audit trail maintained
• Standard retention

Audit Trail¶

Accessing Audit Logs¶

1. Go to Settings > Audit Log
2. Filter by date, user, or action type
3. Export as needed

Logged Events¶

Audit Log Protection¶

• Logs are append-only (cannot be modified)
• Logs are retained according to policy
• Access to logs is controlled by role

Training Management¶

Training Status¶

Track user training status:

1. Go to Settings > Users
2. Click on a user
3. Update Training Status

Training Statuses¶

Training and Signing¶

Validation Support¶

System Validation¶

GxPSign provides supporting documentation for validation:

• Functional specifications
• User requirements
• Test protocols
• Traceability matrix

Contact support for validation packages.

Ongoing Validation¶

Maintain validation through:

• Regular system reviews
• Change control procedures
• Periodic testing
• User training updates

Best Practices¶

1. Enable early - Set up GxP mode before production use
2. Train users - Ensure all users understand compliance requirements
3. Document everything - Maintain qualification and validation records
4. Regular audits - Review audit logs periodically
5. Keep training current - Track and update training status
6. Roll out passkeys early - Have signers register a passkey before their first GxP signing event; one biometric tap is far less disruptive than typing a password for every signature
7. Review access - Regularly audit user permissions

Signing Re-authentication Policy¶

GxPSign provides three re-authentication paths at signing time. Selection is automatic based on the user's enrolled credentials and your tenant policy.

Methods¶

Smart card alone, PIN alone, and "rely on the existing session" are never accepted (§ 13.3).

Tenant Setting: webauthn_required¶

In your Organisation Settings → Security:

The sending tenant's policy applies. If a signer from Org A signs a request created by Org B, Org B's webauthn_required setting governs the event — not Org A's.

Per-Signature Re-authentication¶

Effective for all GxP-enabled tenants: every signature event requires a fresh re-authentication. There is no time-window during which subsequent signatures skip the prompt. With WebAuthn, this is a sub-second biometric tap, so the operational cost is minimal while compliance with EU Annex 11 § 13.3 is unambiguous.

Audit Trail Fields¶

For every signing event, the following are recorded in SignatureAuditLog:

These columns are queryable directly (not buried in JSON metadata), so inspectors can ask "show me all signatures applied with a non-platform authenticator last quarter" and the answer is one SQL query.

Cloned-credential Detection¶

WebAuthn authenticators advertise a sign counter that must increase on each use. GxPSign refuses any assertion whose counter does not strictly advance and emits a failed_reauth security audit event. This is the FIDO2-spec recommended clone-detection check.

Regulatory Mapping¶