GxPForge has controls covering access, approvals, audit trails and other areas relevant to 21 CFR Part 11, and your QA and regulatory teams can assess the platform against your own requirements.
PKI based and biometric signatures are out of scope. Password reauthentication is the signature mechanism.
Four roles are defined at the database level and enforced server side on every write. Validation engineers cannot approve their own submissions where that would break segregation of duties, and approvers cannot edit records they approved.
{{ r.desc }}
There is no way to create a SuperAdmin from the UI. That is deliberate, to prevent escalation by social engineering.
Requirements, test cases and other GxP records use the same approval states: Draft, In Review, Approved and Rejected. An approval asks for the password again, a rejection needs a reason, and every action is recorded.
GxPForge records whether an approval was made by a person or by automation. Once a person approves a record, a later sync cannot silently change that decision.
The log is read only and append only. It records every create, update, delete, approve, reject, import, login and logout event in the system, with JSON before and after snapshots.
SuperAdmins and Admins see the full log for every project. Validation engineers and reviewers see only their own projects' entries.
{{ s.b }}
We can walk through the audit trail, approval process, and controls and answer questions about how they work.
Book a demo