GxP Compliance & E-Signatures

ProBeya's GxP compliance module provides the controls required for regulated pharmaceutical and life sciences environments operating under FDA 21 CFR Part 11, EU Annex 11, and GAMP 5 guidelines. It includes electronic signatures, comprehensive audit trails, validation templates, and data integrity enforcement following ALCOA+ principles.

Overview

Regulated industries require computer systems to demonstrate:

• Electronic signatures: Legally binding signatures with identity verification and meaning declaration
• Audit trails: Immutable, timestamped records of all data changes
• Access controls: Role-based permissions with segregation of duties
• Data integrity: ALCOA+ compliance (Attributable, Legible, Contemporaneous, Original, Accurate + Complete, Consistent, Enduring, Available)
• Validation evidence: IQ/OQ/PQ documentation proving the system meets requirements

Getting Started

Signing Records

1. Navigate to any action, deviation, or compliance record.
2. Click the Sign button to initiate an electronic signature.
3. Re-enter your password to verify identity.
4. Select the signature meaning (e.g., "Approved", "Reviewed", "Authored").
5. Submit the signature — it is recorded with timestamp, user identity, and meaning.

Viewing the Compliance Dashboard

1. Navigate to Compliance > GxP Dashboard.
2. View the overall compliance status across all modules.
3. Review audit trail completeness, signature coverage, and access control status.
4. Export compliance reports for regulatory submissions.

Downloading Validation Templates

1. Navigate to Compliance > Validation Templates.
2. Download pre-built IQ, OQ, and PQ templates.
3. Execute the templates against your ProBeya instance.
4. Store completed templates as validation evidence.

How It Works

Electronic Signatures (21 CFR Part 11)

Each electronic signature captures:

• User identity: Authenticated user ID and display name
• Timestamp: Server-side UTC timestamp (not client clock)
• Meaning: Configurable signature meanings (Approved, Reviewed, Authored, Witnessed)
• Password re-entry: Identity verification at time of signing
• Record binding: Cryptographic link between signature and signed data

Signatures are stored in the e_signatures table with foreign keys to the signed record and the signing user, scoped by organizationId.

Audit Trail

ProBeya maintains a comprehensive audit trail through the activity table:

• Every create, update, and delete operation is logged
• Old and new values are captured for change tracking
• Entries are immutable — no modification or deletion permitted
• Timestamps use server-side UTC clocks
• User identity is captured from the authenticated session

ALCOA+ Data Integrity

Principle	Implementation
Attributable	All records linked to authenticated user identity
Legible	Structured data with clear field labels and types
Contemporaneous	Server-side timestamps at time of creation
Original	First entry preserved in audit trail
Accurate	Zod validation on all inputs before persistence
Complete	No selective deletion — all history retained
Consistent	Referential integrity enforced by database constraints
Enduring	PostgreSQL with backup and disaster recovery
Available	Role-based access with organization scoping

API Reference

Procedure	Type	Description
gxp.getComplianceStatus	Query	Get overall compliance dashboard data
gxp.getAuditTrail	Query	Paginated audit trail with filters
gxp.exportAuditTrail	Mutation	Export audit trail to CSV/PDF
eSignatures.sign	Mutation	Create an electronic signature on a record
eSignatures.verify	Query	Verify a signature's integrity
eSignatures.getHistory	Query	Get signature history for a record

Permissions

Action	Required Role
View compliance dashboard	Admin or Quality role
Sign records	Any authenticated member
Export audit trail	Admin or Quality role
Download validation templates	Admin or Quality role

Related Features

• SOC 2 Compliance — SOC 2 readiness assessment and evidence collection
• Action Log — Full activity history with immutable audit trail