Part 11 electronic signature software for controlled GxP records

What Part 11 e-signature software has to do

21 CFR Part 11 §11.200 defines the requirements for electronic signatures based on biometrics and non-biometrics. In non-biometric practice — which covers ~99% of GxP e-signature use — the signature must consist of at least two distinct identification components (typically an identification code and a password), and the first signature in a continuous controlled session must use both while subsequent signatures in the same session may use only one.

On top of these baseline requirements, defensible e-signature practice today expects MFA on the signature event and a documented meaning attached to each signature. cGen implements both.

What consumer signature tools cannot do (that cGen can)

DocuSign, Adobe Sign, and their peers are excellent for consumer contracts and HR paperwork. They are not designed for GxP-controlled records. Specifically:

• They do not re-authenticate on every signature event — they trust the session
• They do not enforce meaning of signature or reason-for-change
• They do not integrate with the GxP audit trail, so the signature event and the record change are captured separately
• They do not enforce MFA on the signature independently of the login
• They do not produce a signature hash bound to the record content — the signature is on the wrapper (PDF), not the record
• They do not carry the ALCOA++ markers inspectors look for on signed records