Signed, not just saved.Identity, meaning, and time on every approval.
Approval of risk levels, scripts, impact assessments, and the final report are 21 CFR Part 11 electronic signatures. Identity comes from your SSO. The meaning is stated. The time is UTC. The signature is bound to the record hash.
- Approved requirement
- Test scripts
- Autonomous execution
- You take over
- Defects logged
- This pageSigned OQ / PQ report
Four decisions. Four signatures.
Risk levels, scripts, impact assessments, and the final report each carry their own signature: who signed, what it means, and when.
- On screen and in the reportThe signature manifest appears in the run and in the printed report.
- Re-authenticationThe signer confirms identity again at the moment of signing.
- Bound to one recordA signature cannot be moved to another record.
The controls, mapped to the clause.
Each clause of 21 CFR Part 11 that applies to electronic records and signatures, and how Merivane's controls meet it.
| Clause | Requirement | How Merivane meets it |
|---|---|---|
| § 11.10(a) | Validation of systems | Vendor validation package supports your supplier assessment. |
| § 11.10(b) | Accurate and complete copies | Records export as accurate, complete copies for inspection. |
| § 11.10(c) | Record retention | Retention period is set by your organisation. |
| § 11.10(d) | Access limited to authorised individuals | Role-based access. Sign-in is through your SSO only. |
| § 11.10(e) | Secure, time-stamped audit trail | Append-only, hash-chained trail with UTC time stamps on every entry. |
| § 11.10(g) | Authority checks | Authority is checked before every signature is accepted. |
| § 11.50 | Signature manifestation | Each signature shows the signer, the meaning, and the time. |
| § 11.70 | Signature and record linking | The signature is bound to the record hash and cannot be moved. |
| § 11.200 | Electronic signature components | Identity comes from SSO. The signer re-authenticates at the moment of signing. |
The report signs when you do.
The OQ or PQ report assembles from the run. Your signature covers the hash of the whole package, not just the last page.
- Assembled from the runTest summary, defect log, and traceability matrix, pulled together automatically.
- One hash, one signatureThe signature covers the hash of the whole package.
- Export with the manifestThe PDF export carries the signature manifest embedded.
- Meaning
- Approved
- Identity
- Verified by SSO
- Hash
- 9f3c…a71e
Compliance determination stays with your quality organisation.
We supply the technical controls and the documentation to support your assessment.
Vendor validation package available for your supplier assessment.
Trust and securitySignatures rest on what came before.
Questions about signatures and compliance.
If your question is not here, ask us. We reply within one working day.
Does it work with our SSO?
SAML and OIDC providers. Roles come from your directory.
Which signature meanings exist?
Reviewed, Approved, Rejected, Authored. Your QA can add meanings.
Can a signature be revoked?
No. A later signature with the meaning "Rejected" supersedes it. Both stay in the trail.
Do you provide a vendor validation package?
Under review.
See a full run on one of your systems.
Bring one approved requirement. We show you the chain end to end, on a system you already use, in under an hour.
Book a demo