Built for regulated work, not retrofitted to it.

Every state change in ForgeSOP — a published SOP version, a closed CAPA, an inspection answer, an incident transition, a risk approval — is written to an append-only ledger as canonical JSON. Each entry includes:

• Actor (user_id and re-authentication assertion)
• Action (typed enum, e.g. SOP_PUBLISHED)
• Subject (the row affected, with a content hash of the bytes)
• Timestamp (UTC, monotonic)
• Previous-event hash — the chain link

Tamper with one row and every subsequent hash breaks. Every export PDF embeds the chain head and a verifier function description. Your auditor re-derives the chain on their machine; they aren't asked to trust our word.

Three properties make an e-signature usable as evidence under 21 CFR Part 11 and EU Annex 11. ForgeSOP enforces all three:

Every signature carries a typed meaning, so the audit trail records not just that someone signed, but what the signature asserts:

Standards shape: 21 CFR Part 11, EU GMP Annex 11, ISO 13485 §4.1.6. We use "Part 11-shaped" deliberately — we mirror the regulation’s evidence and signature requirements in the data model; formal compliance is a customer-side validation activity, not a claim the software makes on its own.

Access in ForgeSOP is role-based, but roles are not the whole story. Three layers work together:

• Scoped membership. A role can be limited to specific sites, so a Manager at one plant isn’t a Manager everywhere.
• Time-boxed membership. Contractor and temporary access carries an expiry and auto-lapses — no admin has to remember to revoke it.
• Per-user capability grants. Grant or revoke a single capability for one person without inventing a new role or over-promoting them. The override, its scope, and its expiry are all on the audit trail.

Every row in every multi-tenant table carries a workspace_id. Row-level security policies are enforced at the database, not in application code, so a SQL injection or a forgotten WHERE clause cannot leak across tenants.

Service-role writes (system actions, e.g. scheduled inspection rollover) follow a documented convention: every service-role insert/update names the workspace explicitly and is captured in the audit trail with a synthetic actor.

Workspaces nest into sites (physical locations) and assets (equipment). Deviations, CAPAs, incidents, and risks tag back to a site_id and (where applicable) asset_id, so the asset timeline shows you every event across modules in one place.

Standards and templates change. When they do, the work you already approved must not change underneath you — or your audit history becomes fiction. ForgeSOP freezes a snapshot at the moment of approval or run:

• Methodology snapshots. Approving a risk freezes the methodology — matrix bands, multipliers, score formula — onto the assessment. Re-band the matrix next quarter and last quarter’s residuals stay exactly what they were when they were signed.
• Template snapshots. Running an audit or inspection freezes the template at run time. Edit the template tomorrow and yesterday’s run still shows the questions that were actually asked.

The snapshot is bound into the signature, so an auditor sees precisely what rules a decision was made under — not today’s rules applied retroactively.

• Retention. Configurable per workspace and per record class. Default: 7 years for regulated artifacts (SOPs, CAPAs, signed approvals, audit trail), aligned to typical FDA / GxP retention.
• Soft-delete. User-initiated deletes mark the row deleted; the audit trail captures the intent and the operator. Recovery within the workspace's recovery window.
• Archival. Long-tail records move to cold storage with content-hash verification on read.
• Export-on-cancel. Workspace exports (full data in machine-readable format + PDFs of regulated artifacts + chain proof) are available on cancel. We don't hold your audit trail hostage.

This list is current as of the page's last publish. We notify customers of material additions or changes; full notification policy is in the DPA.

Standard DPA (Data Processing Addendum) executable on Professional and Enterprise. MSA on Enterprise. BAA (Business Associate Agreement, HIPAA) available on Enterprise; ForgeSOP is not currently HIPAA-marketed, but the BAA is supported for customers whose workflow requires it.

Email trust@forgesop.com for a copy of any agreement before contracting.

We don't market certifications we haven't earned. If we say "shape," we mean we mirror the regulation's data model; if we say "aligned," we mean a customer can produce the artifacts the standard requires; if we say "certified," we link the report. Auditors notice the difference and so do mature buyers.