Written before the change
The audit record for a regulated change is committed before the change takes effect. A change cannot happen and then be described favourably afterwards.
Compliance
Evidence that stands on its own.
OpenAcura is an Assured Execution and Compliance platform built to support your 21 CFR Part 11 and EU Annex 11 obligations, and aligned to ISO 27001. Every regulated action is electronically signed and recorded on a tamper-evident audit trail — before the change it describes, not after.
Built for 21 CFR Part 11
ISO 27001 aligned
ALCOA+ data integrity
Electronic signatures
Tamper-evident audit trail
Three things that matter
What makes a record defensible.
Most systems can store an approval. Fewer can show that the stored approval is the one that was given, unchanged, by the person named on it.
Rigour you can dial
Dual-PIN signing, second-factor authority checks and mandatory intent statements are configurable per site, and an altered record is detectable whichever controls are on.
Signatures bind three things
An electronic signature captures the signer, their stated intent, and the exact version of the record signed. A signature cannot be carried over to a later revision.
The audit trail
Built to support your Part 11 and Annex 11 compliance.
Every change is audited — who, what, when, and the values before and after. Records are added to, never edited, and an altered record is detectable.
The rigour is built in rather than bolted on, and how much of it you switch on is your decision. Dual-PIN signing, second-factor authority checks and mandatory intent statements are configurable per site — so a warehouse working to ISO 9001 is not pushed through controls written for a GMP cleanroom.
- Signer
- J. Nash · Quality Lead
- Intent
- Verified effectiveness of corrective action
- Record
- CAPA-1188 · version 4
- Signed at
- 2026-08-14 14:22:07 UTC
- Method
- Password + PIN · configurable per site
Audit entry recorded before the change
Who, what, when, and the values before and after. Added to, never edited.
Electronic signatures
A signature is a statement, not a tick.
Under Part 11 a signature has to identify the signer, record what they meant by signing, and be bound to the specific record.
OpenAcura asks the signer to re-authenticate at the point of signing, records the intent as a named meaning — approved, rejected, verified effectiveness — and binds the signature to that version of the record. Change the record and the signature no longer applies; a new one is required.
- Re-authentication at the point of signing
- Named intent, not a generic acknowledgement
- Bound to one record version, and no other
- Verification cannot be performed by the person who did the work
- Signer
- J. Nash · Quality Lead
- Intent
- Verified effectiveness of corrective action
- Record
- CAPA-1188 · version 4
- Signed at
- 2026-08-14 14:22:07 UTC
- Method
- Password + PIN · configurable per site
Audit entry recorded before the change
Who, what, when, and the values before and after. Added to, never edited.
ALCOA+ data integrity
Nine properties, each one enforced somewhere specific.
ALCOA+ is often quoted and rarely broken down. Here is what each property means in practice and where the platform holds it.
Attributable
Every entry carries who made it and when, taken from the authenticated session rather than a typed name.
Legible
Records are readable and permanent. Nothing is overwritten; superseded versions stay available.
Contemporaneous
The timestamp is the moment of the action, captured by the system, not entered afterwards.
Original
The first capture is retained. Later edits are new versions with their own signatures.
Accurate
Values are constrained at entry, and changes to a signed record require a reason.
Complete
Repeat work, failed attempts and voided entries stay in the record rather than disappearing.
Consistent
One clock, one identity model, one audit format across every capability.
Enduring
Retention is set per record type and enforced, not left to whoever manages the folder.
Available
Any record can be produced on request, as an export, for the full retention period.
21 CFR Part 11
Built for it, and specific about what that means.
Part 11 governs electronic records and electronic signatures. The parts that fall to a software platform are access control, audit trails, record retention, operational checks on sequencing, and signature manifestation.
OpenAcura implements those. Validation is yours, and so is the content of your procedures and training. The platform holds the records and enforces the controls; it cannot own the obligation for you.
ISO 27001
Aligned to the control set.
Access is role-based and least-privilege. Credentials for connected systems are held in an encrypted vault rather than in configuration. Data is encrypted in transit and at rest, and administrative actions are audited to the same standard as regulated ones.
The wording is aligned, not certified. Certification is an audited status against a defined scope, and we will say so plainly when we hold it.