Electronic Signatures in an LMS: What a Signature Records, Legal Holds and IP Allowlists

Why a Checkbox Is Not Enough for Regulated Training

In life sciences, medical devices and regulated manufacturing, a training record is often the evidence that a person was qualified before doing a controlled task. An inspector may ask who signed, when, what they signed for, and whether the record could have been changed afterwards.

A single-click attestation answers only part of that: it shows a session clicked a button. It does not show the named person confirmed their identity at that moment, or that the content they acknowledged is the content on file today.

The Four Controls, as the Code Implements Them

Personal Academy applies four controls. Each is described here as the code implements it (paths given so your security reviewer can ask about them).

1. A fresh second factor at signing: the signer must have passed an authenticator-app (TOTP) check recently, or the request is refused and they are asked to verify again. The record notes the method and when the check happened (app/api/assessment/esign/route.ts).

2. What the record keeps: the signer’s name as it stood at signing, the time, the stated meaning (for example approval of a procedure), the record signed, and a SHA-256 hash of the signed content computed at signing. Signature records can be added but never edited or deleted; a database trigger refuses both.

3. Legal holds: an administrator can place a hold on a person or a course, with a reason. While the hold is open, retention purges skip that person’s or course’s training records (activity data, quiz attempts and answers, lesson progress and certificates), and erasure is refused. Releasing a hold also needs a reason, and both steps are written to the audit log (supabase/migrations/20260910000090_retention_classes_legal_holds_and_admin_alerts.sql).

4. An IP allowlist: an organisation can limit access to its Personal Academy site to a list of IPv4 or IPv6 CIDR ranges (lib/ip-allowlist.ts). The allowlist applies to the whole organisation, and the save checks that the administrator is not locking themselves out.

What This Does Not Claim

These are engineering controls, not a certification or a validated system. Whether they meet a specific regulation depends on your procedures, your validation work and your counsel’s reading of the rules. Use the paths above as the starting list for your own vendor assessment.