Electronic Signatures, Legal Holds & Data Governance
Personal Academy delivers mission-critical governance controls out of the box for life sciences, healthcare, finance, and defense organizations.
Built for teams operating under GxP, HIPAA, and international data-protection obligations: hash-bound electronic signatures, litigation legal holds, append-only audit logging, CIDR subnet IP allowlisting, and air-gapped Ed25519 perpetual licensing—without purchasing expensive third-party add-ons. These are engineering controls, not a claim of regulatory certification; confirm your specific obligations with your own compliance counsel.
Six Defense-Grade Compliance Controls
Engineered directly into PostgreSQL database triggers and application runtime verification.
Electronic Signatures
Dual-assertion electronic signature engine requiring authenticated session validation plus a second-factor-verified session. Each signature captures a SHA-256 state hash stored in an append-only ledger with triggers preventing updates or deletes.
Legal Holds & Retention Classes
Configure object-level retention windows (learner records, quiz attempts, audit events). In active litigation, legal holds freeze data purge operations and automatically log GDPR erasure refusals (user.erasure_refused) with court case references.
CIDR Subnet IP Allowlisting
Restrict administrative or whole-organization access by IPv4 and IPv6 CIDR subnet ranges. Includes automated self-lockout prevention checks, break-glass override mechanics, and dedicated SIEM anomaly alerting. IP allow-listing applies to signed-in web sessions.
MFA, Step-Up & Session Caps
Two-factor sign-in is available to everyone, and required for administrators and staff. Organisations can require TOTP authenticator enrollment across the whole tenant. Includes single-use emergency recovery codes, idle session auto-locks, and max concurrent session caps with oldest-session eviction. Re-verification (step-up) is required when managing your own two-factor settings.
EU AI Act & Ethical Disclosures
Comply with EU AI Act and corporate ethics guidelines with transparency disclosure badges, automated data lineage logging, and granular department-level AI opt-out switches preventing user interaction with generative models.
Ed25519 Air-Gapped Licensing
Deploy in fully isolated, private cloud, or air-gapped defense networks. License files use asymmetric Ed25519 digital signatures enforcing host bindings, maintenance dates, seat caps, and module entitlements with zero external telemetry.
How Electronic Signing Works
Second-Factor Verification
Signing requires a second-factor-verified session; password-only sessions are refused.
SHA-256 State Binding
The exact quiz answers or completion timestamp are serialized into canonical JSON and hashed with SHA-256 and stored with the signature.
Database Trigger Protection
The signature is written to e_signatures where PostgreSQL triggers block any modifications or deletion.