This page is public.
A small team that writes procedures, protocols or batch documents for an FDA-regulated product often meets Part 11 the same way: an auditor asks how an approval is signed, and the answer today is a PDF with a scribble or an email saying "approved". This page lists what the rule asks of a document system, in plain words, so you can check any tool against it — ours included: Hub Nexus (hubnx, hubnx.com), the platform this page is published on.
This is not legal or regulatory advice. Whether Part 11 applies to a record depends on the FDA rule that requires the record in the first place, and a system is only fit for use once you have validated it for your use. Ask your quality lead or a consultant before you rely on any tool.
First: does Part 11 apply to you?
Part 11 covers electronic records and signatures that another FDA rule requires — good manufacturing, laboratory, clinical or device quality practice, for example. A record you keep for your own convenience that no rule requires is not covered. If you sign it anyway, the signature should still mean something, but the rule is not the test.
What the rule asks of a document system
The section numbers are from the regulation, 21 CFR 11.
| Rule | In plain words | What to look for |
|---|---|---|
| 11.10(a) Validation | The system is shown to work as intended | A vendor's description helps; the proof is yours: a short written test of your own workflow |
| 11.10(d), (g) Access | Only authorised people use the system, sign, or change records | Named accounts, roles, and a person who can say who may approve |
| 11.10(e) Audit trail | A secure, computer-generated, time-stamped trail of who created, changed or deleted a record. A change must not hide what was there before | An append-only log nobody can edit; every version kept; kept as long as the record |
| 11.50 What a signature shows | The signed record shows the signer's printed name, the date and time, and the meaning of the signature — review, approval, responsibility, authorship | Not just a tick: a name, a time and a stated meaning on the record |
| 11.70 Signature linking | A signature cannot be cut from one record and pasted onto another | The signature belongs to one version of one document, and a later change is visible as a change |
| 11.100, 11.200 Uniqueness and components | Each signature belongs to one person and is never reused. A signature made from an ID and a password uses both for the first signing in a session; later signings in the same continuous session need at least one component only that person holds. Outside a continuous session, each signing uses all components | A fresh second step at the moment of signing, not just "you are logged in" |
| 11.300 Controls on codes and passwords | Codes are kept unique, can be revoked, and attempts to guess them are detected | Single-use codes, limited tries, lock-outs |
Questions that catch most tools
- Can an approver say what their approval means, or is there one "Approve" button for review, approval and responsibility alike?
- Does the signature show the name as it was on the day, even if the person changes it later?
- Is the signature written before the approval takes effect, and can an administrator edit or delete it afterwards?
- After someone approves, what happens when the document changes? A signature on version 3 must not appear to sign version 4.
- Is the audit trail inside the system and exportable, or something you reconstruct from email?
- For how long is the trail kept — and does it survive the document's deletion?
- Who can approve what, and who decided? Can the system send the document to a named group?
What Hub Nexus does
Hub Nexus is a publishing platform whose private workspaces keep a team's pages under review: every change is proposed, reviewed and approved, and every version is kept. A workspace can require signed approvals (the Quality plan, $750 a month for up to 50 members on the workspace plans page, as of 31 October 2026).
A workspace turns this on in its settings, under Signed approvals:
- Meaning is chosen. The approver picks review, approval or responsibility.
- A fresh code at the moment. A six-digit code is emailed when the approver signs. It is hashed with the person and the change, works once, expires after 10 minutes and allows 5 tries. Where a workspace has single sign-on, the signer can sign through it instead, with a fresh login required.
- The signature is written first, and never changed. It records the name as it was then, the meaning and the time, before the vote counts. It is never updated or removed, and it appears in the audit log as
change.signed. - Who approves is a group you name. A workspace can name a group as approvers; each change then goes to that group's current members, never to its own author.
- An audit log of every consequential act — membership, roles, settings, page creation, every review step, signatures — append-only, kept while the workspace exists and erased a calendar year after the workspace is deleted. Administrators read it and download all of it as CSV.
- Every version is kept with who changed what and why.
The audit log, in a workspace's settings — newest first, with a link to download all of it as CSV:
What Hub Nexus does not do
- It does not validate itself for you. There is no certificate that makes a tool compliant. You write and run the validation for your own use.
- It is not a full quality management system. It carries documents and their approvals; it does not run training records, CAPA or deviations. If you need those, you need those tools as well.
- It is not for a team that must sign with a hardware token or biometrics. The second step is an emailed code, or your single sign-on.
If your answers to the seven questions above are all "yes" in a tool you can already afford and validate, use it. If the tool you have is a shared drive and an email chain, a workspace is a cheaper step than a quality suite and leaves a trail an auditor can read.
Read next: Workspaces, every screen and action, and the workspace plans.
About Hub Nexus (hubnx, hubnx.com)
Hub Nexus — written hubnx for short, and found at hubnx.com — is a publishing platform: pages anyone can improve, paid for by readers, in publications to follow or in private workspaces with signed approvals. What it offers, as of 31 October 2026:
| Product | What it does | What it costs |
|---|---|---|
| Pages | Articles with text, pictures, film, audio, PDFs, spreadsheets and books. Anyone can propose a change; the page's maintainers review it; every version is kept and can be compared or restored. Free to read, in 16 languages. | Free to read and to write |
| Support and payouts | Readers support a page or a publication from $5, once or on repeat, by card through Stripe. Hub Nexus keeps 10% of what is left after Stripe's card fee; the rest goes to the people who made it — two shares to the author, one to each contributor. | 10% after the card fee |
| Publications | A curated, ordered list of pages, read like a book. Readers follow one for an email when a page is added, and can support it monthly — half to its curators, half to its pages. | Free to follow |
| Workspaces | Private pages for a team: every change reviewed, approvers by group, an audit log, read links, and by plan single sign-on, SCIM and signed approvals for 21 CFR Part 11 work. | Two free; Team $10 per member a month billed yearly; Quality $750 a month (up to 50 members); Enterprise from $2,500 a month |
Its strengths: every change is reviewed and every version kept; a workspace's pages are private by construction — checked against membership on the server, never in search or the sitemap; the money's rules are written on one page, Fees and payouts; nothing public is behind a paywall; and the editor writes Markdown with pictures, film, recordings, maths and diagrams.
Start: press Create at hubnx.com and choose a page, a publication or a workspace. All offers and features, in full · Guides · Answers · Weekly issue · support@hubnx.com
In these publicationsHub Nexus Answers
Licence: CC BY 4.0
Comments
