Early access · digital seal coming
Sign360 · a Trial360 OS module
Electronic signatures built for clinical trials.
Sign 1572s, protocol signature pages, delegation logs and site agreements with signatures designed for 21 CFR Part 11 and eIDAS. Invite your own team or people at sites outside your organisation. When a request is linked to a study, the signed copy is filed straight into the trial master file with its audit trail.
Designed for 21 CFR Part 11 · eIDAS advanced signatures · EMA computerised systems guideline (2023) · ICH E6(R3)
Protocol signature page · Amendment 2
Study EXP-301 · Site 104
- Signed by
- Dr. A. Example, Principal Investigator
- Meaning
- I approve this protocol amendment
- Date and time
- 2026-11-04 14:32:08 UTC (server)
- Document hash
- SHA-256 9c41…e07b
Why a trial-specific signing module
General e-signature tools leave the regulated part to you.
An e-mail link is not enough
21 CFR Part 11 requires each signer's identity to be verified and two credentials at signing. Sign360 never signs from a link alone: every signer has their own account and password.
The meaning has to be recorded
An inspector needs to know whether a signature means "approved", "reviewed" or "authored". Sign360 records the meaning, name and server time on the document itself.
The signed copy belongs in the file
With a separate tool, someone downloads the PDF and files it by hand. Sign360 hands the signed document and its certificate to TMF360 or the Site360 ISF directly.
How it works
From draft to filed record, every step on the audit trail.
Prepare
Upload the PDF, add signers from your organisation or outside it, click where each signature goes, and set the signing order and the meaning of each signature.
Verify the signer
An invited signer opens a single-use link and chooses their own password. Before signing they accept the e-signature statement and enter user ID and password; later signatures need the password again.
Sign
Name, meaning and server date and time are stamped onto the page. The signing order is enforced by the database, not the browser.
Seal
The signed PDF and its certificate of completion are fingerprinted with SHA-256 and kept by hash. A PAdES digital seal and trusted timestamp are being added.
File
Every signed copy stays in Sign360. Linked to a study, it also goes to TMF360 Document Intake for filing.
Regulatory controls
What the regulations require, and where Sign360 stands.
Every control marked Built runs today and is traced to automated tests. The rest is being built. Evidence for what is built is on our Trust page.
| Requirement | How Sign360 meets it | Status |
|---|---|---|
| Unique signers, identity verified21 CFR 11.100(a), (b) | One personal account per person, never shared or reassigned. Trial360 users sign with the account they already have. | Built |
| Signers outside your organisation21 CFR 11.100(b), 11.30 | The sender records how they know the person. The signer gets a single-use link, chooses their own password and signs with it; they see only that request. Never a link alone. | Built |
| Two credentials at signing21 CFR 11.200 | User ID and password at the first signature of a session; the password again at every later signature. | Built |
| Password controls21 CFR 11.300 | Lockout after failed attempts, password expiry, and administrators can never set a user's password. | Built |
| Signer accountability21 CFR 11.10(j) | Each signer accepts that their electronic signature is the legal equivalent of their handwritten one, once per statement version. | Built |
| Signature manifestation21 CFR 11.50 | Printed name, date and time, and meaning appear on the signed page, in the certificate of completion and on every printout. | Built |
| Signature linked to the record21 CFR 11.70 | Each signature stores a hash binding the signer, meaning and time to the SHA-256 of the exact file reviewed. The PAdES digital seal on the signed PDF is being added. | Partial |
| Audit trail21 CFR 11.10(e) | Append-only, hash-chained log of created, sent, invited, viewed, signed, declined, voided and completed events, with server timestamps only. | Built |
| Enforced sequence and authority21 CFR 11.10(d), (f), (g) | Only the named signer can sign their step, and steps unlock in the order the sender set. | Built |
| Advanced electronic signatureeIDAS Art. 26 | Uniquely linked to and identifying the signer, under their sole control, and any later change detectable through the PAdES seal and RFC 3161 timestamp. | Planned |
| 25-year retention, verifiableEU CTR 536/2014 Art. 58 | Signed copies are never deleted. Long-term validation data, so signatures still verify after the signing certificate expires, comes with the digital seal. | Partial |
| Validation11.10(a), GAMP 5, EMA guideline (2023) | Each control has a requirement ID traced to automated tests, inside the Trial360 validation package. | Built |
| Personal data of signersGDPR | Signer name, e-mail, signatures and events are processed only to evidence the signature, under the customer's data processing agreement. | Planned |
| Certification to FDA21 CFR 11.100(c) | A one-time letter from the sponsor or site stating that its electronic signatures are legally binding. We provide the system description to support it. | Customer |
Documents
The signatures a trial actually runs on.
Form FDA 1572
Investigator
Signed at start-up, signed again whenever its information changes, and needed in both the TMF and the ISF.
Protocol signature pages
Principal investigator, sponsor
For the protocol and each amendment, in a set signing order.
Delegation of authority log
Principal investigator, site staff
Each delegated task signed by the person taking it and the PI.
Financial disclosure
Investigators and sub-investigators
Collected at start-up and updated during the study.
CV and GCP training attestations
Site staff
Signed and dated, filed with the person's qualification record.
Site agreements
Site, sponsor or CRO
Clinical trial agreements, confidentiality agreements and budgets.
Boundaries
What Sign360 will not do.
Stated up front, so your QA team can plan around it.
Not in the first release
- No link-only signing. Every signer has an account and a password, always.
- No participant consent. eConsent needs ethics committee approval and its own controls; it belongs in Consent360.
- No digital seal yet. Signed copies are hashed and kept unchanged; the PAdES seal that lets Adobe show them as certified is being added.
- No qualified signatures (QES) yet. Where a country or contract requires them, they will come through a qualified trust service provider.
What stays with your organisation
- The certification letter to FDA (21 CFR 11.100(c)).
- SOPs for using electronic signatures and reviewing audit trails.
- Training records for your users.
- Deciding which documents may be signed electronically in each country.
Signing 1572s and site agreements this year?
Tell us which documents you sign and in which countries. It shapes what we build first, and we can show you the signing controls already running in TMF360.