What this system actually claims, and how each claim is enforced
Quality software is sold with a lot of adjectives. This page is the mechanisms instead — what happens in the database when you sign something, what stops one customer seeing another, and what we cannot do yet. If you are filling in a vendor assessment, this is the page to read.
Electronic signatures, Part 11 shaped
Signing means re-entering your password, choosing a meaning — authored, reviewed, approved, verified, accepted responsibility — and a server timestamp you cannot set. A SHA-256 hash of the record as it stood at that moment is stored alongside, so a later edit is provable rather than deniable. Signatures are append-only: no policy permits update or delete, and signed records lock through their workflow state.
Every signature prints as a manifest — signer, meaning, timestamp, and the full untruncated hash. A truncated hash proves nothing, so we do not print one.
The audit trail is hash-chained
Every create, update and status change writes an event: actor, entity, action, before, after, reason, timestamp. Append-only, enforced both by the absence of any update or delete policy and by a trigger that binds even the table owner.
Each event carries the hash of the one before it, per organization. Altering a row breaks every hash downstream of it. Append-only stops writes through the database; the chain catches what got around it — a restored backup, a superuser edit, a doctored export. Verify integrity re-walks the whole chain and reports the first place it stops holding.
Tenant isolation, enforced in the database
Every table carries an organization id, has row-level security enabled and forced, and has policies keyed on the caller's membership. Forced matters: without it, policies do not bind the table owner.
An automated check verifies all of it and fails the build on a finding. It prints its own allow-lists, because an exemption nobody can see is one nobody re-examines.
Retention and legal hold
Retention policies are per record type, with the clock running from creation or from closure. Records past their period are flagged eligible for archive — and nothing in the system ever acts on that flag. There is no delete path for a business record anywhere in the schema.
A legal hold suspends retention entirely, and releasing one requires a reason.
Support access you can see
When someone at Provetta needs to enter your tenant to help, they open a time-boxed session with a written reason. It expires on its own, cannot be extended, and your admins can end it early.
Every such session, and every action taken inside one, appears in your own audit trail attributed to a platform administrator with the reason attached — on the same hash chain as your own staff's actions. You do not have to ask us whether we looked.
No lock-in
A full export — one CSV per table plus every uploaded file — runs on demand, as often as you like, under your own permissions.
The bundle documents its own schema and gives the exact recipe for re-verifying the audit chain without this software. Being able to leave is a feature: a quality system holds a decade of evidence, and being unable to take it with you is what turns a vendor relationship into a hostage situation.
What we do not have yet
Every vendor has this list. Most do not publish it. Ours is short and specific, and none of it is hiding behind an asterisk elsewhere on this site.
SOC 2. We intend to pursue it; we do not have it, and there is no badge on this site.
An independent penetration test.
SSO and SAML. On the roadmap, not built.
Virus scanning of uploaded attachments.
Per-document or per-department read restrictions — today every member of an organization can read every document in it.
An automated test suite. Correctness is verified by scripted checks and browser runs each release, which is repeatable but not continuous. It is the largest single piece of debt we carry.
Provetta is built around the ISO 9001:2015 clauses a quality system has to satisfy — document control, competence and training, nonconformity and corrective action, management review, and control of external providers. That is a description of how the software is organised, not a certification of your organization, which only an accredited body can give you.
