Skip to main content
LLMs.md

Digital Signature

The Digital Signature is part of the paid Compliance add-on (€49 per month, together with the audit-proof audit trail in line with ALCOA+ and 21 CFR Part 11; included in the Enterprise contract — see Choose a plan). It is intended for regulated industries (e.g. pharma and GxP environments, 21 CFR Part 11 / EU Annex 11). When it is active, the person performing an action re-confirms their identity when submitting an incident report, when submitting a form response or when completing a task — using a password, PIN, NFC chip or QR code. LiteLog optionally demands the same confirmation when completing a tour in the LiteLog app and when deciding on a request under change control. Password, NFC chip and QR code are the same methods used to sign in to the LiteLog app; the signature PIN is a personal 4- to 6-digit code (under Features → Digital Signature you can set a fixed length for your company, for example exactly 6 digits) used for signing only, never for signing in; each person sets it themselves — in the LiteLog app or in the portal — and never shares it. For every signature, LiteLog stores an immutable record: who signed, when, with which method, with which meaning, with which verification status — plus a checksum (hash) of the signed data.

:::caution Not to be confused with the drawn signature The signature field in forms (field type Signature in the form editor, e.g. for a customer signature on a handover protocol) is something different: there, someone draws a signature image into the form with their finger or mouse. The Digital Signature does not replace that field — it is a renewed identity check of the signed-in account at the moment of submission. Both can appear side by side in the same form. :::

What is this feature for?​

In regulated environments it is not enough that a record originates from a signed-in account — regulations require the person to prove their identity again at the moment of signing, and that this proof is stored permanently, immutably and attributably to the record. That is exactly what the Digital Signature provides: re-authentication on submission plus a tamper-protected signature log.

Activation step by step​

The Digital Signature is a cascade of four levels. A signature is only demanded when the levels combined resolve to "required":

  1. Book the add-on. The Digital Signature comes with the Compliance add-on, which you can book yourself under Choose a plan — it unlocks the feature immediately. The older standalone Digital Signature card under Features (tab "Bookable") still reads "On request"; if it was already unlocked for you that way, it stays unlocked.
  2. Turn on the company switch. Open the portal's Features page ("Features" entry in the left icon bar) and enable the company-wide switch on the Digital Signature card. As long as the company switch is off, LiteLog never demands a signature — regardless of any property or template settings.
  3. Decide per property where signing is required. Open the property (Master Data → Properties → select a property → panel entry Tamper protection, group "Administration") and scroll to the Digital Signature card — it only appears with the unlocked feature, below the location proof. There you configure which areas demand a signature at this property — incident reports, forms and tasks can each be set to Off or Required. Under Allowed methods you also choose what may be used for signing (password, NFC chip, QR code, PIN). New and existing properties start with "no signature required". With many properties, use the overview per property under Settings → Compliance & approvals.
  4. Optionally override per template or task. Individual form templates (in the template properties of the form editor) and individual tasks (in the task detail view, section "Digital signature on completion") can override the property setting: Inherit from property (default), Always required or Off. Already when creating a task, the form shows the "Digital signature" section with the note "From object: required" as soon as the selected property requires a signature for tasks — the task inherits the requirement without you having to override anything. Tours carry their override in the tour editor (field "E-signature on completion", see Managing Tours); there is no property level there.

How a single case resolves:

LevelSettingEffect
Bookable featurenot unlockedno signature, regardless of everything below
Company switch (Features)offno signature, regardless of everything below
Template / taskAlways requiredsignature is demanded — even if the property says "Off"
Template / taskOffno signature — even if the property says "Required"
Template / taskInherit from propertythe property setting of the respective area applies
Tour"Default (tenant setting)"the company switch alone decides — when it is on, a signature is mandatory on tour completion
TourAlways required / Offsignature is demanded, or never demanded — regardless of the properties of the stops

For tours the property level does not exist: only the bookable feature, the company switch and the "E-signature on completion" field on the tour itself take effect. A tour has several stops at different properties — so there is no single property whose setting could apply.

Overview per property​

What is this view for? To see at a glance at which properties the Digital Signature is switched on — without opening every property file one by one. The setting itself still lives on the property file (step 3 above); the overview shows all properties side by side and lets you toggle them right there.

You find the overview under Settings → Compliance & approvals → Tamper protection per property. It shows one row per active property with:

  • Property — the name (with the address for properties of the same name); a click opens the Digital Signature card in the property file.
  • Incident reports, Forms, Tasks — one switch Off / Required each, exactly as on the property card. The switch flips immediately on click; if saving fails, it flips back and LiteLog shows an error.
  • Allowed methods — the four methods password, NFC chip, QR code, PIN as clickable pills. At least one method must stay allowed.
  • Status — "awaiting approval" when a change control request is open for this property; the row is then locked until the decision.

Plus a search by property name, sortable columns and pagination from 50 properties on.

Good to know:

  • The overview is only visible while the Digital Signature is active for the company — the add-on booked (step 1) and the company switch under Features enabled (step 2). Otherwise a note with a link to Features appears in its place.
  • Every change in the overview is the same change as on the property card: it is recorded in the audit trail, and if the row Property settings under Settings → Compliance & approvals → Policies requires approval, LiteLog asks for the change reason when toggling and creates a request — the value stays unchanged until approval.
  • Opening the overview requires the permission Edit settings; toggling a row additionally requires Edit properties (without it, switches and pills are locked).

Signing in the LiteLog app​

If the configuration demands a signature, the LiteLog app shows a signature dialog before submitting — for incident reports and form responses on submission, for tasks on completion. The person chooses one of the allowed methods:

  • Password — the person enters their account password. This works only with an internet connection, because LiteLog verifies the password on the server immediately. The password is not transmitted or stored together with the data — LiteLog verifies it separately and records only the result.
  • PIN — the person enters their personal signature PIN (4 to 6 digits). It is the fast path on the phone: password to sign in, PIN to confirm. It never travels together with the data. After the first online signature with the PIN it also works offline for 7 days on that device (see Offline behavior). Each person sets their PIN themselves — in the app via the dashboard card Set up signature PIN, under Profile → Login & security → Signature PIN or directly in the signature dialog via Set up PIN, alternatively in the portal under Profile › Security (see Setting up and changing the signature PIN). After five failed attempts the PIN is locked for 15 minutes — the other methods remain available meanwhile. The section only appears in the app when the Digital Signature is active for your company.
  • NFC chip — the person taps their own NFC chip on the device. Works offline as well.
  • QR code — the person scans their own sign-in QR code. Works offline as well.

Important: the signature is a re-authentication of the signed-in account. The chip or QR code must belong to exactly the account currently signed in to the app — someone else's chip or QR code is rejected. Nobody can sign "on behalf of a colleague".

Signing in the portal​

In the portal, LiteLog opens the signature dialog when submitting an incident report or form response, when completing a task (including "Not feasible") and when deciding on a change control request. There you sign with your password or signature PIN — which of the two is offered is determined by the Allowed methods list on the property (tamper protection):

  • If both methods are allowed, the dialog shows a Password | PIN switch. If you already have a PIN, it is preselected.
  • If only the PIN is allowed and you do not have one yet, the dialog offers the setup right there: you confirm your account password, set the PIN — and then enter it to sign. Setting up does not replace the signature; the deliberate PIN entry remains the act of signing.
  • If the property allows only NFC chip and/or QR code, signing in the portal is not possible — the dialog points out that the action has to be signed in the LiteLog app. NFC chip and QR code are available in the app only.

Before you enter anything, the dialog states who is signing (name and username of the signed-in account), the meaning of the signature (submission, completion, "Not feasible" or approval/archiving) and that the time is stamped on receipt by the server. By entering your PIN or password you provide an electronic signature that is legally equivalent to your handwritten signature. The action is only completed after successful verification — password and PIN never travel together with the form data and are never stored in the record.

The verification issues a short-lived signature ticket that the action carries on submission. It is valid for 10 minutes and only for the signed-in account and the chosen method; if it expires (e.g. because the form stayed open for a long time), LiteLog simply asks you to sign again. The portal does not issue an offline grant for the PIN — that exists for the LiteLog app only.

After five wrong PIN entries the PIN is locked for 15 minutes (the dialog shows the remaining attempts and the time); meanwhile the password remains usable, provided the property allows it. With Forgot PIN? you set a new PIN right in the dialog.

Setting up and changing the signature PIN​

The signature PIN is your personal signature component: only you know it, and only you set it — each time confirmed with your own account password. Never share your PIN; a signature made with your PIN counts as your signature.

  • In the LiteLog app. As long as no PIN is set and the Digital Signature is active for your company, the dashboard shows the card Set up signature PIN — once after signing in additionally a prompt with Set up now / Later. Tap the card, confirm your password and set the PIN. The same path exists under Profile → Login & security → Signature PIN (also Change PIN there) and in the signature dialog via Set up PIN. Setting up requires an internet connection — afterwards the PIN can be used offline on this device for 7 days.
  • In the portal. Open your profile (menu at the top right) and switch to the Security area. The Signature PIN card shows whether a PIN is set and offers Set up PIN or Change PIN: account password, new PIN, repeat. The card only appears when the Digital Signature is active for your company.
  • PIN length. The default is 4 to 6 digits. Under Features → Digital Signature your company can set a fixed length (exactly 4, 5 or 6 digits) — app and portal show the rule during setup. Trivial sequences such as 1111, 1234 or 6543 are rejected.
  • Reset by the administration. An administrator can only remove your PIN in the portal (edit employee → section Digital signature → Reset PIN), never set or view it. Afterwards you set a new PIN yourself; any offline grant on your devices expires with the reset.
  • Log. Every set, change and reset of the PIN appears in the account's sign-in history (event "Signature PIN changed" with channel app or portal) — the PIN itself is never stored in clear text anywhere.

Offline behavior​

The LiteLog app works without an internet connection — and the Digital Signature is designed for that:

  • NFC chip and QR code work offline. The app checks the signature locally; on upload the server verifies the signature again against the current data (does the chip or code really belong to the submitting account?). Only this server-side check determines the final verification status in the log.
  • The PIN works offline once it has been confirmed online. Every online signature with the PIN in the app (and setting up the PIN in the app) gives the device a grant valid for 7 days — only the LiteLog app receives this grant, the portal does not. A PIN set up in the portal is therefore used once in the app with a connection first. The app stores a check value of the PIN in the device's protected storage — the PIN itself is never stored. Without a connection the app checks the entered PIN against this value (five failed attempts lock it for 15 minutes, offline too) and attaches the grant to the record. On upload the server verifies the grant: it must belong to the account, must not have expired, and the PIN must not have been changed or removed since it was issued. Only then does the log show verified — with a note that the check happened offline. After a PIN change, an admin reset or a sign-out, an online signature is required first.
  • The password does not work offline. Without a connection and without a valid PIN grant, switch to NFC chip or QR code — provided the property settings allow these methods.
  • Data captured offline is never discarded. If no valid signature could be provided offline, LiteLog still accepts the data during synchronization and records a deviation in the signature log ("signature missing" or "signature invalid"). The incident report, form response or task is not lost — the missing mandatory signature is made visible instead and can be followed up within your quality process.

In the portal and via APIs, LiteLog is strict instead: a signature-mandatory action cannot be submitted at all without a valid signature — the person can sign right away. The server accepts an offline grant exclusively in the app's synchronization path; in the portal and via APIs only the signature ticket counts.

Evidence and signature log​

For every signature (and every missing mandatory signature) LiteLog writes a row into an immutable signature log. Each row contains:

  • Who — name, username, role and personnel number of the signing person at the time of signing (frozen — renaming the role later does not change the row; LiteLog support acting while impersonating appears as Platform admin)
  • When — time of the signature and time of arrival on the server
  • Method — password, PIN, NFC chip or QR code
  • Meaning of the signature (submission — this covers form response, incident report, task completion, "Not feasible" and tour completion — or archiving/approval)
  • Verification status — whether password, PIN, chip or code were valid at the moment of signing (verified, rejected or missing, with a reason in case of deviations)
  • Checksum (hash) of the signed data — allowing you to prove later that the record has not changed since it was signed
  • Device and IP address, where available

The log is append-only: entries are never changed or deleted, and a log row survives even if the signed record is deleted later.

Signature status: what LiteLog shows​

From the verification status, the checksum and the current state of the record, LiteLog derives one status on every call and shows it everywhere with the same wording — in the detail views, in the signature log, in the exports and on the PDFs:

StatusMeaningDisplay
SignedThe signature was verified and the record is unchanged since signing (checksum recomputed and equal).green
Signed (v1, not recomputable)Signature from before the recomputable checksum generation (switch on 10 October 2026). The signature is valid; whether the record is unchanged since then cannot be recomputed for this row. Cancellation and supersession are still detected.green-grey
Signed (no checksum)Signature on a tour completion or a "Not feasible" report. For these two kinds of signature LiteLog does not compute a checksum of the record by design — there is no content record that a correction could change. The signature itself is verified and fully documented; this is not legacy data.green-grey
Modified after signatureToday's checksum of the record differs from the checksum at the time of signing — the content was changed after signing. The signature details name the affected fields (e.g. "Changed: Note, Checklist").red
CancelledThe signed task completion or form response was cancelled with a mandatory reason. The signature stays as evidence; the details show who cancelled it and when. Completions and incident reports that were soft-deleted before the cancellation rule — at that time without a mandatory reason — carry the same status; the signature details then only point to the record.grey
SupersededThe signed form response was replaced by a corrected version (report amendment). The signature belongs to the original record; the details point to the corrected version.blue
Record missingNo record could be found for the signature any more: it was permanently deleted (e.g. by a retention deletion or a deletion from before the cancellation rule), or the signature refers to an identifier for which no record is stored.orange
RejectedThe signature was refused at the moment of signing (wrong password, foreign chip, locked PIN …) — with a reason.red
Signature missingA mandatory signature was not provided (e.g. offline without a valid authorization).orange

The "Display" column applies to the portal — detail views and signature log: Cancelled appears grey there (a regular process, not a deviation), Superseded blue. The PDFs know only two colours: intact signatures (Signed, Signed (v1), Signed (no checksum)) are neutral, everything else is red — including Cancelled and Superseded, so that no deviation is overlooked on the printout.

Signatures on decisions — approving or rejecting a request, cancelling a completion — do not refer to a record that could change afterwards; they simply appear as Signed.

A cancellation or a corrected version takes precedence over "Modified after signature": a cancelled completion shows Cancelled even if its checksum also differs.

How LiteLog verifies the checksum​

When signing, LiteLog computes a checksum (SHA-256) from the content fields of the record and stores it in the log row — for a task completion these are task, account, due date, completion time, checklist, photos, note, "completed without scan" and delay details; for a form response template and version, account, property, submission time, all answers, photos, videos and signatures; for an incident report account, property, time and text. On every call LiteLog recomputes the checksum from today's record and compares it with the stored one. If both match, the status is Signed; if they differ, it is Modified after signature — and the signature details name the fields whose checksum changed. LiteLog additionally stores a checksum per field so a deviation can be attributed to a field.

Links and administrative fields that may legitimately be added after signing are not part of the checksum — for example the reference to the guard tour or to time tracking, review and sending notes, translations or the AI classification of an incident report. Such additions therefore do not trigger "Modified after signature"; they appear in the audit trail instead.

The evidence becomes visible in these places:

  • The detail views of report, incident report, task completion and tour show one short line per signature with status, name, time and meaning; a click opens the signature details (role, time with seconds and time zone, method, checksum and — depending on the status — the changed fields, the cancellation or the corrected version).
  • The signature log (History → Signatures tab) shows the status as a tag per row; the "Status" filter works on the verification at the moment of signing (verified / rejected / missing). The export of the log (CSV/XLSX) carries the same status in the Status column.
  • The PDFs — the form PDF in the section "Digital signature (Part 11)" and the completion proof in the section "Signatures" — show the status per signature, for "Modified after signature" with the affected fields; a superseded report additionally carries the header note SUPERSEDED by corrected version of …, a cancelled completion the header note CANCELLED.
  • The list exports Completions and Reports (CSV/XLSX) carry the status in their signature column. The incident list carries the signature only in the PDF (column "Signature" with status, signer and checksum); the incident CSV has no signature column — the signature log and its export cover incident reports as well.
  • The verifications additionally appear in the account's sign-in history.

Good to know​

  • The Digital Signature applies in these areas: incident reports, form responses, tasks — there both the completion and a "Not feasible" report, both following the same property setting "tasks" —, the completion of a tour in the LiteLog app, and the decision on a request under change control (correction, archiving, setting change). Time tracking and guard tours — the checkpoint rounds at a single property, listed in the portal as routes — never demand a signature. Not to be confused: a tour is the cross-property patrol run across several stops — it is signed, the guard tour is not.
  • Tours have no property level — and therefore the inverted default. For incident reports, forms and tasks every property starts with "no signature required"; a signature only arises once you switch it on at the property. Tours have no such intermediate level: when a tour's "E-signature on completion" field is set to "Default (tenant setting)" — the state every tour ships with — it follows the company switch directly. So if you turn the company switch on intending to configure each property afterwards, the signature on tour completion becomes mandatory for all tours immediately. If that is not intended, set the tours concerned to "Off" in the tour editor beforehand.
  • On tour completion the property's "Allowed methods" list does not apply. All four methods are always accepted there — password, PIN, NFC chip and QR code — even if you allowed only some of them at your properties. The reason lies in how a tour is built: it runs across several properties, so there is no single property whose method list could apply. Practical consequence: a tour can always be signed offline as well (NFC chip or QR code). For incident reports, form responses and tasks the list applies as described.
  • The company switch reaches the LiteLog app with the next data refresh — shortly after enabling it, the app may not show the signature dialog yet. The same applies to changed property and template settings.
  • The signature confirms identity; it does not replace a content review: the "Approval before customer dispatch" switch on form templates continues to work independently.

If change control is switched on as well, the decision on a correction or archiving request inherits the signature requirement of the property concerned: the approver confirms it with their password or signature PIN, and the decision gets its own entry in the signature log. If a request covers several properties and just one of them requires the signature, it applies to the whole request.

For requests to change a setting there is no property the signature requirement could hang on. It is set per area instead — in the Signature required column of the change control table under Settings → Organization. Those decisions appear in the signature log as well.

Frequently asked questions​

Why am I asked for my password or PIN when submitting?​

Your operator has activated the Digital Signature for this area (incident reports, forms or tasks). By entering it you confirm your identity at the moment of submission — a requirement in regulated industries. In the portal you can choose between password and signature PIN, in the LiteLog app additionally NFC chip and QR code — in each case as far as the methods are allowed at the property.

I forgot my signature PIN — what now?​

Simply set a new one — all you need is your account password: in the signature dialog (app and portal) via Forgot PIN?, in the app under Profile → Login & security → Signature PIN, or in the portal under Profile › Security → Signature PIN card. An administrator can only remove your PIN (edit employee → section Digital signature → Reset PIN), never set or view it: the PIN is your personal signature component that nobody but you knows.

May I share my PIN with a colleague?​

No. A signature made with your PIN counts as your signature — it is legally equivalent to your handwritten signature. Whoever shares their PIN signs on behalf of others. If you suspect that someone knows your PIN, change it immediately (app or portal) or have the administration reset it.

How long is a signature valid after I entered my password or PIN?​

The verification issues a signature ticket that is valid for 10 minutes and only for this action, this account and this method. If you leave a form open longer, LiteLog simply asks you to sign again on submission. Not to be confused with the offline grant of the PIN in the app: it is valid for 7 days after the last online use and allows signing without a connection — every signature still requires entering the PIN.

What happens if no signature was possible offline?​

Your data is not lost. LiteLog accepts the offline-captured incident report, form response or task completion during synchronization and records a deviation in the signature log ("signature missing"). The detail view then shows a deviation warning instead of "Digitally signed". How to handle such deviations is governed by your company's quality process.

I don't see a signature dialog even though the feature is booked — why?​

Check the cascade from top to bottom: is the company switch under Features on? Is the affected area (incident reports / forms / tasks) set to "Required" on the property? Does the affected form template or task override the property setting with "Off"? And has the LiteLog app already fetched the changed configuration (synchronization)?

Why does LiteLog suddenly demand a signature on every tour?​

Because tours have no property level. When a tour's "E-signature on completion" field is set to "Default (tenant setting)", it follows the company switch under Features directly. Turning the company switch on therefore makes the signature binding for all tours at once — unlike incident reports, forms and tasks, which additionally have to be switched on at the property. Set individual tours to "Off" in the tour editor if they should be completed without a signature.

Can someone sign with another person's chip?​

No. The chip or QR code must belong to the signed-in account. LiteLog rejects someone else's credential and records the attempt in the log as a rejected signature.

Can a signature be changed or removed afterwards?​

No. The signature log is append-only — entries are neither changed nor deleted. Deleting the signed record does not remove the log row either.

What happens to the signature when a completion is cancelled or a report is superseded?​

A signed task completion is not deleted but cancelled with a mandatory reason (see Editing tasks). The original signature stays in the log and shows the status Cancelled from then on; if the task requires a signature, the cancellation must be signed too — it gets its own log row with the meaning Cancellation confirmed. The proof remains readable in the export, the PDF (note CANCELLED) and the detail view; the signature details show who cancelled it, when and why. The same applies to a cancelled form response.

If a signed report is replaced by a corrected version (report amendment), the signature of the original shows the status Superseded and points to the corrected version; the original remains unchanged as evidence, and the PDF carries the header note SUPERSEDED by corrected version of …. The corrected version is signed anew on submission.

Completions and incident reports that were deleted before the cancellation rule are soft-deleted — at that time without a mandatory reason. Their signatures also show Cancelled; because there is no cancellation record for them, the signature details only point to the record ("Details of the cancellation are on the record").

What does "Modified after signature" mean — and what do I do then?​

LiteLog recomputed the checksum of the record and it differs from the checksum at the time of signing: the content was changed after signing (see How LiteLog verifies the checksum). For completions and reports this is not possible through the portal or the app — signed completions are locked, reports are only replaced by corrected versions — so the status reveals changes made behind the user interface. Open the signature details: the Changed row names the affected fields (e.g. "Note, Checklist"). How to proceed — assessment, documentation, possibly cancellation and re-entry — follows your company's deviation process; the status itself cannot be reset because the log is immutable.

For incident reports there is a regular path that produces this status: the reasoned correction via "Correct incident" (see Change control) changes the incident text on the record itself — the incident is not replaced by a new version. The signature then shows Modified after signature with the field list "Text"; the reason for the correction is in the activity log under Settings on the incident's record. Category and severity are not part of the checksum, so correcting them does not change the status. The same applies to voice incidents whose text is only created after signing by the automatic transcription; this change, too, is in the settings history with its cause.

What does "Signed (v1, not recomputable)" mean?​

The signature dates from before LiteLog computed the checksum from the stored fields (first-generation checksum over the transmitted data). The signature is valid and fully documented; only the question "is the record unchanged since then?" cannot be answered automatically for this row. Cancellation and supersession are still detected. The switch to the recomputable checksum took place on 10 October 2026 (database change 1838080000000): all signatures on completions, reports and incident reports since then carry it; the legacy rows are deliberately not recomputed afterwards because the log is immutable and a checksum computed today would say nothing about the state at the time of signing.

What does "Signed (no checksum)" mean?​

The signature belongs to a tour completion or a "Not feasible" report. For these two kinds of signature LiteLog does not compute a checksum of the record by design — unlike the "v1" legacy rows this is not a state from before the switch but applies permanently: a tour completion has no content record that a correction could change, and a "Not feasible" report is never edited in content, only reviewed or dismissed. The signature itself (who, when, method, meaning) is verified and fully documented; for "Not feasible" a deleted record is still detected as Cancelled.

Is this the same as the signature field in a form?​

No — see the note above: the signature field is a drawn image inside the form (e.g. a customer signature). The Digital Signature is the renewed identity check of the submitting person and produces the log entry with the checksum.

Permissions​

ActionRequirement
Open Features and toggle the company switchaccess to your company settings
Configure the signature requirement on a property"Edit properties" permission
Open the overview per property and toggle in it"Edit settings" to open, additionally "Edit properties" to toggle
Override on a template / taskedit rights on form templates or tasks
Set up or change your own signature PINevery account as soon as the Digital Signature is active for the company — confirmed with your own password
Reset (remove) a person's signature PINedit rights on the employee account
Unlock the featureLiteLog team only (on request)