Skip to main content

project-document-management-docs-000-10-compliance-framework

title: Compliance Framework Specification type: reference version: 1.0.0 created: '2025-12-27' updated: '2025-12-27' status: deprecated tags:

  • ai-ml
  • authentication
  • deployment
  • security
  • testing
  • api
  • architecture
  • automation summary: 'Compliance Framework Specification Document ID: 000.10 Version: 1.0.0 Status: Draft Last Updated: December 19, 2025 Owner: CODITECT Document Management Team --- Executive Summary This specification defines the compliance framework for the CODITECT...' moe_confidence: 1.000 moe_classified: 2025-12-29

Compliance Framework Specification

Document ID: 000.10 Version: 1.0.0 Status: Draft Last Updated: December 19, 2025 Owner: CODITECT Document Management Team

1. Executive Summary​

This specification defines the compliance framework for the CODITECT Document Management System, enabling deployment in regulated industries including healthcare (HIPAA), financial services (SOX), life sciences (FDA 21 CFR Part 11), and organizations handling EU personal data (GDPR).

1.1 Compliance Certifications Target​

RegulationIndustryTarget DatePriority
HIPAAHealthcareQ2 2026P0
SOXFinancial ServicesQ2 2026P0
GDPRAll (EU Data)Q1 2026P0
FDA 21 CFR Part 11Life SciencesQ3 2026P1
FedRAMPGovernmentQ4 2026P2
ISO 27001AllQ2 2026P1
SOC 2 Type IIAllQ2 2026P1

2. Multi-Factor Authentication (MFA)​

2.1 Requirements​

The system SHALL support multi-factor authentication for all user access.

class MFAConfiguration:
    """MFA configuration for compliance requirements."""

    class MFAMethod(Enum):
        TOTP = "totp"                    # Time-based OTP (Google Auth, Authy)
        SMS = "sms"                       # SMS verification (not recommended for HIPAA)
        EMAIL = "email"                   # Email verification
        PUSH = "push"                     # Push notification
        HARDWARE_KEY = "hardware_key"     # FIDO2/WebAuthn (YubiKey)
        BIOMETRIC = "biometric"           # Fingerprint, Face ID

    # Minimum methods required per compliance level
    COMPLIANCE_REQUIREMENTS = {
        "hipaa": {"min_factors": 2, "allowed": [TOTP, HARDWARE_KEY, BIOMETRIC]},
        "sox": {"min_factors": 2, "allowed": [TOTP, HARDWARE_KEY, PUSH]},
        "fda_part11": {"min_factors": 2, "allowed": [TOTP, HARDWARE_KEY, BIOMETRIC]},
        "gdpr": {"min_factors": 1, "allowed": [TOTP, SMS, EMAIL, PUSH]},
        "standard": {"min_factors": 1, "allowed": "all"}
    }

2.2 MFA Enrollment Flow​

1. User completes primary authentication (username/password)
2. System checks MFA requirement for user's compliance level
3. If MFA not enrolled:
   a. Present MFA enrollment wizard
   b. Guide through primary method setup (TOTP recommended)
   c. Require backup method for recovery
   d. Store encrypted recovery codes
4. If MFA enrolled:
   a. Present MFA challenge
   b. Validate response within time window (30 seconds for TOTP)
   c. Log successful/failed attempts
5. Grant access token with MFA claim

2.3 API Specification​

POST /api/v1/auth/mfa/enroll
Content-Type: application/json

{
  "method": "totp",
  "device_name": "iPhone 15 Pro"
}

Response:
{
  "secret": "BASE32ENCODEDSECRET",
  "qr_code_url": "data:image/png;base64,...",
  "backup_codes": ["XXXX-XXXX", "YYYY-YYYY", ...]
}
POST /api/v1/auth/mfa/verify
Content-Type: application/json

{
  "method": "totp",
  "code": "123456"
}

Response:
{
  "verified": true,
  "access_token": "eyJ...",
  "mfa_verified": true
}

3. Configurable Retention Policies​

3.1 Requirements​

The system SHALL support configurable document retention periods to meet regulatory requirements.

RegulationMinimum RetentionMaximum RetentionNotes
HIPAA6 yearsState-specific (up to 10 years)From last service date
SOX5 years (records)7 years (audit docs)From creation
GDPRPurpose-limitedMust delete when no longer neededRight to erasure
FDA 21 CFR Part 11Duration of clinical trial + 2 yearsIndefinite for approved productsGxP requirements
Legal HoldIndefiniteUntil hold releasedOverrides all policies

3.2 Retention Policy Schema​

class RetentionPolicy:
    """Document retention policy definition."""

    id: UUID
    name: str                          # "HIPAA Medical Records"
    description: str

    # Retention period
    retention_period: timedelta        # e.g., timedelta(days=365*7)
    retention_unit: Literal["days", "months", "years"]
    retention_trigger: Literal[
        "creation_date",               # From document creation
        "last_modified",               # From last modification
        "last_accessed",               # From last access
        "custom_date_field",           # From metadata field
        "workflow_completion"          # From workflow end
    ]

    # Actions
    expiration_action: Literal[
        "archive",                     # Move to archive storage
        "delete",                      # Permanent deletion
        "review",                      # Queue for manual review
        "extend"                       # Auto-extend for active docs
    ]

    # Scope
    applies_to_document_types: list[str]  # ["contract", "medical_record"]
    applies_to_classifications: list[str]  # ["confidential", "phi"]

    # Compliance mapping
    compliance_frameworks: list[str]  # ["hipaa", "sox"]

    # Legal hold override
    legal_hold_exempt: bool = False   # If True, legal holds don't apply

    # Notifications
    notify_before_expiration: list[int]  # Days before: [90, 30, 7]
    notify_recipients: list[str]      # User IDs or roles

3.3 Retention API Endpoints​

# Create retention policy
POST /api/v1/compliance/retention-policies
{
  "name": "HIPAA PHI Records",
  "retention_period": 2555,
  "retention_unit": "days",
  "retention_trigger": "last_modified",
  "expiration_action": "archive",
  "applies_to_classifications": ["phi"],
  "compliance_frameworks": ["hipaa"],
  "notify_before_expiration": [90, 30, 7]
}

# Apply policy to document
POST /api/v1/documents/{document_id}/retention
{
  "policy_id": "uuid-of-policy"
}

# Check retention status
GET /api/v1/documents/{document_id}/retention
Response:
{
  "policy": "HIPAA PHI Records",
  "expires_at": "2032-12-19T00:00:00Z",
  "days_remaining": 2555,
  "legal_hold": false,
  "action_on_expiry": "archive"
}

4. HIPAA Compliance Module​

4.1 Protected Health Information (PHI) Handling​

class PHIClassification:
    """PHI detection and classification."""

    # PHI identifiers per HIPAA Safe Harbor
    PHI_IDENTIFIERS = [
        "name",
        "geographic_data",          # Smaller than state
        "dates",                    # Birth, admission, discharge, death
        "phone_numbers",
        "fax_numbers",
        "email_addresses",
        "ssn",
        "medical_record_numbers",
        "health_plan_numbers",
        "account_numbers",
        "certificate_numbers",
        "vehicle_identifiers",
        "device_identifiers",
        "web_urls",
        "ip_addresses",
        "biometric_identifiers",
        "photos",
        "unique_identifiers"
    ]

    def classify_document(self, content: str) -> PHIResult:
        """Scan document for PHI and return classification."""
        detected = []
        for identifier in self.PHI_IDENTIFIERS:
            if self._detect_identifier(content, identifier):
                detected.append(identifier)

        return PHIResult(
            contains_phi=len(detected) > 0,
            detected_identifiers=detected,
            recommended_classification="phi" if detected else "general",
            requires_encryption=len(detected) > 0,
            requires_access_logging=len(detected) > 0
        )

4.2 Business Associate Agreement (BAA) Workflow​

class BAAWorkflow:
    """Business Associate Agreement management."""

    class BAAStatus(Enum):
        PENDING = "pending"
        SENT = "sent"
        SIGNED = "signed"
        EXPIRED = "expired"
        TERMINATED = "terminated"

    class BusinessAssociate:
        id: UUID
        organization_name: str
        contact_email: str
        services_provided: list[str]
        phi_access_level: Literal["view", "process", "store"]
        baa_status: BAAStatus
        baa_document_id: Optional[UUID]
        signed_date: Optional[datetime]
        expiration_date: Optional[datetime]
        annual_review_date: Optional[datetime]

4.3 HIPAA Audit Trail Requirements​

class HIPAAAuditEvent:
    """HIPAA-compliant audit trail entry."""

    # Required fields
    event_id: UUID
    timestamp: datetime                # UTC with milliseconds
    user_id: UUID
    user_email: str
    user_role: str

    # Action details
    action: Literal[
        "view", "download", "print", "export",
        "create", "modify", "delete",
        "share", "permission_change",
        "access_attempt", "access_denied"
    ]

    # Resource
    document_id: UUID
    document_name: str
    document_classification: str
    contains_phi: bool

    # Context
    ip_address: str
    user_agent: str
    session_id: UUID

    # Immutability
    event_hash: str                    # SHA-256 of event data
    previous_hash: str                 # Chain to previous event

    # Retention
    retention_required_until: datetime  # 6 years minimum

5. SOX Compliance Module​

5.1 Internal Controls Over Financial Reporting (ICFR)​

class ICFRControl:
    """SOX Section 404 internal control definition."""

    id: UUID
    control_name: str
    control_description: str
    control_type: Literal["preventive", "detective", "corrective"]

    # Ownership
    control_owner: UUID               # User responsible
    process_owner: UUID               # Business process owner

    # Testing
    test_frequency: Literal["daily", "weekly", "monthly", "quarterly", "annual"]
    last_test_date: Optional[datetime]
    last_test_result: Literal["effective", "ineffective", "not_tested"]

    # Evidence
    evidence_documents: list[UUID]    # Supporting documentation

    # Risk assessment
    risk_rating: Literal["high", "medium", "low"]
    financial_statement_assertions: list[str]  # Existence, completeness, etc.

5.2 SOX Document Classification​

class SOXDocumentType(Enum):
    """SOX-regulated document types with retention requirements."""

    FINANCIAL_RECORD = ("financial_record", 5)        # 5-year retention
    AUDIT_WORKPAPER = ("audit_workpaper", 7)          # 7-year retention
    BOARD_MINUTES = ("board_minutes", 7)
    INTERNAL_CONTROL = ("internal_control", 7)
    EMAIL_FINANCIAL = ("email_financial", 5)
    CONTRACT_FINANCIAL = ("contract_financial", 7)
    TAX_RECORD = ("tax_record", 7)

5.3 Management Attestation Workflow​

class SOXAttestation:
    """Section 302/404 attestation workflow."""

    class AttestationType(Enum):
        SECTION_302 = "section_302"    # CEO/CFO certification
        SECTION_404 = "section_404"    # Internal control assessment

    id: UUID
    attestation_type: AttestationType
    fiscal_period: str                 # "Q4 2025", "FY 2025"

    # Signatories
    ceo_user_id: UUID
    cfo_user_id: UUID
    ceo_signed: bool
    cfo_signed: bool
    ceo_signed_at: Optional[datetime]
    cfo_signed_at: Optional[datetime]

    # Supporting evidence
    control_assessments: list[UUID]    # ICFR control test results
    deficiency_reports: list[UUID]     # Any identified issues
    remediation_plans: list[UUID]      # Plans to fix issues

    # Status
    status: Literal["draft", "pending_ceo", "pending_cfo", "complete", "filed"]
    filing_deadline: datetime
    filed_at: Optional[datetime]

6. GDPR Compliance Module​

6.1 Data Subject Rights​

class DataSubjectRequest:
    """GDPR data subject rights management."""

    class RequestType(Enum):
        ACCESS = "access"              # Right to access (Art. 15)
        RECTIFICATION = "rectification"  # Right to rectify (Art. 16)
        ERASURE = "erasure"            # Right to erasure/RTBF (Art. 17)
        PORTABILITY = "portability"    # Right to data portability (Art. 20)
        RESTRICTION = "restriction"    # Right to restrict processing (Art. 18)
        OBJECTION = "objection"        # Right to object (Art. 21)

    id: UUID
    request_type: RequestType
    data_subject_email: str
    data_subject_verified: bool

    # Timeline (GDPR requires response within 30 days)
    received_at: datetime
    due_date: datetime                 # received_at + 30 days
    completed_at: Optional[datetime]

    # Processing
    status: Literal["received", "verifying", "processing", "complete", "denied"]
    denial_reason: Optional[str]       # If denied, reason required

    # Affected documents
    documents_identified: list[UUID]
    documents_processed: list[UUID]

    # Evidence
    processing_log: list[dict]         # Detailed action log
    response_document_id: Optional[UUID]

6.2 Right to Erasure (RTBF) Workflow​

class ErasureWorkflow:
    """GDPR Article 17 - Right to Erasure implementation."""

    async def process_erasure_request(
        self,
        request: DataSubjectRequest
    ) -> ErasureResult:
        """Process a right to erasure request."""

        # 1. Identify all documents containing subject's data
        documents = await self.search_documents_by_subject(
            request.data_subject_email
        )

        # 2. Check for retention exemptions
        exempt_documents = []
        erasable_documents = []

        for doc in documents:
            exemption = self.check_retention_exemption(doc)
            if exemption:
                exempt_documents.append({
                    "document_id": doc.id,
                    "exemption_reason": exemption.reason,
                    "legal_basis": exemption.legal_basis
                })
            else:
                erasable_documents.append(doc.id)

        # 3. Check for legal holds
        legal_holds = await self.check_legal_holds(erasable_documents)

        # 4. Execute erasure for non-exempt documents
        erasure_results = []
        for doc_id in erasable_documents:
            if doc_id not in legal_holds:
                result = await self.erase_document(doc_id)
                erasure_results.append(result)

        # 5. Generate compliance report
        return ErasureResult(
            request_id=request.id,
            documents_erased=len(erasure_results),
            documents_exempt=len(exempt_documents),
            documents_held=len(legal_holds),
            exemption_details=exempt_documents,
            completed_at=datetime.utcnow()
        )

    ERASURE_EXEMPTIONS = [
        "legal_obligation",            # Required by law
        "public_interest",             # Public health, archiving
        "legal_claims",                # Establishment/defense of claims
        "freedom_of_expression",       # Journalism, research
    ]

6.3 Data Portability Export​

class DataPortabilityExport:
    """GDPR Article 20 - Data Portability implementation."""

    EXPORT_FORMATS = ["json", "csv", "xml"]

    async def generate_export(
        self,
        data_subject_email: str,
        format: str = "json"
    ) -> ExportResult:
        """Generate portable data export for data subject."""

        # Collect all data for subject
        data = {
            "export_date": datetime.utcnow().isoformat(),
            "data_subject": data_subject_email,
            "format_version": "1.0",
            "documents": [],
            "metadata": [],
            "activity_log": []
        }

        # Include documents
        documents = await self.get_documents_by_subject(data_subject_email)
        for doc in documents:
            data["documents"].append({
                "id": str(doc.id),
                "name": doc.name,
                "created_at": doc.created_at.isoformat(),
                "content": doc.content,  # Or download URL
                "metadata": doc.metadata
            })

        # Include activity history
        activities = await self.get_activity_by_subject(data_subject_email)
        data["activity_log"] = activities

        # Generate export file
        if format == "json":
            export_file = json.dumps(data, indent=2)
        elif format == "csv":
            export_file = self.convert_to_csv(data)

        return ExportResult(
            download_url=self.store_export(export_file),
            expires_at=datetime.utcnow() + timedelta(days=7),
            format=format,
            size_bytes=len(export_file)
        )

7. FDA 21 CFR Part 11 Compliance Module​

7.1 Electronic Signature Requirements​

class Part11ElectronicSignature:
    """FDA 21 CFR Part 11 compliant electronic signature."""

    # Signature components (minimum 2 required)
    user_id: UUID
    identification_code: str           # User ID/username
    password_verified: bool            # Password verification
    biometric_verified: Optional[bool]  # Optional biometric

    # Signature meaning
    signature_meaning: Literal[
        "authored",                    # Created the document
        "reviewed",                    # Reviewed content
        "approved",                    # Approved for release
        "verified",                    # Verified accuracy
        "rejected"                     # Rejected/disapproved
    ]

    # Timestamp
    signed_at: datetime                # Server timestamp (UTC)
    timezone: str                      # User's timezone for display

    # Binding
    document_id: UUID
    document_version: str
    document_hash: str                 # SHA-256 of document at signing

    # Non-repudiation
    signature_hash: str                # Hash of signature components
    certificate_id: Optional[str]      # Digital certificate if used

7.2 System Validation Documentation​

class SystemValidation:
    """IQ/OQ/PQ validation documentation for Part 11."""

    class ValidationType(Enum):
        IQ = "installation_qualification"
        OQ = "operational_qualification"
        PQ = "performance_qualification"

    id: UUID
    validation_type: ValidationType
    system_name: str
    system_version: str

    # Protocol
    protocol_document_id: UUID
    protocol_approved_by: UUID
    protocol_approved_at: datetime

    # Execution
    executed_by: UUID
    executed_at: datetime
    execution_results: list[dict]      # Test results

    # Deviations
    deviations: list[dict]             # Any deviations from protocol
    deviation_resolutions: list[dict]

    # Approval
    status: Literal["draft", "executed", "approved", "effective"]
    approved_by: UUID
    approved_at: Optional[datetime]
    effective_date: Optional[datetime]

    # Periodic review
    next_review_date: datetime
    review_frequency: Literal["annual", "biennial", "change_triggered"]
class LegalHold:
    """Legal hold management for litigation/investigation."""

    id: UUID
    hold_name: str
    matter_name: str                   # Legal matter/case name
    matter_number: Optional[str]       # External case number

    # Scope
    custodians: list[UUID]             # Users under hold
    document_criteria: dict            # Search criteria for docs
    date_range_start: Optional[datetime]
    date_range_end: Optional[datetime]

    # Status
    status: Literal["active", "released", "expired"]
    created_by: UUID                   # Legal/compliance officer
    created_at: datetime
    released_by: Optional[UUID]
    released_at: Optional[datetime]
    release_reason: Optional[str]

    # Documents
    documents_held: list[UUID]
    hold_acknowledgments: list[dict]   # Custodian acknowledgments

    # Prevents
    prevents_deletion: bool = True
    prevents_modification: bool = False  # Usually allows viewing
    prevents_export: bool = False
# Create legal hold
POST /api/v1/compliance/legal-holds
{
  "hold_name": "Patent Litigation 2025",
  "matter_name": "Acme Corp v. Widget Inc",
  "custodians": ["user-uuid-1", "user-uuid-2"],
  "document_criteria": {
    "document_types": ["email", "contract"],
    "date_range": {
      "start": "2023-01-01",
      "end": "2025-12-31"
    },
    "keywords": ["patent", "widget", "invention"]
  },
  "prevents_deletion": true
}

# Acknowledge hold (by custodian)
POST /api/v1/compliance/legal-holds/{hold_id}/acknowledge
{
  "acknowledged": true,
  "electronic_signature": {
    "signature_meaning": "acknowledged",
    "password": "..."
  }
}

# Release hold
POST /api/v1/compliance/legal-holds/{hold_id}/release
{
  "release_reason": "Litigation settled",
  "authorized_by": "legal-counsel-user-id"
}

9. Immutable Audit Trail​

9.1 Blockchain-Anchored Audit Log​

class ImmutableAuditLog:
    """Tamper-evident audit trail with blockchain anchoring."""

    def log_event(self, event: AuditEvent) -> AuditLogEntry:
        """Create immutable audit log entry."""

        # 1. Get previous entry hash (chain)
        previous_hash = self.get_latest_hash()

        # 2. Create entry with hash chain
        entry = AuditLogEntry(
            event_id=uuid4(),
            timestamp=datetime.utcnow(),
            event_data=event.dict(),
            previous_hash=previous_hash,
            entry_hash=self.compute_hash(event, previous_hash)
        )

        # 3. Store in append-only database
        self.store_entry(entry)

        # 4. Periodically anchor to blockchain (batch)
        if self.should_anchor():
            self.anchor_to_blockchain(entry.entry_hash)

        return entry

    def compute_hash(
        self,
        event: AuditEvent,
        previous_hash: str
    ) -> str:
        """Compute SHA-256 hash for chain integrity."""
        data = f"{event.json()}{previous_hash}{datetime.utcnow().isoformat()}"
        return hashlib.sha256(data.encode()).hexdigest()

    def verify_integrity(self, start_id: UUID, end_id: UUID) -> bool:
        """Verify audit log integrity for a range of entries."""
        entries = self.get_entries(start_id, end_id)

        for i, entry in enumerate(entries):
            # Verify hash chain
            expected_hash = self.compute_hash(
                entry.event_data,
                entries[i-1].entry_hash if i > 0 else "genesis"
            )
            if entry.entry_hash != expected_hash:
                return False

        return True

10. Compliance Dashboard​

10.1 Dashboard Components​

interface ComplianceDashboard {
  // Overall compliance score
  overallScore: number;  // 0-100

  // By framework
  frameworkScores: {
    hipaa: ComplianceScore;
    sox: ComplianceScore;
    gdpr: ComplianceScore;
    fda_part11: ComplianceScore;
  };

  // Open items
  openDataSubjectRequests: number;
  pendingRetentionActions: number;
  activeLegalHolds: number;
  overdueTraining: number;

  // Recent activity
  recentAuditEvents: AuditEvent[];
  recentComplianceAlerts: Alert[];

  // Upcoming deadlines
  upcomingDeadlines: Deadline[];
}

interface ComplianceScore {
  score: number;
  status: 'compliant' | 'at_risk' | 'non_compliant';
  openFindings: number;
  lastAssessmentDate: Date;
  nextAssessmentDate: Date;
}

10.2 Compliance Reports​

# Generate compliance report
POST /api/v1/compliance/reports
{
  "report_type": "hipaa_annual_assessment",
  "period_start": "2025-01-01",
  "period_end": "2025-12-31",
  "include_sections": [
    "access_controls",
    "audit_logs",
    "encryption_status",
    "training_completion",
    "incident_summary",
    "baa_status"
  ],
  "format": "pdf"
}

Response:
{
  "report_id": "uuid",
  "status": "generating",
  "estimated_completion": "2025-12-19T15:00:00Z",
  "download_url": null  // Available when complete
}

11. Implementation Checklist​

11.1 Phase 1: Foundation (Weeks 1-4)​

  • Implement MFA module with TOTP support
  • Create retention policy engine
  • Build immutable audit log with hash chaining
  • Implement document classification system
  • Create compliance configuration management

11.2 Phase 2: GDPR & HIPAA (Weeks 5-8)​

  • Implement data subject request workflow
  • Build right to erasure (RTBF) processor
  • Create data portability export
  • Implement PHI detection and classification
  • Build BAA management workflow

11.3 Phase 3: SOX & FDA (Weeks 9-12)​

  • Implement ICFR control tracking
  • Build management attestation workflow
  • Create Part 11 electronic signatures
  • Implement system validation documentation
  • Build legal hold management

11.4 Phase 4: Dashboard & Reporting (Weeks 13-16)​

  • Create compliance dashboard
  • Build automated compliance reports
  • Implement real-time compliance alerts
  • Create audit trail verification tools
  • Build training tracking integration

12. Database Schema Extensions​

-- Retention policies
CREATE TABLE retention_policies (
    id UUID PRIMARY KEY,
    name VARCHAR(255) NOT NULL,
    retention_days INTEGER NOT NULL,
    retention_trigger VARCHAR(50) NOT NULL,
    expiration_action VARCHAR(50) NOT NULL,
    compliance_frameworks JSONB,
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
);

-- Legal holds
CREATE TABLE legal_holds (
    id UUID PRIMARY KEY,
    hold_name VARCHAR(255) NOT NULL,
    matter_name VARCHAR(255) NOT NULL,
    status VARCHAR(50) NOT NULL DEFAULT 'active',
    document_criteria JSONB,
    custodians UUID[],
    created_by UUID REFERENCES users(id),
    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    released_at TIMESTAMP WITH TIME ZONE,
    released_by UUID REFERENCES users(id)
);

-- Data subject requests (GDPR)
CREATE TABLE data_subject_requests (
    id UUID PRIMARY KEY,
    request_type VARCHAR(50) NOT NULL,
    data_subject_email VARCHAR(255) NOT NULL,
    status VARCHAR(50) NOT NULL DEFAULT 'received',
    received_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    due_date TIMESTAMP WITH TIME ZONE NOT NULL,
    completed_at TIMESTAMP WITH TIME ZONE,
    processing_log JSONB DEFAULT '[]'
);

-- Immutable audit log
CREATE TABLE audit_log (
    id UUID PRIMARY KEY,
    timestamp TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    event_type VARCHAR(100) NOT NULL,
    user_id UUID,
    document_id UUID,
    event_data JSONB NOT NULL,
    previous_hash VARCHAR(64) NOT NULL,
    entry_hash VARCHAR(64) NOT NULL,
    blockchain_anchor VARCHAR(255)
);

-- Create index for hash chain verification
CREATE INDEX idx_audit_log_hash ON audit_log(entry_hash);
CREATE INDEX idx_audit_log_timestamp ON audit_log(timestamp);

-- Electronic signatures (Part 11)
CREATE TABLE electronic_signatures (
    id UUID PRIMARY KEY,
    document_id UUID NOT NULL REFERENCES documents(id),
    document_version VARCHAR(50) NOT NULL,
    user_id UUID NOT NULL REFERENCES users(id),
    signature_meaning VARCHAR(50) NOT NULL,
    signed_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    document_hash VARCHAR(64) NOT NULL,
    signature_hash VARCHAR(64) NOT NULL
);

Document Version: 1.0.0 Effective Date: Upon Approval Review Date: Quarterly Owner: Compliance Team