Document control an auditor can take apart

A document's life is an explicit, audited state machine — not a status field. The transition that matters most is automatic and atomic: when a revision becomes effective, its predecessor is superseded and withdrawn in the same event. At no instant are two revisions of the same document effective, and no point of use is left pointing at the old one.

A signature is only worth what it binds. Doqumus binds four things at once: who signed, when they last proved who they were, what the signature meant (prepared, reviewed, approved, acknowledged) and the exact bytes they were signing. Executed signatures are never altered or detached — a mistake is corrected by a superseding record that shows both.

The event log is the source of truth for regulated state. Document status, signature validity and training completion are projections of it — always derivable, never authoritative on their own. Auditors can read the events themselves, not just verify that a hash matched.

“Everyone has been trained on the current revision” is a question with a precise answer, and it is a projection of acknowledgement events rather than a checkbox. When a document changes, the people it applies to are asked again — automatically, against that revision.

A revision points at a hash, and the stored bytes hash to that value. Years later, the file an auditor downloads is provably the file that was signed — not a re-render, not a copy someone replaced.

Any controlled item or record can be related to any other: a revision to an NCR, an NCR to a CAPA, a CAPA to its effectiveness verification, a material certificate to the heat it came from. Relationships are first-class and audited, which is what makes traceability and impact analysis possible rather than manual.