Signing in goiso
When you press Approve on a document revision, the system asks for proof: your password, or your two-factor code if you have it enabled. Many people read this as friction — it is in fact the feature itself.
The question an auditor asks
Not "who approved this document?" — the session already knows that. The question is:
"How do you prove the signer was present and intending, rather than a screen left open on their desk that somebody else clicked?"
Without an answer, a signature row is just a timestamp. With one, it becomes testimony.
Three methods, each verified by the server
| Method | For whom |
|---|---|
| Two-factor code | Anyone who enabled it — with no fallback to the password: if you hold both layers, you are asked for the stronger one |
| Password | Anyone who has not enabled two-factor |
| Device key | On the mobile app: your fingerprint unlocks a key inside your device that signs a challenge issued by the server |
Whichever was used is written onto the signature row itself, so the auditor can see it: password, code, or device key.
A note on biometrics: the phone never sends "your fingerprint", and never tells the server "I verified it". The fingerprint unlocks a private key locked inside your device; that key signs a server-issued challenge, which the server verifies against the registered public key. A flag written by the app saying "biometrics passed" proves nothing — and collapses at the first question: what stops a direct call to the API?
What the signature records
- Name and job title, copied at the moment of signing. If your role changes a year later, or your account is deleted, the row still testifies who signed and in what capacity.
- The meaning: approved / reviewed / acknowledged / witnessed.
- The fingerprint of what was signed, so a signature cannot be transplanted onto another file.
- Time, IP address, and the intent-proof method.
And the row can neither be edited nor deleted — a guard in the code refuses it; it is not a convention we follow.
The signature is a gate, not a trace
This is the crucial point: the signature is not a stamp applied after approval — it is the condition of approval happening. If the intent proof fails, or the signature row fails to write, the approval does not occur at all and the revision's state does not change. There is no such state as "approved without a signature".
Separation of duties: control is custody, approval is authority
The document controller creates the document, edits the draft, uploads the file, submits it for review and withdraws it when needed — but does not approve. Approval belongs to the management representative or the organization owner.
This is not administrative theatre: it is the same doctrine applied to safety policies since day one — whoever keeps the documents is not the one who decides they are valid. If one person held both roles, the auditor would ask about your controls.
Practical advice: enable two-factor for everyone who can approve. Your answer to the control question becomes an order of magnitude stronger, and it costs seconds.