Gravity Forms
+ Policy Read & Sign

Getting people to read a policy, and showing who has read which version, usually means paper sign-off sheets, e-mail threads or a tick box nobody has to scroll to. The Gravity Forms Policy Read & Sign add-on runs the whole process on your own website. You publish each policy as text or a PDF with a version, assign it to WordPress roles or staff groups with a due date, and every version is kept unchanged with its own content hash.

Each person opens a personal link or logs in. The acknowledgement form stays locked until they have scrolled to the end and spent a minimum reading time, both checked on the server, then they answer up to three check questions and type their full name. A wrong answer means reading again. One record is kept per person and version, with the time, reading time, a keyed IP hash and the browser.

The compliance dashboard shows who has acknowledged, who is pending and who is overdue for each version, sends reminders only to the people who are missing, and exports a CSV and a receipt PDF per person. A new version can ask everybody to acknowledge again while earlier records stay in the audit trail. For care homes, schools, clinics, HR teams, charities and clubs on Gravity Forms 2.9 and newer.

Policies, versions, acknowledgements and reminders live in the add-on's own tables. Each version is written once with a SHA-256 hash of its title, label and exact text or PDF file, and is never changed. The reading page starts a reading session signed with a site key, holding the person, policy, version and the server's start time; reaching the end of the text earns a scroll token for that session from a REST route whose permission check verifies the session. The Gravity Forms acknowledgement form is accepted only with a genuine session for the current version, the minimum time passed on the server clock, the scroll token, right answers and the person's name; a wrong answer ends the session. Acknowledgements are stored with one database row per person and version, so a double submit keeps the first record. Reminders go through WordPress e-mail and receipts are drawn on your server with a bundled PDF library. Everything happens on your own server — the add-on makes no outside HTTP request beyond the licence and update checks.