Access code to sign

You set it, and you deliver it

Choose Access code on a recipient card and a box appears for the code itself, with the placeholder saying to share it with the signer yourself. That is the entire security model and it is worth being explicit about: the product never sends the code. If you email it in the same thread as the invitation you have gained nothing. It works when the channel is genuinely different, a phone call, a text, a reference number the person already holds from an earlier letter.

Nothing stores the code you typed

It is hashed with scrypt against a sixteen byte random salt before it touches the database, and comparison uses a constant time function so the time a wrong guess takes reveals nothing about how much of it was right. There is no route that returns the code, to you or to anyone. If you forget it, you cannot look it up, and the only fix is to change it and tell the signer the new one.

Editing later without retyping it

If you come back to a draft and save the recipients again, leaving the code box blank keeps the stored hash rather than clearing it. The card shows Saved, type to replace as its placeholder, so it is obvious the code is still in force. Typing a new value replaces it. That means you can fix a spelling in somebody's name without accidentally removing their code.

Five attempts, then fifteen minutes

Each wrong code increments a counter on that recipient. On the fifth failure the counter resets and the recipient is locked for fifteen minutes, during which every attempt is refused with a message to try again later. The counter is written with a compare and set against the value that was read, so a burst of parallel guesses cannot all write the same number and slip past the limit. A correct code clears the counter and the lock.

What a wrong code leaves behind

Every failed verification is appended to the audit trail as its own event with the IP address behind it and the method that was attempted. So a document somebody tried and failed to open six times looks different in the record from one nobody touched. Successful verification is recorded too, separately from the moment the document was first viewed.

How it works, in three steps

1. Step 1

   Choose Access code on the recipient

   The Verify by dropdown on each card offers email link only, access code, or an emailed one-time code.

2. Step 2

   Type a code of at least four characters

   Something the signer already knows or can be told separately. A contract reference or the last four digits of an account number both work.

3. Step 3

   Tell them through another channel

   Phone, text or a previous letter. The invitation email warns them a code will be needed but never contains it.

Limits worth knowing

• Minimum four characters. There is no complexity requirement beyond that.
• The code cannot be recovered or displayed once saved, only replaced.
• The product never delivers the code. Sharing it is entirely your job.
• One code per recipient. Two people on the same envelope need two codes, set separately.

Questions people ask

Related pages