E-signatures
E signature audit trail
A list of things that happened is only worth something if you can show it has not been edited since. That is what the hash chain under this log is for, and the page tells you whether it still holds.
Eighteen things that can happen
Created and document attached, when the envelope was made and the file added. Sent, then invited per person, or delivery failed if the email bounced. Opened when a link is followed, verification code sent, identity verified, verification failed, document viewed. Signed, or declined. Invitation resent. Signed in person, hosted by the sender. Withdrawn. Expired. Then certified and completed at the end. Each is written the moment it occurs, by whichever part of the system was responsible.
What a row carries
A sequence number, starting at one and never reused, a timestamp to the second, the event type, which recipient it belongs to, the IP address the request came from and the browser it came from, plus whatever metadata that event type needs. A signing event, for example, carries the signature mode, the hash of the signature image, the hash of the document at that moment and the consent version accepted.
How the chain works
Each row's hash covers its own contents plus the hash of the row before it. Object keys are sorted before hashing so that a database reordering the fields of a JSON column cannot change the result. Delete a row and the next one's recorded predecessor no longer matches. Edit a row and its own hash stops matching what its contents produce. Either way the break is detectable, and the sequence number is protected by a uniqueness constraint so two writers cannot claim the same slot.
It cannot be edited in the first place
The chain detects an edit; the database refuses to make one. A trigger raises an error on any update to the event table, so a row cannot be rewritten in place. Deletion is deliberately left open, because dropping a draft envelope has to cascade to its events, and that is precisely the case the hash chain is there to catch. Worker processes that stamp signatures and certify the final file write into the same chain rather than keeping a log of their own, which is why the sequence reads as one continuous story rather than two interleaved ones.
The badge at the top
Opening an envelope re-verifies the whole chain and shows the result beside the heading. Hash chain verified in green means every row still matches. Otherwise the badge names the sequence number where the chain first broke, which is far more useful than a general warning, because it points at the row to look at. The verification is done fresh on each view rather than being a stored flag.
How it works, in three steps
Step 1
Open the envelope's status page
The audit trail sits below the signers and the downloads, with the chain badge next to its heading.
Step 2
Read down the numbered rows
Sequence, timestamp, event and IP across four columns, newest at the bottom, alternately shaded.
Step 3
Take the certificate for anything you need to send on
The same log is printed into the certificate of completion, which is a PDF you can hand to somebody else.
Limits worth knowing
- There is no download event. Who opened the finished file is not recorded.
- The IP address is what the edge saw, taken from the last hop, and can be a shared or corporate address.
- Events cannot be filtered, searched or exported as data from this page. The certificate PDF is the portable copy.
- A broken chain is reported, not repaired. There is no way to rewrite history, which is the point.
Questions people ask
Who can change the audit trail?
Nobody through the product. The table rejects updates and deletes at the database level, and the hash chain would expose an edit made any other way.
Why does a signer show as opened before they are verified?
Opened records that the link was followed. Reaching the document is a separate later event, with the identity check in between.
Can I get the trail as a file?
Yes. The certificate of completion prints the entire event log as a PDF, and can also be appended to the signed document itself.
What does a failed delivery event mean?
The invitation email could not be sent to that recipient. They stay pending so a retry re-invites only them, and the failure stays in the record.
Make your own signing flow
The button opens the generator with this use case already described. Change the wording to match yours, generate, then edit anything you like.
Send a document for signingRelated pages
In person signing
The other party is standing at the counter. Emailing them a link, waiting for them to find their phone, unlock it and search their inbox is theatre. Turn your screen round instead.
Are electronic signatures legally binding?
This page does not answer that question, because no software can. Whether a signature binds anybody depends on the law where you are, the kind of document, and eventually on somebody deciding a dispute. What a product can do is be exact about what it recorded.
Draw or type a signature
The pad has two buttons in its corner: a pen and a letter. They produce the same kind of thing in the end, an image, but they suit very different people and the record notes which one you used.
More finished work of this kind is on the e-signature examples hub.