E-signatures · Glossary
What is an audit trail?
An audit trail is the ordered record of everything that happened to a document from the moment it was created to the moment it was completed. Each entry carries a sequence number, a timestamp, the event type, the person it belongs to, their IP address and user agent, and each is chained to the one before it so a missing or altered entry shows up.
The signature proves the file. The audit trail proves the process, and in a dispute it is usually the audit trail somebody asks to see first.
Nuwan Madhusanka · Co-founder
3 min read · Published
Eighteen kinds of event
A full trail records eighteen event types: created, document attached, sent, invited, delivery failed, opened, auth challenged, auth failed, authenticated, viewed, signed, declined, resent, in person started, voided, expired, certified and completed. The interesting ones are the negative events. A failed authentication attempt and a bounced invitation tell you far more about a disputed signing than the successful ones do, which is why a trail that only records the happy path is worth much less.
Why it is chained
Each entry stores a hash computed over its own contents plus the hash of the previous entry. Change one field in the middle and every hash after it stops matching, so the tampering is visible rather than silent. Verification walks the chain and either confirms it or names the exact sequence number where it broke. That is the difference between a log, which is a list somebody could edit, and an audit trail, which is a list that shows when it has been.
What each entry has to carry
A sequence number so order is unambiguous, a timestamp, the event type, which recipient it concerns, the IP address the action came from and the user agent of the browser that made it. Without the IP and the agent you cannot answer the most common challenge, which is that somebody else used my link. With them you can at least say the two events came from different places and different devices.
Questions people ask
Is an audit trail the same as a certificate of completion?
No. The trail is the underlying record, one row per event, kept for the life of the envelope. The certificate is a PDF built from it at the end, summarising the envelope, each signer and the full event log in a document you can hand to somebody. One is the data, the other is the printable evidence.
Can an audit trail be edited?
Updates are blocked at the database level, so an entry cannot be quietly changed after the fact. Deletion is deliberately left possible so that discarding a draft can remove its rows, which is worth knowing: the chain proves nothing was altered, not that nothing was ever removed wholesale along with its envelope.
Does the trail record people who did not sign?
Yes, and that is often the point. A recipient who opened the document, was challenged for a code, failed twice and never signed leaves a clear record. So does an invitation that bounced. Those entries are what let you show you sent it, they received it, and they chose not to act.
What does a broken chain mean?
That the stored data no longer matches its hashes from some sequence number onwards. It does not tell you who changed it or why; it tells you the record can no longer be relied on from that point. The verification reports the exact event where it broke, which at least bounds the problem.
How long should an audit trail be kept?
For as long as the agreement could be challenged, which for most commercial contracts means the limitation period in your jurisdiction plus a margin. The practical answer is to keep the certificate of completion with the signed PDF, since the two together are the evidence you would actually produce.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is a certificate of completion?A certificate of completion is the PDF summary of a finished signing: the envelope, each signer with their identity check and IP, and the full event log.
- Electronic signature against digital signatureAn electronic signature is any mark made with intent to sign. A digital signature is cryptography. One is a legal category, the other is a technique.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .