E-signatures · Glossary
What is an audit trail in e-signature?
An audit trail in e-signature is the time ordered record of every action taken on a document during signing: when it was sent, who opened it, how each person was verified, who signed or declined, and when it was completed. Each entry names the person, the time and where the action came from, so the signing process can be reconstructed later.
The signature shows that someone agreed. The audit trail shows how the agreement happened, and in a dispute it is usually the first record anyone asks to see.
Nuwan Madhusanka · Co-founder
4 min read · Published · Updated
| Record | What it is | What it can show | What it cannot show |
|---|---|---|---|
| System log | Technical events written by servers for operations and security | That a request reached a server at a time | Anything a reader can rely on without the operator's word |
| Audit trail | A chronological record of actions on one document or transaction | Who did what, when and from where, in order | The content of the document itself |
| Certificate of completion | A PDF summary built from the trail when signing ends | The signers, their verification and the event list, in a form you can hand over | Anything that happened after it was produced |
| Signed PDF certification | A cryptographic seal on the finished file | That the file has not changed since it was sealed | Who opened it, or how anyone was verified |
The general definition
NIST defines an audit trail as a chronological record that reconstructs and examines the sequence of activities surrounding or leading to a specific operation, procedure or event, from inception to final result. In signing, the operation is the agreement, so the trail runs from the moment the document is prepared to the moment the last party signs, declines or the request lapses. What makes a list of events an audit trail rather than a log is that it is kept for evidence: it is complete, ordered, attributable to people, and protected against quiet change.
What the law and regulators expect
Most e-signature laws do not require an audit trail by name. The US ESIGN Act asks that an electronic record accurately reflect the information and remain accessible for later reproduction by the people entitled to it, and a trail is how most services show the process behind that record. Some regulated fields are explicit. The US FDA's rule on electronic records, 21 CFR 11.10(e), requires secure, computer generated, time stamped audit trails that record the date and time of actions creating, modifying or deleting records, says changes must not obscure what was recorded earlier, and requires the trail to be kept as long as the records it covers.
What each entry has to carry
A useful entry carries a sequence number so the order is never in doubt, a timestamp, the type of event, the person it concerns, the IP address the action came from and the browser or device that made it. Without the address and the device you cannot answer the most common challenge, which is that somebody else used the link. With them you can at least show whether two events came from the same place and the same browser. The negative events matter as much as the successful ones: a failed verification or a bounced invitation often explains a disputed signing better than the signature does.
The audit trail in this e-sign product
Every envelope records 18 event types: created, document attached, sent, invited, delivery failed, opened, auth challenged, auth failed, authenticated, viewed, signed, declined, resent, in person started, voided, expired, certified and completed. Each row stores a sequence number, timestamp, event type, recipient, IP address, user agent and metadata, plus a SHA-256 hash over those fields and the previous row's hash. The status page walks the chain and shows either Hash chain verified or Chain broken at event n. A database trigger rejects any update to a row, while deletion is left open so a draft envelope can be removed. Downloads are not recorded, so the trail cannot show who downloaded the finished file.
Questions people ask
Is an audit trail the same as a certificate of completion?
No. The trail is the underlying record, one row per event, kept for the life of the envelope. The certificate is a PDF built from it when signing ends, summarising the envelope, each signer's verification and the full event log in a document you can hand to someone else. One is the data, and the other is the printable evidence drawn from it.
What is the difference between a log and an audit trail?
A log is any record a system writes, often for debugging or security monitoring, and it may be rotated, trimmed or edited by whoever runs the server. An audit trail is kept as evidence of a specific process. It is complete for that process, ordered, tied to identifiable people and protected so that a change to an earlier entry is either blocked or detectable.
Can an audit trail be edited?
In this product, no row can be updated once written, because a database trigger rejects the change, and the hash chain would expose an altered row anyway. Deletion is different: removing a draft envelope removes its rows with it. So the chain shows nothing inside a trail was changed, not that a whole trail was never deleted along with its draft.
What does a broken chain mean?
That the stored data no longer matches its hashes from some sequence number onwards. It does not tell you who changed it or why. It tells you the record can no longer be relied on from that point. The verification names the exact event where the break begins, which at least bounds the problem and tells you which entries remain trustworthy.
Does the audit trail show who downloaded the signed file?
Not here. The trail records events up to completion, including certification, but no download event is ever written, so a download by a signer or the sender leaves no entry. If you need to know who holds a copy, keep that record separately, for example by noting who received the completion email, which goes to every recipient and the sender.
Is an e-signature valid without an audit trail?
Often yes, because most e-signature laws turn on intent to sign and a record that can be reproduced, not on a trail by name. The trail matters when validity is challenged. Without it you may have a signed file and no way to show who opened the link, how they were verified or when they acted, which is exactly what a dispute tends to ask.
Make one with e-signatures
The button opens the generator with this use case already described. Change the wording to match your own.
Send a document for signingRelated questions
- What is a certificate of completion?An e-signature certificate of completion is the PDF record of a finished signing: each signer's identity check, IP and consent, plus the full event log.
- Electronic signature against digital signatureAn electronic signature is any mark made with intent to sign. A digital signature is cryptography. One is a legal category, the other is a technique.
- What evidence does an electronic signature produce?An electronic signature produces a bundle of evidence, not one file. What each item proves, where it is stored, and where the record is thinner than expected.
Step by step in the builder: Send a PDF for e-signature.
Written and checked by the OneCraft team. Last checked .