What's in an e-signature audit trail?

With a pen-and-paper contract, the evidence is the paper itself: the ink, the handwriting, maybe a witness. With an electronic signature, the evidence is the audit trail, a record of every step the document went through, from the moment it was sent to the final signature.

Here's what Revamp Sign records, what ends up on the certificate of completion, and why it matters.

What the audit trail records

Every meaningful action on a document is saved as an event. That includes when it was created and sent, when each signer viewed it (and whether they arrived from a text), when they accepted the electronic-records consent, when they signed or declined, and when the document was completed, voided, downloaded or reminded.

Each event is stored with:

• The time it happened.
• The IP address of the device that took the action.
• The browser (user agent) that was used.
• Details about the action. For a signature, that includes whether it was typed or drawn, and a SHA-256 fingerprint of the signature image.

Why "append-only" matters

An audit trail is only useful if nobody can quietly edit it afterwards. Revamp Sign's audit events are append-only: the application adds new events but won't edit or delete existing ones. The history of a document only ever grows.

The certificate of completion

When everyone has signed, Revamp Sign generates a certificate of completion. It's included with the finished PDF, and senders can download it separately too. It shows:

• Each signer, how the link reached them (a masked email address or phone number), and how they opened it.
• An event log with the time (in UTC), the event, the signer and the IP address.
• A verification hash, a fingerprint of the audit record and the final PDF.

What the verification hash is for

A hash is a short fingerprint calculated from a file. Change even one character of the file and the fingerprint changes completely. Revamp Sign stores a hash of the audit record together with the final PDF, and senders can run a check later to confirm the file still matches what was signed.

Why any of this matters

U.S. law treats electronic signatures as valid for most business documents, but a signature still has to be attributable: you need to be able to show who signed and that they meant to. A detailed, append-only audit trail and a certificate of completion are how you do that. (More on the legal side in our guide to e-signature law.)

For signers, it's protection too. The record shows exactly what was presented to you and when, and you get your own copy of the completed document.