Glossary
What is an audit trail in e-signatures?
Short answer
An audit trail in e-signatures is the log of everything that happened to a document from sending to completion: who received it, when they opened it, when they confirmed their identity and when they signed, with IP addresses and devices. It is the main evidence if a signature is ever challenged. In Sign PDF each entry is chained by hash to the one before, so a deleted or altered entry breaks the chain.
Updated 25 October 2026
- Audit trail
- An e-signature audit trail is a time-stamped record of every event in a document's signing process, such as when it was sent, opened, viewed and signed, and by which email address, IP address and device.
What an audit trail records
A useful audit trail answers four questions for each signer: who, what, when and from where. Typical entries include:
- Document created and sent, with the sender's account
- Email delivered and link opened by each signer
- Identity step completed, such as an email code confirmed
- Consent to sign electronically given
- Each signature applied, with timestamp in UTC
- IP address, approximate location, browser and device for each action
- Document completed, voided or declined, with any reason given
Why courts and counterparties look at it
Electronic signature laws make e-signatures valid, but they leave it to the person relying on the signature to show it is genuine. UETA section 9, for example, says a signature is attributable to a person if it was their act, which may be shown 'in any manner', including the efficacy of any security procedure.
An audit trail is that showing. If a tenant says they never signed, a log showing the link went to their email, a code from that inbox was entered, and the signature came from a phone in their city ten minutes later is hard to argue with.
Hash-chained audit trails
A plain log can be edited by whoever controls the database. A hash-chained log makes that harder to hide: each entry includes a cryptographic hash of the entry before it, so changing or removing an old entry changes every hash after it.
Sign PDF uses this approach. The chain, the SHA-256 fingerprint of the original file and the events for each signer are printed in the certificate of completion, which is then sealed into the PDF with a timestamped digital signature.
What an audit trail cannot prove
No website can capture a device's MAC address, and an email code proves control of an inbox, not a person's legal identity. Sign PDF does not check government ID or record video. For most contracts the email-based evidence is the kind courts weigh, but for higher-risk deals you may want ID verification from a service that offers it. This is not legal advice.
Questions people ask
Where do I find the audit trail on a Sign PDF document?
It is printed in the certificate of completion added to the end of the signed PDF, so it travels with the file. Every party gets the same copy.
Is an IP address enough to identify a signer?
Not on its own. IP addresses can be shared or masked by a VPN. It is one piece of evidence alongside the email code, device details and timing.
Can an audit trail be faked?
A plain text log could be. Hash-chaining the entries and sealing them inside a digitally signed, timestamped PDF makes later changes detectable.
Does the audit trail show when someone declined?
In Sign PDF, yes. If a signer declines, the decline and the reason they gave are recorded, and the sender is told.
Upload a document and watch the boxes land
See every signature, initial and date box placed before you sign up. Sending starts at $5 a month, monthly, cancel any time.
Upload a document