Will it hold up?
An electronic signature is only as good as the evidence behind it. Here is what we record for every document, how the signed file is protected, and where electronic signatures stop being enough.
The laws that recognise electronic signatures
Most countries treat an electronic signature on an ordinary contract the same as ink, provided you can show who signed and that they meant to. The main laws:
- United States: the ESIGN Act (2000) and the Uniform Electronic Transactions Act, adopted by 49 states.
- European Union: Regulation (EU) No 910/2014, known as eIDAS. Signatures made here are simple electronic signatures under eIDAS, which courts must not reject only because they are electronic.
- United Kingdom: the Electronic Communications Act 2000 and the UK version of eIDAS. The Law Commission confirmed in 2019 that e-signatures can execute most documents.
- United Arab Emirates: Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services.
What we record for each signer
Who they are
Every signer gets a personal link by email. With the email code turned on, which is the default, they also type a six digit code sent to the same address before the document opens. The certificate shows when that code was confirmed.
That they meant to sign
Before seeing the document each signer ticks a box agreeing to use electronic records and signatures, and they confirm again when they press Sign. Both moments are timestamped.
Where and how they signed
IP address, the approximate location that IP address resolves to, the browser and operating system, the device's time zone and language, and the exact time of every step, recorded in UTC by our server rather than the signer's clock.
A note on MAC addresses
People sometimes ask for the signer's MAC address. No website can collect one: a MAC address identifies a network card on the signer's local network and is stripped off before traffic leaves their router. Tools that claim to record it are showing something else. The verified email, IP address and device details above are what e-signature laws and courts rely on.
How the signed PDF is protected
When the last person signs we write the signatures and entries into the original pages, add the certificate of completion to the end, and seal the whole file with a digital signature. Adobe Acrobat and most PDF readers show the seal in their signatures panel. If anyone edits the file afterwards, even by a single character, the seal shows as invalid.
Every event in a document's history is stored with a SHA-256 hash of the event before it, so a deleted or altered entry breaks the chain. The certificate prints the length of the chain and its final hash.
Checking a copy
Anyone holding a copy can check it at signpdf.ai/verify. The file is fingerprinted in their own browser and only the fingerprint is sent to us, so the document itself never leaves their computer. If it matches the sealed copy we hold, we show the envelope number, the date it was completed and who signed.
Storage and access
- Files are stored privately and encrypted at rest. There are no public links to any document.
- Signing links are long random tokens. Only a hash of each is kept in our database.
- All traffic is served over HTTPS with HSTS.
- Payments are handled by Stripe. We never see or store card numbers.
When an electronic signature is not enough
Some documents need a handwritten signature, a witness in the room or a notary, depending on the country. Common examples are wills, some powers of attorney, deeds that transfer land, and certain court and family law papers. If you're not sure about a particular document, check with a lawyer where it will be used. We're a signing tool and don't give legal advice.