What an e-signature audit trail contains, with a real example

When a client says "I never signed that", the signature image settles nothing: anyone can paste an image. What settles it is the record around it. This page shows what that record looks like in SoloWOS, line by line, and how to use it. It belongs to our contracts and signatures guides; the law behind it is in are electronic signatures legal?.

Annotated example: a certificate of completion

Below is the event log of a fictional two-signer contract, as SoloWOS prints it in the certificate of completion that comes with every signed PDF. Names, emails and IP addresses are made up.

Above the event log, the certificate lists the document title, a request ID, the sender, the page count and the created, sent and completed times. A section per signer repeats their status, consent time, signing time, IP address and device (the browser's user agent). An integrity section prints two SHA-256 values: one for the PDF exactly as it was sent, one for the final signed PDF.

How the fingerprint works

A SHA-256 hash is a 64-character value computed from every byte of a file. Change one comma and the value changes completely. To check a signed contract, run `shasum -a 256 contract-signed.pdf` on a Mac or Linux (or `certutil -hashfile contract-signed.pdf SHA256` on Windows) and compare the result with the signed SHA-256 printed in the certificate. If they match, the file is the one that was signed. In SoloWOS, the "Verify integrity" button on a completed request recomputes both fingerprints from the stored files for you.

Using the audit trail if a client disputes a signature

1. Download the signed PDF and the certificate of completion, and check the fingerprint as above.
2. Point to the chain: the invitation went to the client's own email address, the document was opened from that link, consent and signature followed minutes later from the same IP and device.
3. Add what surrounds it: the emails where the client discussed the terms, the invoice they paid after signing, the deposit. Courts look at all of it.
4. If it goes to court, the certificate is evidence your side offers to authenticate the signature. Under Federal Rule of Evidence 901, evidence only needs to be sufficient to support a finding that the item is what you claim; distinctive characteristics and the circumstances count. State courts have similar rules.
5. For a large amount, talk to a lawyer before you reply in writing.

How long to keep the audit trail

The ESIGN Act lets you keep a contract electronically when the electronic record accurately reflects the information and stays accessible for later reference (15 U.S.C. § 7001(d)); UETA § 12 says the same at state level. No federal rule names one retention period for client contracts. A workable rule: keep the signed PDF and certificate for the life of the contract plus the statute of limitations for written contracts in the governing state. In California that is four years from the breach (Code of Civil Procedure § 337); other states differ, so check yours. Some freelancer laws add their own: California's Freelance Worker Protection Act makes the hiring party keep the contract at least four years, Columbus five.

Store the signed PDF and the certificate side by side, outside the e-signature tool too: a cloud folder per client works. If you ever cancel the tool, you still have the evidence.

What an audit trail can't prove

• Identity beyond the email inbox. A standard audit trail proves the person controlled that email address and device, not that they showed ID. SoloWOS doesn't do ID checks.
• Exact location. An IP address points to a network, often a provider's, and can be a VPN.
• Authority to sign for a company. Make sure the signer's title is right and, for large contracts, ask who is authorized to sign.

In SoloWOS

Every request you send for e-signature produces the certificate shown above, in English or in your workspace's language. Signers sign in the order you set, reminders can go out every 2, 3 or 7 days (at most 3 automatic ones per signer), and an optional expiration date closes the links. If a signer declines, that's logged too. Basic ($2/month) includes 3 requests a month and Solo 15 for $15/month. For the difference between this kind of record and a certificate-based signature, read electronic vs digital signature.