E-signature audit trails: the record behind every signed document

What an audit trail is for

When a signed contract is challenged, the question is rarely "is there a signature on the page?" It is "who put it there, when, and was the document the same one they were shown?" An audit trail answers those questions with a record kept by the signing service, not by either party. Electronic signature laws such as the US ESIGN Act and the EU's eIDAS Regulation do not require a particular format, but courts and auditors look for exactly this kind of evidence.

What Salsox records

Every document has an append-only list of events. Among them:

• the document being created and sent, and to whom;
• each time a recipient opens their link;
• each field a recipient fills or signs, and when they finish;
• reminders, corrected email addresses and renewed links;
• a recipient declining, with the reason they gave;
• payments started, received, refunded or disputed on Sign & Pay documents;
• the document completing, being cancelled or expiring.

Each event carries a timestamp and, for actions taken by a recipient, their email address, IP address and device. Events are only ever added, never edited, and they stay with the document.

The sealed PDF and its certificate

On the Business plan, the completed document is sealed: a final PDF is produced with every signature in place and an extra certificate page summarising who signed, when and from which device. A cryptographic fingerprint of the original upload and of the sealed file is stored, so any later change to either can be detected.

Verification codes

Each completed document has a verification code. Anyone holding the signed PDF, such as a bank, a landlord or a court, can enter the code on the public verify page to confirm the document exists in Salsox, when it was completed, and that it matches. No account is needed to check.

Exporting your records

Your records are yours. On any plan you can export every document, original and signed, together with its audit trail, at any time, including after you cancel. Keep them with your own files or in your document management system.

Checking a record yourself

Open any completed document from your documents list and its audit trail is listed beneath it, oldest event first. Read it the way a reviewer would: was the document sent to the address you expected, when was it first opened, and do the signing times make sense for the people involved? A signer who opened a contract at 9:02 and signed every field by 9:05 has a trail that tells its own story. If something looks wrong, the trail is where you start, and it is the same record anyone you share it with will see.

What it is not

Salsox provides simple electronic signatures with a strong audit trail. It does not provide qualified electronic signatures backed by a government-recognised certificate, witnessed or notarised signing, or identity verification against official ID. Some documents in some countries need those; for everyday contracts, agreements, consent forms and acknowledgements, an audit trail like this is what is normally relied on.