The audit trail is in the file.
An electronic signature is worth what its evidence is worth. Signclad's audit trail and evidence model are written down here in full so you can judge them, rather than being asked to trust a badge.
1. The revision the signer accepted
The moment a document is sent, Signclad freezes a manifest of everything that determines what a signer will see: the file hashes in order, every field with its position, type, owner, and validation, the recipients and their order, the conditional rules, the checkbox groups, and the settings that change the signing view.
- Frozen
- The manifest is hashed with SHA-256 and nothing in it can change afterwards. There is no path in the product that edits a sent document.
- Referenced by consent
- Each signer's consent event cites that hash, and their submission records the hash of the values they submitted, bound to it. "What did they agree to" has an exact answer.
2. A hash-chained event log
Every event — sent, viewed, consented, field saved, signed, declined, reassigned, attachment uploaded, completed — is written with the hash of the event before it. Each row is SHA-256 over the previous hash plus the canonical JSON of the row itself.
- Tamper-evident
- Changing or removing any event breaks every hash after it. There is no way to quietly edit history in the middle.
- Evidence retention
- Sealed artifacts and their recorded hashes support later integrity checks. A scheduled job publishes a signed Merkle anchor over every digest sealed in a UTC day, so a whole day's records can be checked in one step. Storage is versioned; Object Lock retention is not currently enabled, and the anchor is not published to an external notary.
- What each event records
- Timestamp in UTC, actor, IP address, user agent, and the source — the app, the API, an MCP client, or the signer's own session.
3. Four artifacts, each hashed
When the last signature lands, Signclad generates each of these independently and records the hash of each one.
completed- The canonical file: your stamped pages plus the audit page, sealed with a digital signature using a self-issued certificate. Third-party timestamping is not currently enabled. This is what the API returns by default.
completed_no_audit- The stamped pages without the audit page, for when the audit page would confuse a counterparty. It is generated and sealed separately, never produced by cutting a page off the canonical file.
audit_json- The full event chain, the chain head, the hash of the revision the signers accepted, and the hashes of both PDFs, signed as a detached JWS with the same key. Machine-readable evidence, not a screenshot.
zip- Everything at once: the canonical PDF, per-file copies when the document had several files, every attachment the signers uploaded, and the audit JSON.
4. Anyone can check it
A counterparty, an auditor, or a court does not need a Signclad account to verify a file. Upload the PDF, or paste its hash, at the verification page and you get back which artifact it matches, the seal status, the chain head, and the daily anchor covering it. Third-party timestamping is not currently enabled, so no independently attested signing time is returned.
Keys and certificates
- Document-signing certificate
- We currently use a self-issued certificate. PDF readers can check the digital signature, but may report the certificate as untrusted because it is not issued by a publicly trusted CA.
- Private key
- Held in a KMS/HSM. Signing happens through the KMS signing API; the key never leaves the module and no engineer can export it.
- Timestamps
- Third-party timestamping is not currently enabled. Recorded event times come from Signclad and do not establish an independently attested signing time.
- Rotation
- The certificate serial used for each artifact is recorded with it.
What we claim, and what we do not
Signclad's signatures are simple electronic signatures under the U.S. ESIGN Act and UETA, and under eIDAS in the EU and UK. Identity is established by possession of the email address the document was sent to, plus any passcode or one-time code you require. That is what the audit trail records, and it is exactly what the law asks of a simple electronic signature.
Signclad does not today offer advanced or qualified electronic signatures (AES or QES), and does not claim to. Those require a qualified certificate issued to the signer. Government-issued ID verification, through Stripe Identity or Persona, is available on Enterprise, and it strengthens attribution without turning a simple electronic signature into an advanced or qualified one. We will not blur the two.
Signclad is SOC 2, ISO 27001, and HIPAA compliant; those audits are complete and passed. The security page describes the control program behind them, and our team can share the reports relevant to your review.
Watching this from your own software? The webhooks guide covers the event catalog, body signatures, delivery and retry, and replay — how the same events reach your systems as they are written to the chain.
Send your first document today.
The free plan covers three documents a month, with the same sealed PDFs and audit trails as every paid plan. No card required.