What the record actually shows.
Every packet carries a history that anybody holding its code can check for themselves. This page explains what that history demonstrates, and what it does not.
How the record is built
Each packet has an append-only list of events. Nothing in it is ever updated or deleted, and it survives the documents being purged.
Every event carries a fingerprint computed from its own contents and the fingerprint of the event before it. Change one field of one event and every fingerprint after it stops matching, which is what makes tampering detectable rather than merely forbidden.
There are 38 kinds of event and the list is closed. A new one is a change to the product, not something that appears quietly.
Also recorded on each document
- A SHA-256 digest
- Computed as the file arrives and printed on the certificate
- Page count and size
- Read from the file itself rather than taken on trust
- The time on our clock
- Our server clock, which a signer cannot set
What it cannot tell you
An address a connection came from is not the same as a person, and we print that on the certificate rather than leaving you to work it out.
A shared office, a phone on mobile data and anybody using a VPN all produce addresses that say very little about who was sitting there. The certificate classifies the connection where it can and says when it cannot.
- That a particular human being pressed the button
- Where somebody physically was
- That the person named is who they said they were, unless you asked for a code
Where you need more certainty than a link in an email gives you, a packet can require an access code or a one-time code by email before anything opens, and each attempt is recorded whether it succeeds or fails.
Where the law comes into it
We are not making a compliance claim on this page. The record described above is evidence, and evidence is what a dispute turns on, but whether a particular signature satisfies a particular statute in a particular country is a question for a lawyer looking at your situation.
Our certificate has not yet been through legal review, and until it has we would rather say so than print a badge. When that review is finished this page will say what it concluded.
Your documents
Never used for training
Nothing you upload is used to train a model, ours or anybody else's. There is no setting for this because there is nothing to switch off.
Yours to take
Export every packet, document and record in your workspace whenever you want, on any plan, without asking.
Deleted when you say
Set how long completed packets are kept. When the time is up the documents go, and the record of what happened stays.
Documents are held in our own database in one region today, so this is not a product you should buy for a data residency requirement. When that changes it will be stated here rather than implied.
Try the check page on a real agreement.
No account, no sign-in, and it works for anybody you send a code to.