E-signature audit trail

A typed name proves very little on its own. What makes an electronic signature defensible is everything around it: that the document sent for signature is provably the document that was signed, that each party reached it through a link only they were sent, and that the sequence of events is recorded rather than reconstructed.

Which is why the audit trail — not the signature image — is the artefact that matters if the agreement is ever disputed.

Per event, and per party:

• A content hash of the document as presented, so any later change to the text is detectable.
• The time each party signed, and the address and client they signed from.
• The delivery of the signing link and the identity it was addressed to.
• A declined signature, which is an event and should be recorded as one rather than as an absence.

A signing link is a credential. A link that never expires and is forwarded — as links routinely are — hands a stranger the full document, both parties' addresses and both signatures, indefinitely.

Time-limiting the signing link, and issuing the executed copy under a separate credential of its own, is the difference between a convenience feature and a leak with a URL.

SalesShift records a hash of the contract's content, timestamps each party's signature with the address and client it came from, keeps declines as events, and exposes the full trail alongside the executed PDF — which carries a hash of its own. Signing links are time-limited rather than permanent.