How It Holds Up
What the product does to make a signed file stand up, written from the code, with each limit stated. It follows the controls these standards describe; whether they meet your own obligations is for you and your advisers to decide.
Advanced Electronic Signatures
Advanced level, every paid plan- What It Is
- The EU's eIDAS regulation, in Article 26, describes an advanced electronic signature: linked to one signer, able to identify them, made with data under their control, and linked to the document so that any later change can be detected.
- What the Product Does
- At the advanced level each signer proves their mailbox with an emailed code, gets a certificate issued to them for that signing, and adds a PAdES digital signature over the document exactly as it stood when they signed. Each signature is a new revision of the file, so every signature before it still covers the same bytes. A sender picks the level for each envelope, and a workspace can make it the default.
- Where It Stops
- The certificate and its key are made on our server for that one signing, used once and destroyed, and the key is never stored. The certificate comes from the platform's own authority, which Adobe Acrobat does not know by default; Trust This Seal explains what that means. This is an advanced signature, not a qualified one.
Trusted Timestamps
Every plan- What It Is
- An RFC 3161 timestamp is a signed statement from an independent timestamp authority that a piece of data existed at a given moment. The time on a signature then rests on that authority, not on the signer's computer or on our servers.
- What the Product Does
- Every finished file carries the platform's seal with a timestamp, and then a closing document timestamp over the whole file. At the advanced level each signer's signature carries its own timestamp, and if no authority answers, the signature is not made and the signer is asked to try again. An authority receives a hash and nothing else.
- Where It Stops
- We ask Sectigo first and DigiCert second, and freetsa.org, a volunteer service, only as a last resort when neither answers. If no authority answers for the closing document timestamp, the file is kept without it and the certificate of completion prints the lower level the file reached.
Long-Term Validation
Every plan- What It Is
- A signature has to stay checkable for years, after the certificates behind it have expired. Long-term validation keeps everything a checker needs inside the file itself.
- What the Product Does
- Every finished file carries the certificates and revocation lists behind its signatures and its seal in the PDF's own validation store, and the closing timestamp covers that store, so a checker needs no live lookup to read the validation data.
- Where It Stops
- Revocation data is certificate revocation lists (CRLs), captured when the file is sealed; there is no OCSP. If a list cannot be fetched at that moment, the file is still sealed, at a lower level, and the certificate of completion says which.
21 CFR Part 11 Controls
Advanced level, every paid plan- What It Is
- The US FDA's rule for electronic records and signatures asks for signatures tied to one person, checked again at the moment of signing, with the meaning of each signature recorded and shown beside it.
- What the Product Does
- At the advanced level each signer has their own identity, enters a fresh code from their mailbox within ten minutes before they finish, and chooses what their signature means: “I approve this document” or “I have reviewed this document”. The name, the date and time and the meaning are drawn with the signature and printed on the certificate of completion, and every step is in the audit trail.
- Where It Stops
- These controls apply at the advanced level only. Part 11 also asks for things software cannot supply on its own, such as your procedures, training and validation of the system for your use, and those stay with you.
A Hash-Chained Audit Trail
Every plan- What It Is
- A record of every step an envelope goes through, from upload to completion: what happened, who did it, when, and from which internet address.
- What the Product Does
- Each event is written in the same transaction as the action it records and carries the hash of the event before it, so the events form a chain. The newest hash is printed on the certificate of completion, and Verify a Document recomputes the whole chain.
- Where It Stops
- The trail is append only because a database trigger refuses any change or deletion. That rule lives in the database, and somebody with full control of the database could turn it off, which is why the chain matters: at Verify a Document a removed or altered entry shows as a break in the chain, or as a head hash that no longer matches the certificate.
The Certificate of Completion
Every plan- What It Is
- A separate PDF that comes with every finished envelope and says who signed, when and from where.
- What the Product Does
- It lists each signer with their email address, how they were checked (the link alone, an access code or an emailed code), the internet address and browser they used, the consent they gave, and when they were sent the document, opened it and signed. Then come the full list of events with each one's hash, the hashes of the finished files, and a QR code that opens the verify page. It is sealed in its own right.
- Where It Stops
- An internet address shows where a connection came from, not who was holding the device. What ties a signature to a person is the mailbox the link was sent to and, at the advanced level, the emailed codes.
Public Verification
Every plan- What It Is
- A way for anyone holding a finished file to check it without taking our word for it.
- What the Product Does
- At Verify a Document anyone can upload a file, or type the envelope id and the hash from its certificate. The check confirms the file's hash matches a file this platform sealed, re-checks every signature and timestamp inside the file itself, and recomputes the audit chain. No account is needed.
- Where It Stops
- Somebody outside the sending workspace sees names as initials and no title. A copy that was re-saved or printed to a new PDF no longer matches and is reported as unknown, which is correct: it is not the sealed file. Checks are limited to 20 an hour from one address.
Retention and Legal Hold
Every plan- What It Is
- Rules for how long documents are kept, and a way to stop anything being deleted while it may still be needed.
- What the Product Does
- By default a workspace keeps its documents until somebody deletes them. An admin can set a retention period in Settings, Compliance, after which the files and the personal details on them are removed. A legal hold, on the whole workspace or on one envelope, stops every deletion: a retention sweep, the removal of a deleted document and an erasure request.
- Where It Stops
- When a file is removed, its hashes and its audit trail stay, so it can still be shown whether a given file was the one signed. A deleted document is removed 30 days after it is deleted, and database backups catch up as they roll over.
GDPR Data Requests
Every plan- What It Is
- Under the GDPR a person can ask for a copy of the personal data held about them, or for it to be erased.
- What the Product Does
- Every email a signer receives carries a Your Data link. Through it they ask the workspace that sent the document for a copy or an erasure, with no account, and the workspace answers from Settings, Requests. An erasure removes their name, email address, internet address, browser details, signature images and the certificate body that carried their name. Data Requests has the steps.
- Where It Stops
- The signed file and its audit trail are kept, because they are the record of an agreement, which the GDPR allows (Article 17(3)). An erasure is refused while a legal hold is on. The workspace that sent the document decides each request, and we act on its instructions.
Accessibility
Every plan- What It Is
- WCAG 2.2 at level AA is the common standard for web pages that work with a keyboard, a screen reader, enlarged text and enough contrast.
- What the Product Does
- WCAG 2.2 AA is the standard every signer and sender page is built toward, and automated accessibility checks run on them in light and dark, on a desk and on a phone. The Accessibility Statement says what it covers, the gaps we know about and how to report one.
- Where It Stops
- Every page is checked by automated tools before a release, and the code was reviewed against every WCAG 2.2 A and AA criterion in October 2026. A screen-reader pass by a person is part of each release review; the statement records the date of the last one. If something gets in your way, tell us with Contact Support at the foot of any page and we fix it.
Send a Document You Can Prove
Start on the Free plan. No card needed.