What is an e-signature audit trail, and why does it matter?

An electronic signature on its own is just a mark. What makes it trustworthy is the record around it: the audit trail. If a client ever says “I didn’t sign that” or “that’s not what I agreed to”, the audit trail is your evidence.

What a good audit trail records

• Identity: the signer’s name, email address and, where relevant, title.
• Consent: that the signer agreed to sign electronically.
• Timeline: when the document was sent, opened and signed, with timestamps.
• Technical details: IP address and browser or device for each step.
• Document integrity: a cryptographic fingerprint (hash) of the exact document signed.
• Every signer: the same details for each party, in the order they signed.

The signing certificate

Many tools summarise the audit trail in a certificate attached to the signed document, so anyone holding the PDF can see who signed, when and the document fingerprint without logging in anywhere.

Why it matters

In the UK, EU and US, electronic signatures are valid for most business agreements (see are electronic signatures legally binding?). In a dispute, the question becomes one of evidence. An audit trail that ties a specific person to a specific, unaltered document at a specific time makes that evidence strong.

Good practice

• Send signing links to each person’s own email address.
• Lock the document when it’s sent, so it can’t change before or after signing.
• Give every party a copy of the signed document and certificate.
• Keep signed documents for as long as the agreement and any claims under it could matter.

Frequently asked questions