# Audit trail

An audit trail is the time-ordered record of every event in a document's life: who created it, who it was sent to, and what each person did, with times.

## In plain words

A signature on a page is a result. The audit trail is how you got there. It lists events in order: created, sent, opened, consented, viewed, signed, completed. Each event carries a time and details such as the address a link went to, or the device used.

When nobody questions a signature, nobody reads the trail. When someone says "that wasn't me", the trail is what you hand over. Our [audit trail guide](/guides/audit-trail-explained) goes through what courts look for.

## An example

A rental application is disputed. The trail shows the link went to the applicant's own address, it was opened on a phone at 7:42 pm, the applicant accepted electronic records at 7:43, viewed every page and signed at 7:51. That is a story a person can follow, and it is far stronger than a signature image.

## How it shows up in docuinked

Every event in docuinked is written to a hash-chained log. Each entry includes the [hash](/glossary/hash) of the one before, so an edit to an old entry would break the chain. The database refuses updates and deletes on the log, and checkpoints over it are timestamped by an outside authority every hour.

Events cover the full flow, including the agent side: an agent's draft, a person's approval, the send, consent, viewing, signing, declining and the seal. The `get_evidence` tool returns all of it, with a check of whether the chain is intact. The sealed PDF also carries a summary, so the file can stand alone.

## Common confusions

**An activity feed is not an audit trail.** Many apps show "Dana viewed this". That is a feed. An audit trail is meant to survive a dispute, so it must resist quiet edits. That is what [tamper-evident](/glossary/tamper-evident) design gives you.

**The certificate is not the whole trail.** A [certificate of completion](/glossary/certificate-of-completion) is a summary page. Keep the full evidence export too.

## Related terms

- [Certificate of completion](/glossary/certificate-of-completion)
- [Human-in-the-loop](/glossary/human-in-the-loop), recorded as its own events
- [Webhook](/glossary/webhook), the push signal that a trail has grown

## Sources

Checked 2026-11-07.

- [Fenwick on audit trails in court](https://www.fenwick.com/insights/publications/using-e-signatures-in-court-the-value-of-an-audit-trail)

## Common questions

### What is a hash-chained log?

It is a log where each entry includes a hash of the entry before it. Change an old entry and every later link breaks, so a quiet edit can't hide.

### Does the docuinked audit trail record agents?

Yes. A draft made by an agent key and the person who approved it are separate events. The record never merges the agent and the person.

### Can I download the audit trail for my own records?

Yes. Call `get_evidence` for any document, or use the evidence export in the web app, and store it next to the signed PDF.