# E-signature audit trails, explained

An audit trail is the record of how a signature got onto a document: who was sent what, when, from where, and what they did. In a dispute it does more of the work than the signature, because a signature can only be denied, and a record can be explained.

## Why this is the real product

Look at how disputes go. A signature passes until someone says "that wasn't me". Then the burden moves to the party relying on it, who must explain how it was made. A bare certificate with an ID code isn't an explanation. Courts have said so. A plain step-by-step account, backed by logs, usually works, and it can come from an HR manager rather than an engineer.

## What a useful trail records

| Question in a dispute | What answers it |
|---|---|
| "I never signed" | Who sent it, to what address, what steps were passed, device and IP, the times |
| "I didn't mean to sign" | The exact wording shown, the separate consent step |
| "The document changed" | The hash at signing, the seal, the timestamp |
| "I never agreed to electronic" | The consent event, the disclosure version, the access test |
| "I never got a copy" | The delivery events |
| "Someone used my email" | Any second step, plus the honest limit: email proves a mailbox, not a person |

## Tamper-evident beats tamper-proof

Nobody can honestly promise tamper-proof. What you can do is make a change show. In a hash chain, each entry includes the hash of the one before it, so editing an old entry breaks every entry after it. That alone isn't enough, because an insider could rebuild the whole chain. So the chain's head also needs an outside anchor. docuinked has a timestamp authority sign a checkpoint every hour. Anything changed after a checkpoint would show, and the window is up to an hour.

## What docuinked records

The `get_evidence` tool returns every event, the chain, whether the chain is intact, the seal certificate and a plain description of the process. Events cover the agent's draft, the approval, sending, consent, viewing, signing, declining and sealing. The signed PDF carries a summary too, so it stands alone.

## Keep it where you can reach it

Fetch the evidence when a document completes and keep it with the PDF. A year from now, the person who needs it will be someone in your company who has never heard of us. A plain record they can hand to a lawyer is the point.

## Sources

Checked 2026-11-07. Case details are from summaries, so read the opinions before you cite them.

- [Fenwick on audit trails in court](https://www.fenwick.com/insights/publications/using-e-signatures-in-court-the-value-of-an-audit-trail)
- [Hudson Cook on Fabian v. Renovate America](https://www.hudsoncook.com/article/california-court-finds-business-could-not-verify-consumers-electronic-signature-despite-docusign-markers/)
- [DLA Piper on Aerotek v. Boyd](https://www.dlapiper.com/en-us/insights/publications/2021/06/enforcing-a-disputed-electronic-signature)
- [Federal Rule of Evidence 902](https://www.law.cornell.edu/rules/fre/rule_902)

This guide is general information, not legal advice.

## Common questions

### Is an IP address enough to prove who signed?

Rarely by itself. IP logs help when they line up with other facts, such as the signer's own account or a known location. They support a story and seldom decide one.

### Who explains the audit trail in court?

Usually someone from the business relying on the signature, not the vendor. That is why the record needs a plain description of the process that a non-engineer can adopt.

### How long should I keep an audit trail?

As long as you keep the document, and at least as long as a claim could arise. The period comes from the law for that kind of record, so ask your lawyer.