What a signature made here is
A sign request sends a PDF to each signer by email, with a private link. The signer opens the document, reads it, agrees to sign electronically, and signs by drawing, typing or uploading their signature. The sender can also require an access code, which they give the signer themselves, apart from the email; the link shows nothing until it is typed, the signed copy asks for it too, and five wrong codes lock the link until the sender sends a new one. When everyone has signed, the document is sealed: a certificate page is added, its SHA-256 fingerprint is recorded, and a timestamp from an independent authority (RFC 3161) fixes the moment. Everyone gets the signed copy.
This is an electronic signature: evidence that a particular person, reached at a particular address, agreed to a particular document at a particular time, with a record that shows any later change. It is not a certificate-based (digital) signature issued to the signer by a certification authority, and we do not claim it is.
What the audit trail records
- who sent the request: name, email address and the country of their network address;
- each signer’s email address, and whether an access code was required, with each time it was typed right and any lock wrong codes caused;
- the consent text each signer agreed to, its version, and the time of agreement;
- the signature itself as drawn or typed, how it was made (drawn, typed in a named style, or uploaded), the device in plain words, and the country of the network address;
- every event with its time: sent, delivered, opened, reminded, signed, declined, completed, downloaded;
- the number of pages, signatures and initials;
- the SHA-256 fingerprint of the final document and the authority’s timestamp.
The certificate page carries the essentials; the full record comes as a separate audit PDF, in English and in the sender’s language. The record is kept for seven years after the request ends, without the document itself, so a signed copy can be checked against it on the verification page long after the document has been deleted from our servers (90 days).
European Union: eIDAS
Regulation (EU) 910/2014 (eIDAS) recognises three levels. A signature made here is an electronic signature in the sense of Article 3(10), and Article 25(1) says such a signature shall not be denied legal effect or admissibility as evidence solely because it is electronic. Whether it also meets the requirements of an advanced electronic signature (Article 26: uniquely linked to and capable of identifying the signatory, created under their sole control, and linked to the data so that any later change is detectable) is a question of fact in each case; the email link, the optional access code and the sealed fingerprint are the facts we record for it. It is not a qualified electronic signature (QES): we issue no qualified certificates and use no qualified signature creation device.
United States: ESIGN and UETA
The federal Electronic Signatures in Global and National Commerce Act (2000) and the Uniform Electronic Transactions Act, adopted by almost every state, give an electronic signature the same effect as a handwritten one where the parties agreed to deal electronically, the signature is attributable to the person, and it is associated with the record. A sign request records the consent, the attribution (the address the link went to, the access code if one was required, the events) and the association (the signature placed in the document, sealed by its fingerprint). Some records are excluded by those laws themselves: wills and testamentary trusts, certain family-law matters, court documents, and some notices such as of default, eviction or cancellation of insurance.
India: the Information Technology Act
Under the Information Technology Act 2000, an “electronic signature” in the technical sense of section 3A is one made with a technique notified in the Second Schedule, such as a Digital Signature Certificate or Aadhaar-based eSign. A signature made here is not one of those. It is, however, evidence of agreement: section 10A provides that a contract is not unenforceable solely because it was formed by electronic means, and the audit trail is the electronic record that proves who agreed to what and when, admissible under the rules for electronic records. For filings that the law reserves to a Digital Signature Certificate or eSign (company and tax filings, for instance), use those.
When you need more
- Where a law or a counterparty demands a qualified signature (EU), a notarised or witnessed signature, a Digital Signature Certificate or Aadhaar eSign (India), or a wet-ink signature: deeds in some jurisdictions, wills, certain powers of attorney, court and registry filings.
- Where your organisation’s own policy sets a higher identification standard than an email address and an access code given by the sender.
To sign a PDF with your own certificate (PAdES, with a timestamp), use Sign PDF in your browser; the certificate never leaves your device.
A note
This page explains how the service works and the laws it is built to serve. It is not legal advice; the effect of a signature depends on the document, the parties and the law that applies to them.
Questions about this document can be sent to support@uvpdftool.com.