Browse help
The audit trail
Everything we record about an envelope, and why it cannot be edited.
Last updated
Every action on an envelope is written to a record that is added to and never changed. Each entry is sealed to the one before it, so the entries form a chain: alter any one of them and every entry after it stops matching. An envelope is the bundle you sent for signature: the documents, the people and the fields.
Reading it
Open Envelopes, open the one you want, and look for the Audit trail panel on the right of its page. The most recent entries show first, each numbered by its position in the chain, so entry seven is the seventh thing that happened rather than the seventh thing on screen. Show all opens the rest and Show recent only collapses it again.
Open any entry and it gives you the evidence recorded with it: IP Address, User Agent and Event Hash, each with a button to copy it.
What gets recorded
- The envelope being created, sent, viewed, completed, voided, declined or expired.
- Each recipient opening the document, and each field they complete.
- Each signature as it is captured, with what kind it was.
- Each signer finishing, with the consent statement they were shown, its version and its exact wording.
- Each reminder sent.
- The finished document being produced, and the certificate of completion being issued.
Against every entry: the time, who acted, their IP address and their browser. Who acted is recorded honestly rather than conveniently. A person is recorded as a person, a signer as that signer, an integration as that integration, and something the platform did on its own is recorded as the platform with the reason stated. Nothing is attributed to somebody who was not there.
Why it cannot be edited
Two things hold it in place, and they cover different risks.
The chain itself makes a change visible. Each entry carries a fingerprint computed over its own contents and over the fingerprint of the entry before it. Rewriting one entry changes its fingerprint, which breaks the link the next entry holds, and so on to the end. Recomputing the chain is what the Audit chain intact check on the verification page does.
The database refuses the change in the first place. Audit entries cannot be updated at all, and cannot be deleted unless the envelope is still a draft that was never sent and never seen by anyone.
Independent timestamps
The head of the record is regularly timestamped by several independent external timestamp authorities under the RFC 3161 standard. Each authority signs the same value, so corroboration does not rest on any one of them, and the time comes from inside their signed token rather than from us.
That is what puts the record beyond our own reach: entries resealed after the fact would be internally consistent again, and still could not produce a timestamp a third party had signed over the earlier state.
The certificate of completion says which of these applies to your envelope. Where the record has been timestamped it names the authorities and the point they attested to. Where it has not, it says plainly that the times shown are CecurSign's own server clock. The raw timestamp tokens travel in the evidence pack with a procedure anyone can run themselves, using ordinary open source tools and without trusting our software.
Taking it away with you
The Evidence pack on the envelope's page is a ZIP holding the original documents, the signed documents, the certificate, the signature images, a machine readable copy of every event, and the timestamp tokens. It is the version to send to an insurer, an auditor or a counterparty's solicitor.
The record is kept for as long as your account exists. See Where your documents are kept.