What is an electronic signature audit trail?

An audit trail is a timestamped record of every meaningful step a document went through: when it was created, sent, opened, signed, declined, or completed. It exists because the signature image itself — a squiggle or a typed name — proves nothing on its own. What proves something is the sequence of events around it: this specific link was opened from this IP address at this time, and a signature was added right after.

A plain log is just a list — anyone with database access could quietly edit or delete a row. A hash-chained log adds a fingerprint of each entry into the next one, so entry #5 mathematically depends on entries #1 through #4. Change or remove any earlier entry, and every fingerprint after it stops matching. That mismatch is what makes the log tamper-evident: you don't have to trust that nobody touched it, you can check.

When signing finishes, a Certificate of Completion is generated directly from the sealed audit chain — never from application logs, which could disagree with what actually happened. On Signavos, the certificate lists the sender, the signer (name, email, and authentication method — the emailed link, in this case), every event in order with its timestamp, a summary hash of the whole chain, and the SHA-256 checksum of the final signed PDF.

1. 01Check the document itself. Compute the SHA-256 hash of your PDF and compare it to the checksum printed on the certificate. A match means the file is exactly what was sealed at completion.
2. 02Check the chain. On Signavos, the document page has a verification panel that recomputes the entire hash chain and reports the exact sequence number where any break would occur, if one exists.

Neither check requires trusting the vendor's word for it — both are mechanical and repeatable.

It proves that a specific link was used and a specific action was taken at a specific time from a specific device. It does not, on its own, prove the identity of the person behind the keyboard beyond the fact that they had access to the recipient's inbox — the same limitation every email-link-based e-signature tool shares, not just this one. For higher-assurance identity verification, some jurisdictions and use cases call for qualified electronic signatures, which is a different, heavier-weight process. See electronic signatures vs digital signatures for that distinction, and are electronic signatures legally binding? for how courts weigh evidence like this.

Signavos adds a hash-chained audit trail and a completion certificate to every signed document: see how the Signavos audit trail and certificate work, or compare it in Signavos vs DocuSign.