What an e-signature audit trail actually proves
If a signature is ever disputed, the audit trail — not the signature image — is what decides the outcome. Most organisations treat it as a vendor feature rather than as their own evidence, and discover the difference during a dispute.
What belongs in a complete audit trail
| Event | What it establishes |
|---|---|
| Envelope created, with document hash | The exact document version sent |
| Sent to a specific address | Delivery target |
| Link opened — timestamp, IP, device, user agent | Access, and from where |
| Authentication performed (OTP, login, knowledge check) | That the signer proved who they were |
| Document viewed before signing | Opportunity to read — rebuts "I never saw it" |
| Signature applied, with timestamp | The act itself |
| Document hash after signing | That the file did not change afterwards |
| Completion and delivery to all parties | That everyone received the executed copy |
If a vendor's audit trail lacks the document hash, you cannot prove non-alteration. If it lacks authentication events, you cannot prove identity. Ask for a sample trail before you buy — it is the single most informative artifact in a vendor evaluation.
What it proves, and what it does not
It proves: that a signature event occurred, that it is associated with a particular document version, when it happened, from what network and device, and what authentication preceded it.
It does not prove: that the person behind the keyboard was the person named, unless the authentication was strong enough to support that claim. An emailed magic link proves control of an inbox. If the inbox was compromised, the signature is still "valid" but the identity claim is weaker than it appears.
That gap is why assurance levels exist. A mortgage note and an internal acknowledgement should not have the same authentication requirement — see the eIDAS tiers for how the EU formalises this, and electronic vs. digital signatures for the U.S. equivalent.
The export problem
The most common failure is a trail that exists only inside the vendor's web interface. Ask these questions while you still have leverage:
- Can I download the completed document and its audit trail in one self-contained file?
- Is that file readable without the vendor's software?
- Does the export include the document hash and the authentication events, or just the signature timestamps?
- What happens to completed envelopes if I cancel the subscription?
- Is the retention commitment in the contract, or only in marketing material?
Get the answers in writing. A vendor that is confident about its export will not hesitate to commit.
Building your own retention habit
- Export each completed envelope when the deal closes, not at year end.
- Store the signed PDF and the audit trail together, with a clear filename.
- Keep them somewhere your organisation controls — not solely in the platform.
- If the document carries long-term obligations, plan for a retention period measured in years and make sure the format will still open.
When you need more than an audit trail
If you need non-alteration to be verifiable by a third party who does not trust your platform, or you need to demonstrate that a document is byte-for-byte unchanged, you need cryptographic signing rather than a platform log. That is the PKI route, and it is a genuinely different guarantee.
Not legal advice. Evidentiary weight is for a court or arbiter to assess in context.