Electronic signatures and evidence

What an electronic signature made in Bookmaker is, the evidence kept for each one, and how anyone can check a signed document later.

The kind of signature#

Signatures made with Sign are simple electronic signatures under the US ESIGN Act and UETA and the EU's eIDAS Regulation. That is the kind of signature used for everyday business agreements: contracts, NDAs, offer letters, quotations, purchase orders, consents.

Some documents need more than that, or cannot be signed electronically at all. Wills, many property deeds and some court and family documents are examples. If you are unsure, ask a lawyer before you rely on an electronic signature.

What makes a signature hold up#

Four things matter when someone asks "did this person really sign this?". Bookmaker records each of them.

The certificate of completion#

The signed PDF ends with a certificate of completion. It lists:

• the request's reference, and when it was created and completed;
• the original document's name, page count and fingerprint;
• for each signer: email, the role they signed in (such as "Client"), when they first opened it, when they agreed to sign electronically, when they signed, how their identity was checked (email link, access code, or signed in to Bookmaker), their device and their network fingerprint;
• anyone who passed their place to someone else instead of signing: to whom, when, and the reason they gave;
• every file a signer attached: what was asked for, who attached it, its name, size and fingerprint as uploaded, and the pages of the PDF it was added as;
• every event, in order, from creation to completion;
• the words of the disclosure each signer agreed to;
• the address of the verification page.

Answers to dropdowns and choices are printed where the fields were placed, like any other field. Names are printed as text you can select and search, in every script the server has a font for; names in scripts that join letters or read right to left (Arabic, Hebrew, Hindi and others) are drawn as a picture of the text, exactly as written.

Attachments#

A file a signer attaches is checked by its contents, not its name: only a real PDF, JPG or PNG is kept. It is stored as uploaded, and its fingerprint is recorded, so the original can always be produced. A copy is added to the signed PDF before the certificate — photos turned upright and sized for print — so the signed file carries everything in one place. A file that cannot be added (a damaged or password-protected PDF) is still listed on the certificate with its fingerprint, and stays with the request.

Passing a request on#

A signer can pass their place to someone else, for example to a colleague with the authority to sign. The new person gets their own link and signs with their own evidence; the record shows both people, who passed it to whom, when and why. A place protected by an access code cannot be passed on, because the code was shared with that person alone, and the sender can turn the option off for a request.

Verifying a document later#

Anyone holding the signed PDF can check it at /verify. The file's fingerprint is calculated in their own browser and compared with the one recorded when the request was completed. A match proves the file is exactly the one produced then. Any change to the file — even opening and saving it again in another program — gives a different fingerprint, so a changed copy never matches.

Privacy#

• Documents sent for signature are stored privately with your organization's data, never at a public address.
• A signer's network address is kept only as a one-way fingerprint, which can show that two signatures came from the same network but cannot be turned back into the address.
• Each link works for one person and one request, and stops working when the request is completed, voided, declined or expired.