This page explains audit trails in general terms. It is not legal advice.
Why it matters
A signature on its own says little about how it got there. If a customer later says they never agreed, or that the document was different, the business needs evidence. The audit trail is that evidence. It shows the sequence of events, the people involved and whether the document changed.
What an audit trail typically records
| Event | Detail usually captured |
|---|---|
| Sent | Date and time, who sent it, who it was sent to |
| Viewed | When the signer opened the document |
| Consent | That the signer agreed to sign electronically |
| Signed | Date and time, plus technical details such as IP address and browser |
| Countersigned | Who signed on the business side, and when |
| Completed | When the document was finalised |
Proving the document did not change
Good e-signature tools also take a fingerprint of the document, called a hash. Any change to the file, even a single character, produces a different hash. Recording the hash at each step, and sealing the final PDF, makes later changes detectable.
Where to keep it
The audit trail should travel with the signed document, often as a certificate of completion attached to the final PDF, so anyone holding the document can see the history without logging in to another system.
Common mistakes
- Relying on email threads. Forwarded emails and attachments are easy to dispute and hard to search.
- Storing the PDF without the trail. The signature is far weaker without its evidence.
- Allowing edits after sending. The document should be fixed once it goes out.
- Losing track of where it is. Signed documents filed away from the customer’s record are hard to find when needed.
Questions to ask of any e-signature tool
- Does it record consent to sign electronically?
- Does it log each step with a time and technical details such as IP address?
- Does it fix the document when it is sent, so the signer sees exactly what you sent?
- Does it seal the final PDF so later changes can be detected?
- Does the completed document carry its own record of the signing, such as a certificate of completion?
- Can you find the signed document again from the customer’s record, years later?
How GuardenerAI handles it
- GuardenerAI Signatures logs every step of a request (sent, viewed, consented, signed, countersigned, completed) with the time, IP address and browser.
- Each evidence event is tied to a SHA-256 hash of the document, which is frozen when the request is sent.
- The final PDF is sealed with a digital seal so later changes can be detected, and includes a certificate of completion page.
- The sealed PDF is filed on the person’s record in the CRM, next to their other files and history.
- The customer receives a link to download the completed document.
- Separately, field changes across your CRM records are kept in an append-only history that shows who or what made each change.