What is an electronic signature, and when does it hold up

An electronic signature is any data in electronic form that a signer attaches to a record to show they agree to it. Typed name, clicked checkbox, drawn squiggle, cryptographic certificate. All of them count.

That breadth surprises people. The law was written to be technology-neutral on purpose.

In the United States the rule sits in the ESIGN Act, at 15 U.S.C. §7001(a). It says a signature, contract or other record relating to a transaction "may not be denied legal effect, validity, or enforceability solely because it is in electronic form", and that a contract may not be denied legal effect "solely because an electronic signature or electronic record was used in its formation".

Read it twice. It does not say electronic signatures are always valid. It says being electronic is not, by itself, a reason to throw one out.

That is a narrower promise than most vendor pages imply, and the distinction matters the moment somebody disputes a document.

Alongside ESIGN sits the Uniform Electronic Transactions Act, adopted by almost every state. ESIGN gives federal validity in interstate and foreign commerce; UETA governs transactions inside a state. Between them they cover essentially all US commercial activity.

In the European Union the equivalent is Regulation 910/2014, better known as eIDAS. Its Article 3(10) defines an electronic signature as data in electronic form which is attached to or logically associated with other electronic data and which the signatory uses to sign.

What that means in practice

Everything else follows from those two sentences. The question is never really "is my electronic signature legal". It is "can I prove what happened, to the standard this particular document needs".

Those are different questions. Most disputes turn on the second one.

It also helps to be clear about what an electronic signature is not. It is not a scanned picture of your handwriting, although pasting one into a PDF may technically qualify as a simple signature. It is not a password. It is not the same thing as an electronic record, which is the document rather than the act of agreeing to it.

And it is not automatically a digital signature, which is a specific cryptographic technique covered further down.

eIDAS sorts electronic signatures into three tiers, and the tiers carry different legal weight. US law has no formal tiering, but the same technical distinctions show up in evidence anyway.

Simple electronic signature. A name typed into a box. A checkbox. A signature drawn with a mouse. Perfectly valid for the vast majority of commercial agreements.

Advanced electronic signature. Article 26 of eIDAS sets four conditions. It must be uniquely linked to the signatory. It must be capable of identifying them. It must be created using means the signatory can keep under their sole control. And it must be linked to the signed data in a way that makes any later change detectable.

Qualified electronic signature. An advanced signature made with a qualified signature creation device and based on a qualified certificate, per Article 3(12). Article 25(2) gives it the payoff: the legal effect of a qualified electronic signature is equivalent to that of a handwritten signature.

That is the only tier the regulation puts on a par with ink. Everything below it is valid but has to be proven. The qualified electronic signature guide goes through how to get one and when it is worth the cost.

How to pick a tier without overthinking it

Start from the document, not from the technology. Three questions settle it almost every time.

Does a statute prescribe a form for this document? If yes, the statute decides and you have no discretion. Does the counterparty impose a requirement of its own? Banks, insurers and public bodies routinely do, and they are entitled to. Is the amount at stake large enough that somebody might genuinely litigate it?

If all three answers are no, a simple signature with a solid audit trail is the proportionate choice. Reaching for a qualified signature on a routine NDA costs money and friction and buys nothing.

One cross-border caveat. A tier is meaningful inside the legal system that defines it. A qualified signature carries its Article 25(2) effect across all EU member states, but outside the EU it is treated as evidence like anything else, weighed on its merits. Plan for the law that will actually govern the contract.

Legislation sets the rule. Your evidence decides the case. Four things have to be provable when someone disputes a signed document.

Integrity is where most tools quietly fail. A scanned image of a handwriting pasted into a PDF proves nothing about whether page four was swapped afterwards.

A cryptographic hash does. Change one byte and the hash no longer matches. That is not a policy promise from a vendor. It is arithmetic, and anyone can rerun it.

The audit trail is the actual product

An audit trail is a timestamped record of every action taken on the document: who opened it, who signed it, when, from which IP address, against which verified email identity.

Without one, a service cannot prove intent, attribution or integrity when it matters. With one, the argument is usually over before it starts. You can inspect what a signed file actually carries with the PDF signature checker.

Two details separate a useful trail from a decorative one. It has to be exportable, because a record you can only view inside somebody's web app is awkward to put in front of a court. And it has to be tamper-evident, meaning a change to the trail itself is detectable rather than merely discouraged by access controls.

Retention is the part everyone forgets

A signature that verified perfectly in year one is worthless in year six if nobody kept the file. Retention periods vary by document type and jurisdiction, and they routinely outrun the life of the software that produced the record.

Store the original signed file rather than a re-exported copy. Store the audit trail with it. And check that you can still open both without a live subscription to the service that made them.

These two phrases get swapped constantly and they are not synonyms.

An electronic signature is a legal concept. It represents a person's intention to be bound.

A digital signature is a specific cryptographic technique. It uses public key infrastructure and a certificate authority to bind a key pair to an identity, then produces a hash of the document at the moment of signing.

So a digital signature is one way to implement an electronic signature. It is not the only way, and the law does not require it for most agreements.

What the cryptographic route buys you is non-repudiation: the signer cannot credibly claim afterwards that it was not them, because the proof travels inside the file rather than inside a vendor's database.

Electronic signatures cover almost everything. The exclusions are narrow, specific and jurisdictional, which is exactly why people get caught out.

Common exclusions include wills and testamentary instruments, certain real property conveyances, some family law documents, particular court filings and a handful of official government records. The exact list depends on where you are.

Germany is a useful example of how sharp these edges can be. Section 126a of the German Civil Code allows the statutory written form to be replaced electronically, but only if the issuer adds their name and signs the electronic document with a qualified electronic signature. Nothing less will do.

And Section 623 of the same code, on the termination of employment relationships, states flatly that the electronic form is excluded. No signature tier saves you there. Paper or nothing.

Check the document type against the local rule before you send it. This takes five minutes and saves entire deals.

A rejected signature is rarely a broken signature. Usually it is a mismatch, and the fix depends on which kind.

Wrong tier. The recipient needs a qualified signature and you sent a simple one. No amount of resending helps. You need a certificate from a qualified trust service provider.

No agreement on method. Between private parties nobody is obliged to accept your signing system unless it was agreed. A bank can insist on a specific certificate and is within its rights.

Broken integrity. The file changed after signing. Even flattening a PDF or re-saving it in the wrong tool can do this. The fix is to reissue and re-sign, not to argue.

Expired certificate. Certificates carry an end date. Once past it, the signature may still be historically valid but new signings will fail.

A worked example

A supplier sends a signed framework agreement. Legal opens it, adds a comment, saves, and forwards it to finance. Finance runs a validation check and gets a failure.

Nobody acted in bad faith. The comment rewrote the file, the hash no longer matched the one captured at signing, and the validator did exactly what it should. The document was fine; the copy was not.

The fix is procedural rather than technical. Keep the signed original untouched in one place, and circulate copies for reading. If you genuinely need to annotate, annotate a duplicate and say so.

The practical defence against the rest is equally boring and equally effective. Write into the contract which signature method the parties accept, before anyone signs. Our contract templates already include that clause.

Once compliance is settled, the platform choice comes down to what happens around the signature.

Look for end-to-end encryption in transit and at rest. Look for a tamper-evident audit trail you can export. Look for non-repudiation backed by an actual certificate rather than a picture. Look for SOC 2, ISO 27001 and GDPR handling if you operate in regulated markets.

Then look at the workflow, because that is where the time goes: signing order for multi-party agreements, bulk send, a template library, and an API that talks to whatever system already holds your customer records.

Three questions vendors dislike

Ask what happens to your evidence if you stop paying. If the audit trail lives only inside the vendor's database, cancelling the subscription can quietly cost you the proof.

Ask whether a third party can verify a signed document without an account. Independent verification is the difference between evidence and a claim.

Ask what the pricing does at volume. Per-envelope pricing looks cheap on a pilot and gets expensive precisely when adoption succeeds.

If all you need is a clean signature graphic to drop into a document, the signature generator does that in a minute. If you want to compare tiers and costs, the pricing page lists them. And if you need the full agreement lifecycle with an evidence trail behind it, see how signing works with Chaindoc.