Secure electronic signature: how to tell whether yours will hold up

A secure electronic signature is one you can defend a year from now, in front of someone with a reason to doubt it. The padlock in your browser doesn't tell you that. Neither does a vendor's homepage.

When a signature is challenged, the questions are nearly always these four:

• Who signed? Not which email address clicked, but which person.
• What did they sign? The exact version, down to the last byte.
• When did each step happen, and in what order?
• Has anything changed since?

Security people call the result non-repudiation: the signer can't credibly deny the act, because the evidence ties a person to a specific file at a specific moment.

Here's the uncomfortable part. Most signing tools get the cryptography right. They differ on how hard they check the signer, what they log and whether the evidence survives without them. Signing a document in Chaindoc takes minutes; this page is about whether you'd trust the result in a dispute.

Yes, in the narrow sense. Nobody fakes a properly made digital signature by breaking the maths behind it. The attacks that work go around it: someone gets into the signer's inbox, a fake signing request harvests a password, or a supplier in the chain gets breached.

None of the figures above is about signatures as such. They describe the channel signing runs through: email, invoices, outside vendors. So the useful question about a secure electronic signature isn't how strong the encryption is. It's how the signer gets checked, and what happens when a request looks real but isn't.

What a secure electronic signature can't fix

It can't stop someone who's talked into signing a document they didn't read, and it won't notice a bank account swapped in a follow-up email. Those are process problems. A call to a number you already had does more against them than any signing feature.

Plenty of signing requests still work like this: a link arrives by email, the recipient clicks it, types a name, done. That proves somebody could read that inbox at that moment. For a holiday request, fine. For a contract someone might later disown, it's thin.

NIST is blunt about it. Its 2025 guidelines, SP 800-63B-4, say email shall not be used for out-of-band authentication, treat SMS and voice codes as restricted, and require services at the middle assurance level to offer a phishing-resistant option. Those rules govern US federal systems, not your sales contracts. They're still the most careful public ranking of the methods signing tools offer.

Underneath a secure digital signature, the software runs the document through a hash function, which gives a short fingerprint unique to that exact file. Change one comma and the fingerprint changes completely. That fingerprint is signed with a private key whose certificate comes from a public key infrastructure (PKI), and the result is embedded in the PDF. Any PDF reader can recompute it later. Match: it's the signed document. No match: the reader flags it.

You can test a provider in five minutes:

1. 1.
   Open a file it has signed in Adobe Acrobat Reader or another PDF reader and look at the signature panel. You should see who sealed it and whether it changed since.
2. 2.
   Edit one character in a copy, save it and reopen it. A properly sealed file now flags the signature as invalid or the document as altered.

If the panel is empty, you're holding a picture of a signature plus a log on the vendor's server. That can still be legally valid, but all of the proof lives with the vendor.

The signature proves the file didn't change. The audit trail proves everything around it, and when a secure electronic signature is disputed, it's usually the trail that gets read aloud. A complete one records at least:

• Each signer's identity and how it was verified: email only, a code, an ID check.
• A timestamp for every step, from sending through viewing to signing, with the time source stated.
• IP address and device details for each action.
• The document's fingerprint for each version, so the record ties to the file you hold.
• What the signer agreed to, including consent to sign electronically.
• Who sent the request, plus reminders, declines and voided versions.

Then ask two things. Can you export the trail as a file you keep? Could the vendor change it later without leaving a mark? A trail kept only in an editable database is evidence you take on trust. Our guide to what a complete audit trail contains walks through each field.

Non-repudiation stops a signer from credibly denying they signed. In security textbooks it comes from the cryptography: only the holder of a private key could have produced this signature. In a courtroom it's messier. The key proves a device or account was used; the argument then moves to whether the person behind it is who they claim. That's why signature law sets a low bar for validity and leaves the rest to evidence.

United States

The ESIGN Act, at 15 U.S.C. § 7001, says a signature or contract can't be denied legal effect solely because it's electronic. It names no technology, and its retention rule asks that the record reflect the contract accurately and stay accessible in a reproducible form. State-level UETA works the same way; New York, which never adopted it, has its own Electronic Signatures and Records Act. None of them tells you how to prove who signed. That falls to your evidence.

European Union

eIDAS Article 25 says an electronic signature can't be refused as evidence just because it's electronic or not qualified, and gives a qualified signature the effect of a handwritten one. Article 26 defines the advanced level in between: uniquely linked to the signer, able to identify them, made with data under their sole control, and linked to the document so any later change is detectable. Most EU business contracts are signed at the simple or advanced level, and that's legally fine. The difference shows when someone objects. In Germany, France and Spain, national law presumes a qualified signature genuine until shown otherwise; at the other levels, you're the one who shows it's right.

United Kingdom

Section 7 of the Electronic Communications Act 2000 makes an electronic signature admissible as evidence of a document's authenticity and integrity. Admissible isn't the same as convincing.

So non-repudiation isn't a feature you buy. It's the sum of how the signer was checked, how the file was sealed and what was logged, and it's as strong as the weakest of the three.

Every vendor selling a secure electronic signature shows a row of badges on its security page. Treat them as claims to check; it takes about ten minutes a vendor.

ISO 27001

ISO 27001 certifies an information security management system, audited by an accredited body on a cycle. Look the certificate up in IAF CertSearch, the database of accredited certificates. Check that it's current, who issued it and its scope, since it can cover one office rather than the service you're buying.

SOC 2 Type 2

SOC 2 is an auditor's attestation report, common among US vendors and often required by US buyers. Type 2 covers how controls operated over months; Type 1 describes them on one date. Expect to sign an NDA to see it, then read the period, the systems in scope and the exceptions, where the real findings sit.

Qualified trust services

For qualified signatures in the EU, the provider or its certificate partner must be on the EU Trusted List. Our explainer on how the EU Trusted List works shows where to look.

One more question most electronic signature providers skip on their websites: where is the data stored, and which subprocessors touch it? In the EU, the data processing agreement should name them.

On certifications, DocuSign is ahead of Chaindoc. Its compliance page lists enterprise-wide ISO 27001:2022 certification, SOC 1 Type 2 and SOC 2 Type 2 reports, and PCI-DSS (read on 14 October 2026). If procurement insists on SOC 2, that's a genuine reason to shortlist it.

The risk people actually meet is an email pretending to be DocuSign, because a familiar request rarely gets a second look. DocuSign's safety page says real requests come from official domains such as docusign.net, never arrive as file attachments, and carry a security code for opening the document on its website instead of the link. For the legal side, see DocuSign's standing in court.

Vendors get acquired, change plans and close accounts. Contracts often outlast all three. So ask: if this company vanished tomorrow, what could I still prove?

A good answer has two parts. The signed PDF carries its own signature, which any PDF reader can check. And the audit trail is a file you've downloaded, rather than a page in someone else's dashboard.

Some providers give a secure electronic signature an independent anchor as well. Chaindoc writes the fingerprint of a document version to a public blockchain when you publish it for signing, then records each signer's proof there on completion. Anyone with the transaction link can look it up on a public block explorer, whether or not Chaindoc's servers are running. Our PDF signature verification service reads the signatures embedded in a signed file.

One limit worth knowing: certificates expire, and old signatures validate best when the file also carries a trusted timestamp and validation data, which the PAdES levels above the baseline add. Chaindoc's signatures are PAdES-BES, the baseline without a timestamp, so for decade-long retention keep the audit trail and verification report with the file. Ask any provider which PAdES level it produces.

Put your shortlisted electronic signature providers through the same seven questions. Most lists of the best eSignature software rank tools on price and integrations; these rank them on what you could prove later. For the cost side, see our guide to comparing e-signature software on price and features.

Here's where we stand against that checklist, gaps included.

Chaindoc holds ISO 27001 and ISO 9001 certificates, both listed in IAF CertSearch. We don't have a SOC 2 report; if your buyer requires one, that's a real gap, and better you hear it from us.

Signatures are advanced electronic signatures in PAdES-BES format, embedded in the PDF. Files travel over TLS, and users' private signing keys are encrypted with AES-256. It isn't end-to-end encrypted: the server reads each file to scan it for malware and apply the signature. The server fingerprints a file on upload; that fingerprint goes on chain when you publish, and each signer's proof follows on completion. The audit trail and a verification report download as PDFs.

On paid plans, the optional identity check adds a government ID and live selfie inside the signing flow, switched on per document. For qualified signatures you bring a certificate from a qualified trust service provider; Chaindoc runs the signing flow but isn't one itself. A fixed signing order runs through approval routes on the Business plan (see plans and pricing).

If that fits how you sign, creating a secure electronic signature takes a few minutes. If you need a SOC 2 report or long-term validation built into the file today, another provider will serve you better.