What's in the audit PDF we hand back.
When the completion certificate is produced
The moment the last required signer signs, we generate a completion certificate as a separate PDF (it accompanies the signed contract, not embedded into it). Downloadable from the dashboard, the email, or the public proof URL — for the rest of the document's life.
What's in it
The document hash (SHA-256). Each signer's: name, email, signing time, viewing IPs, the certificate serial that sealed their signature, the RFC 3161 time stamp when the authority answered, and (when an SMS code was entered) the masked phone number. Every event between send and completion in chronological order: invited, viewed, started, completed. Names, email addresses and phone numbers are the ones the sender entered or the signer typed: the certificate records what happened through each signer's link, not who the person was.
How it ties to the contract
The contract carries one PAdES-B seal, applied at the last signature and valid over the whole file, so any change to it breaks the seal. The completion certificate names the SHA-256 hash of that sealed file, the serial of the certificate that sealed it and, when our time-stamp authority answered, its RFC 3161 time stamp. The certificate itself is not sealed: the proof is the sealed contract, which /verify and any PDF reader can check.
Public verification — /verify
Drop the contract on /verify and we re-hash the bytes, look them up against every document we've issued, and produce the same audit trail anyone can independently confirm. No login. No upload tracking. The proof is the document itself.
Have a question this page didn’t answer? Email support@wesign.now — our DPA, security overview, and infosec answers are available on request.