Skip to content
nodshake
Menu
Request access

What an e-signature audit trail should contain

By the nodshake team. Published 14 October 2026, updated 14 October 2026.

US law defines an electronic signature by intent to sign and, where a law requires a record to be kept, accepts an electronic one that accurately reflects the information and stays accessible. EU law asks that an advanced signature is uniquely linked to the signer and that later changes are detectable. Vendors record signers, timestamps, IP addresses and often a file hash. This is information, not legal advice.

Key points

  • A useful audit trail answers who signed, when, from where, what they saw and whether it changed afterwards.
  • EU advanced signatures must make any later change to the data detectable (eIDAS Art. 26).
  • Vendors record similar fields but differ on retention: BoldSign offers auto-delete after 14 to 1,827 days; retention for Dropbox Sign and Documenso is not established.
  • We did not find an exact page for DocuSign's certificate fields or retention, so DocuSign is not in the vendor table.

What the law says

Quoted from the primary texts, read 14 October 2026.[1][2][3][4][5] They state outcomes, not a certificate layout. This is information, not legal advice.

Law and the evidence it points to
LawWhat it saysWhat a record should show
US ESIGN, 15 U.S.C. 7006(5)An electronic signature is an electronic sound, symbol or process executed or adopted by a person with the intent to signThat the signer chose to sign
US ESIGN, 7001(d)(1)Where a law requires a record to be kept, an electronic record meets it if it accurately reflects the information and stays accessibleAn unaltered copy you can still open
US UETA (Minnesota text), s.9Attribution may be shown in any manner, including the efficacy of any security procedureHow the signer was identified
US UETA (Minnesota text), s.10In an automated transaction, an individual may avoid an error if the system gave no chance to prevent or correct it, subject to further conditionsA step to review before signing
EU eIDAS 910/2014, Art. 26An advanced signature is uniquely linked to the signatory, can identify them, is under their sole control, and any later change to the data is detectableIdentity, control and tamper evidence

What vendors record

From each vendor's own documentation, read 14 October 2026.[6][7][8][9][10]

Audit trail contents by vendor
VendorWhat it recordsRetention
Dropbox SignUnique document ID; sender and recipient emails and IPs; date, time and location for upload, view, send, sign, decline and cancel; a PDF hashNot established
BoldSignDocument ID, status, page count, sent and completed time; name, email, IP, device; identity verification; signature typeOffers auto-delete after 14 to 1,827 days
DocumensoCreation, recipient added, sent, viewed (with IP), field completed, completed; a final document hashNot established

What to check in yours

  • Does it show every event with a time: sent, viewed, signed, declined?
  • Does it record where each signer came from (IP) and how they were identified?
  • Is there a hash or other check that the final file has not changed?
  • How long is it kept, and can you export it before it is deleted?

For the rules by country, see are electronic signatures legally valid and the law checker. For a company buying a service, see the provider checklist. nodshake answers security questions in writing on Business / API: nodshake for business.

Questions

Is an audit trail required by law?
The passages we read from ESIGN, UETA and eIDAS state outcomes such as intent, attribution, accurate retention and detectable change, not a certificate format. A record that shows who, when and what is how vendors support them.
What does the Dropbox Sign audit trail show?
A unique document ID, sender and recipient emails and IPs, the date, time and location of each upload, view, send, sign, decline and cancel, and a PDF hash.
Can BoldSign delete the record automatically?
It offers auto-delete after a period you set, from 14 to 1,827 days.

Sources

  1. [1] 15 U.S.C. 7001 (ESIGN), read 14 October 2026.
  2. [2] 15 U.S.C. 7006 (ESIGN definitions), read 14 October 2026.
  3. [3] UETA, Minnesota Statutes chapter 325L, read 14 October 2026.
  4. [4] Regulation (EU) 910/2014 (eIDAS), read 14 October 2026.
  5. [5] Regulation (EU) 2024/1183 (amends eIDAS), read 14 October 2026.
  6. [6] Dropbox Sign audit trail overview, read 14 October 2026.
  7. [7] Dropbox Sign service-specific terms, read 14 October 2026.
  8. [8] BoldSign audit trail help article, read 14 October 2026.
  9. [9] BoldSign auto-delete help article, read 14 October 2026.
  10. [10] Documenso: electronic signature compliance, read 14 October 2026.

How we source and check our data.

Keep going

All guides