The signed PDF, Certificate of Completion and audit trail
When everyone finishes, each person gets the signed PDF and a Certificate of Completion. Both are digitally sealed and, when the time-stamping service is reachable, independently time-stamped. The signed PDF carries the signing evidence inside it, so changing one byte makes PDF readers flag the file.
Updated 2 min read
On this page (4)
What you get
- Signed PDF: the locked document with everyone's entries, flattened, digitally sealed and time-stamped.
- Certificate: the Certificate of Completion, sealed the same way.
- As sent: the original you sent, for comparison.
All three download from the request in Sent. Everyone, including people who got a copy, receives an email with the signed PDF and the certificate attached when they're small enough, plus download links that work for 7 days. Save a copy for your records, or have signed copies saved to Google Drive automatically.
How the evidence works
- Each signer's own device key. When a signer opens the request, their browser creates an ECDSA P-256 key that never leaves their device. On finishing, it signs a statement binding the document's SHA-256 fingerprint to exactly what they entered, and PDFBetter's certificate authority certifies the key.
- A locked document. The version you sent is fingerprinted, and the certificate shows the SHA-256 of the sent and completed PDFs.
- A hash-chained audit trail. Every step (sent, viewed, consented, signed, declined, reminders, codes) is written to an append-only log where each entry includes the hash of the one before, so later changes are detectable.
- A digital seal and time-stamp. The completed PDF and certificate are sealed with a PAdES signature from PDFBetter Document Seal and, when the service is reachable, time-stamped under RFC 3161 by an independent time-stamping authority.
- Evidence inside the file. The signed PDF embeds a signing-evidence file with each signer's statement, device signature, key certificate, entered values and the audit trail, so the PDF alone is enough to check what happened.
Reading the Certificate of Completion
The certificate has three parts. Integrity lists the document fingerprints, the seal and the time-stamp. Recipients lists each person's role, status, authentication method, IP address, device and Device signature key fingerprint. Event log lists every event with its time. A line at the end confirms the audit trail is intact against its hash chain.
How long it's kept
PDFBetter keeps the evidence of a completed request (the sealed PDF, the certificate and the audit trail) for 7 years after completion, even if the sender deletes the document or their account, so everyone who signed can still prove the agreement. Records of requests that were never completed are deleted with the document. See How long PDFBetter keeps your files and Security for details.
Does the certificate say no time-stamp?
If the time-stamping service couldn't be reached at completion, Independent time-stamp (RFC 3161) reads None. The seal and the audit trail are still in place.
Can someone edit the signed PDF?
Anyone can change a PDF file, but the seal shows it: PDF readers report the document as modified after signing.
Tools in this article
Did this answer your question?
Related articles
- Are PDFBetter e-signatures legally valid?Electronic signatures are generally accepted for most business documents in many countries, but some documents need more. Signature requests give every signer their own device key and a sealed, time-stamped PDF with the evidence built in. Whether that's enough depends on the law that applies to your document.
- Track, remind, cancel or resend a signature requestOpen Sent in the sidebar and select a request. Each recipient shows Emailed, Opened, Signed or Declined. Use Remind, New link / fix email or Cancel request, and download the Signed PDF and Certificate once it's Completed.
- Request signatures from other peopleOpen the document and switch to Invite to sign. Add each recipient's name, email and role, choose In order or All at once, place each person's fields, then choose Send, check the title, message, reminders and expiry, and select Send.
- How long PDFBetter keeps your filesGuest drafts are deleted 1 hour after they're created. Files uploaded only to run a tool are deleted after 24 hours. Documents in your account stay until you delete them, then they're erased 30 days later.