What Exactly Is an Audit Trail for Electronic Signatures?

A California employer once held a signed arbitration agreement and still lost, because nobody could explain how the employee's e-signature got onto it (Ruiz v. Moss Bros.).

An e-signature audit trail is the record that does that explaining: who was sent the document, when they opened and signed it, from which IP address and browser, and a hash that shows the file has not changed since.

This page walks through a real two-page certificate line by line, what the ESIGN Act and UETA actually say, and five court cases where the record decided the outcome. Legal facts were verified October 2026 against the primary sources linked in each section.

What does an e-signature audit trail record?

An e-signature audit trail records who the signer was, what happened and when, where it happened from, what the signer entered, and whether the file has changed since. Most vendors print it as a PDF next to the signed document.

The table uses the fields on SignWith's Certificate of Completion, with the placeholder values from the example in our help center article on the certificate. No real person's email or IP address appears on this page.

Page 2 holds the event history and the two document fingerprints. Each event has a time, a party label such as "Client" and an IP address; the "Email sent" line has no IP because the server sends that email, not the signer.

What changes when the signer verifies their email

When the sender switches on email verification for a send, each participant gets the line "Email OTP verification: Verified", and the event history gains two events: "Verification email sent" and "Email verified with one-time code". The table below is the event history from a two-party test signing on 27 September 2026, with the IP addresses replaced by documentation placeholders.

In the certificate from the signing without email verification (Figure 2), "Email link clicked" sits where the two verification events are here.

There is no separate consent line in the history. The signer agrees by clicking the AGREE AND SIGN DOCUMENT button at the end of the document, and that click is what the history records as "Submission completed".

Does US law require an audit trail for electronic signatures?

No. Neither the ESIGN Act nor UETA uses the words "audit trail" (both texts searched, verified October 2026). The law says a signature cannot be refused just for being electronic, and that you may show who signed "in any manner". An audit trail is the usual way to show it.

What the texts actually say:

• ESIGN Act, 15 U.S.C. 7001(a)(1): a signature, contract or other record "may not be denied legal effect, validity, or enforceability solely because it is in electronic form" (Cornell LII).
• What counts as an e-signature, 7006(5): "an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record" (govinfo).
• UETA section 9(a): a signature "is attributable to a person if it was the act of the person. The act of the person may be shown in any manner, including a showing of the efficacy of any security procedure applied" (UETA official text). States adopt it under their own section numbers.
• Keeping the record, ESIGN 7001(d) and (e): a retained record must accurately reflect the contract and remain accessible "in a form that is capable of being accurately reproduced for later reference". Where a law requires a contract in writing, legal effect may be denied if the record cannot be retained and reproduced by all parties.
• Consumer consent, 7001(c): only when a law requires information to be given to a consumer in writing does ESIGN require the consumer's consent to receive it electronically. That is why some vendors log a separate consent event.

Several vendor pages say ESIGN and UETA "require" an audit trail. They do not. An audit trail is also not the same thing as a certificate-based digital signature; our guide to digital vs electronic signatures explains the difference.

How do courts use an audit trail?

Courts treat the audit trail as evidence that a specific person signed, but only after someone explains how the record was made. When a signer denies signing, the side relying on the contract carries the burden of proof, which our answer on whether electronic signatures hold up in court explains step by step.

Under Federal Rule of Evidence 901, you "must produce evidence sufficient to support a finding that the item is what the proponent claims it is", for example "evidence describing a process or system and showing that it produces an accurate result" (verified October 2026).

Case texts from the linked opinions, verified October 2026. Aerotek involved an in-house hiring system, not an e-signature vendor, but the point is the same: a time-stamped record tied to a unique login.

How do DocuSign, Dropbox Sign and Adobe audit trails compare?

DocuSign and Dropbox Sign both record events with timestamps, IP addresses and a way to check the document, but they name and package the record differently. The table shows only what each vendor's own pages say (verified October 2026).

Whatever the tool, open one completed certificate before you rely on it and check four lines: the signer's email, the event times, the IP addresses and the document fingerprint.

What can an audit trail not prove?

An audit trail ties a signature to an email inbox, a device and a network address. It does not prove who was sitting at the keyboard. Its limits:

• Inbox access is not identity. A one-time code proves someone could read that inbox. In IO Moonwalkers the record showed "someone with access to the Moonwalkers email account", which was enough there, but a shared inbox weakens it.
• An IP address is approximate. It shows the network used, which can be an office, a VPN or a mobile carrier, not a street address.
• In-person signing relies on the sender. When a signer signs on the sender's device, the certificate identifies them by the email the sender typed.
• Some documents have no trail. Dropbox Sign's self-signed "Just Me" documents carry none.
• A record nobody explains can fail. Ruiz and Fabian lost with signed documents in hand.

What keeps an audit trail useful in a dispute, in four steps:

1. Download the signed document and the certificate when signing finishes.
2. Store both with the contract, in the same folder.
3. Note how signing worked: email verification on or off, remote or in person.
4. Be ready to describe the process, which is the kind of evidence FRE 901(b)(9) describes.

Regulated fields add their own record-keeping rules on top; our e-signature guide for financial services covers the ones that apply there.

What does SignWith's audit trail record?

On SignWith the certificate opens from the AUDIT LOG button on a completed document as a two-page PDF, and every party, including the sender, gets the signed document and the certificate by email when signing finishes. The help center walkthrough shows where to find it.

Email verification is a switch the sender turns on for each send, and the code check then shows on the certificate as described above. See how email verification works. Signed documents stay in your account; keep your own copy of both PDFs with the contract anyway.

This 51-second video from our channel walks through the certificate and where to find it.

SignWith Certificate of Completion and Audit Trail Explained

SignWith fits people and small teams who want a simple way to get a document signed, with no subscription and no hidden fees: you buy credits, and a credit is used only when a document is signed. Pick an alternative when:

• Your buyer runs a vendor security review or needs identity checks beyond an email code. An enterprise vendor such as DocuSign sells ID verification; confirm what it covers with their sales team.
• You need templates, bulk send or team accounts today. Those are coming soon on SignWith, not live.

E-signature rules vary by country, state and document type, so check with a legal professional that an e-signature suits your specific agreement before you rely on it.