VoltScape SignWho we think you are
The sender names you and emails a unique signing link to that address. The PDF stays closed until you enter the one-time code from that email (the invitation window is the Valid days set on that workflow — tap Resend if you need a fresh code). Wrong codes are logged; eight failures lock the code until you tap Resend. That is email-possession evidence, not a government ID or KYC check.
What you agree to
You open the agreement in full (Back / Next through each field). When you tap Sign, you check I reviewed this agreement in full, then electronic-signature consent (ESIGN / UETA style), then confirm. Sign will not accept a signature without both checks. Those timestamps are stored on your signer record and on the certificate page of the executed PDF. After you sign, you land on the confirmation page (download / seal). Tap View document to open the stamped PDF.
How the file is locked
When the envelope is created, Sign stores the unsigned original and its SHA-256 (documentHash). At the moment you sign, Sign re-hashes that original. If even one byte has changed, signing is refused. After the last party signs, Sign seals an executed PDF (signatures + certificate page) and stores a second hash (executedHash). The certificate also prints the original and signed-body hashes. A later swap of the file will not match those values.
Independent time
After the executed PDF is sealed, Sign sends only that SHA-256 to a third-party RFC 3161 timestamp authority (default Open TSA). The PDF itself never leaves Sign for that step. The reply token (.tsr) is stored next to the PDF so you can download it. Open TSA is free and is not an eIDAS qualified TSA; a failed timestamp does not undo the signature.
Audit trail
Each event (view, OTP, review/consent, sign, download, timestamp) is stored with UTC time, IP address, and browser user-agent. You can read that trail on the document seal after you sign. The certificate copies the most recent events onto the PDF.
Your copies
When everyone has signed, every signer and every CC can download the executed PDF and the timestamp token from their own link. The completion email repeats the hashes. Keep those files. Staff can also download them from the Sign desk.
The document seal
After you sign, a document seal link stays on this page so you can download the copy recorded so far. Until every party has signed, that seal says it is not prepared. After the envelope is fully executed, tap it for the hashes, parties, and audit events, then use Verify this copy to SHA-256 the sealed PDF in your browser. On your computer you can run openssl dgst -sha256 your.pdf and match the hex yourself.
What this is not
- Not a government identity check, in-person notarization, or qualified electronic signature (eIDAS QES).
- Not “tamper-proof” in the sense that a file cannot be edited — it is tamper-evident: an edit changes the hash, and the stored hash will no longer match.
- Not legal advice. Enforceability depends on the parties, the document, and the law that applies.