What an audit trail proves, and what it doesn't

Last reviewed 26 September 2026

An audit trail proves what happened to a document and when: who it was sent to, when each link was opened, when each person agreed to sign electronically and signed, and from which IP address and browser. It doesn't prove who was holding the device, because Paraph checks that a signer controls an email address, not who they are.

What Paraph records

Every document has a trail. Each event carries the time from our server, the IP address and the browser of whoever caused it:

when the document was sent, and when each email was accepted for delivery and delivered;
when a signing link was opened, marked as automated when a mail security scanner opened it rather than a person;
when each person agreed to sign electronically, completed their fields, signed, or declined;
when the last signature landed and the signed PDF was made, and each time it was downloaded;
reminders, and any request to stop them.

How it is kept

The trail is append-only: nothing in it can be edited or deleted, by you or by us. The one exception is an erasure request: a single audited function can remove a person's details, and it records that it did so, so the trail never pretends to be complete when it isn't.

When the document is finished, the parts that matter go on the completion certificate: each signatory with the time they agreed and signed, their IP address and browser, the full history, and fingerprints of the original and the signed file.

What it does prove

That the document was sent to particular email addresses, and when.
That somebody with access to each address opened the link, agreed to sign electronically, and signed, at the recorded times, from the recorded IP addresses and browsers.
That the signed file you hold is the one that was produced, if its fingerprint matches the certificate. How to check a signed PDF hasn't been changed shows how.

What it doesn't prove

Who the person was. Paraph verifies control of an email address, not identity. If somebody else can read a signer's email, the trail can't tell them apart.
That they read it. It records that the document was opened and signed, not how carefully.
That the document was the right kind to sign electronically. A deed signed without a witness is still missing its witness. When do you need a wet signature or a witness?
A cryptographic seal. The signed PDF carries a fingerprint on the certificate, not a digital seal a PDF reader checks. The security page explains why.

The certificate says all of this in its own words, because overclaiming on the one document a court might read would make it worth less.

Forwarded links

A signing link opened from two different places shows as two opens from two IP addresses. If a signer forwards their link and somebody else signs, the trail shows the addresses it was signed from, which is why every request asks people not to forward it.

This is general information, not legal advice.