An e-signature works by recording that a specific person agreed to a specific document at a specific time. A trustworthy record shows four things: the signer's intent to sign, evidence of who they are, an audit trail of each step, and proof the document has not changed since. The drawn signature image is the least important part.
We built the AZLG Case Hub for a personal injury practice. A new client fills out a case review on the firm's website and lands in the hub. From there the firm generates documents, sends them for signature, and gives the client a portal to follow along. Signing is one step in that chain.
People tend to think an e-signature is a picture of a scribble on a PDF. It is not. The scribble is decoration. What matters is the record around it, and that is what this post explains. This is general information about how the technology works, so check the rules for your own documents with your attorney.
What is an e-signature?
An e-signature is an electronic record that a person agreed to a document. It can be a typed name, a drawn mark, or a clicked button. What makes it meaningful is the evidence attached to it: who acted, on what document, when, and that nothing was altered afterward.
In the United States, the federal ESIGN Act and the Uniform Electronic Transactions Act adopted by most states give electronic signatures legal standing for most transactions. Some document types are treated differently and other countries have their own frameworks, which is one more reason to confirm the rules for your case.
A related term, digital signature, refers to a specific cryptographic technique. Many e-signature systems use digital signatures under the surface to seal the finished file. The two terms are not interchangeable, but in practice they work together.
What makes an e-signature record trustworthy?
An e-signature record is trustworthy when it can show four things: intent, identity, an audit trail, and tamper evidence. Together they answer the questions someone would ask in a dispute: did this person mean to sign, was it really them, what exactly happened, and is this the same document.
| Element | Question it answers | How software captures it |
|---|---|---|
| Intent | Did they mean to sign? | A clear action, such as clicking a button labelled "Sign", after seeing the document and agreeing to sign electronically |
| Identity | Was it really them? | A unique link sent to their email or phone, a login, a one-time code, or stronger checks for higher stakes |
| Audit trail | What happened, and when? | A timestamped log of each event: sent, opened, viewed, signed |
| Tamper evidence | Is this the same document? | A cryptographic fingerprint of the file, stored at signing |
Each one can be weak or strong. A link sent to an email address is modest evidence of identity. A link plus a code sent to a phone is better. Match the strength to what is at stake. A permission slip and a settlement agreement do not need the same ceremony.
How does an e-signature flow work, step by step?
An e-signature flow prepares a document, sends a unique signing link to each signer, records what they do, seals the completed file, and distributes copies. Every step writes to the audit trail, so the final record tells the whole story without anyone's memory.
- Prepare. The document is generated or uploaded and the signature fields are placed. We describe generation in how document generation software works.
- Send. Each signer receives a unique link that cannot be guessed.
- Verify. The signer proves who they are, at whatever level the document calls for.
- Consent and review. The signer agrees to do business electronically and sees the whole document.
- Sign. The signer takes a deliberate action. The time and the available technical details are recorded.
- Seal. The finished file is fingerprinted so any later change is detectable.
- Distribute. Every party gets a copy, and the record is stored where it can be found again.
Step 2 often uses the same mechanism as passwordless sign-in, which we cover in passwordless login with magic links.
How does tamper evidence work?
Tamper evidence works by computing a hash, a short fingerprint, of the signed file. Change one character in the document and the fingerprint changes completely. By storing the fingerprint at signing time, anyone can later prove whether a copy matches what was signed.
In Node, the fingerprint is a few lines:
import { createHash } from 'node:crypto';
import { readFileSync } from 'node:fs';
const file = readFileSync('signed-agreement.pdf');
const fingerprint = createHash('sha256').update(file).digest('hex');The hash goes into the audit record along with the time. Stronger systems go a step further and apply a digital signature to the PDF itself, so the file carries its own proof and a PDF reader can warn if it has been modified.
Should you use an e-signature service or build your own?
Use an established e-signature service through its API when your documents are high stakes, cross jurisdictions, or need advanced identity checks. Build signing into your own software when the flow is simple, the volume is high, and you want the experience and the records to stay inside your product.
| E-signature service | Built into your software | |
|---|---|---|
| Time to add | Short | Longer |
| Cost pattern | Usually per document or per user | Development up front, little after |
| Compliance work | Largely handled by the provider | Yours to get right |
| Signer experience | The provider's screens | Fully your own |
| Records | Held by the provider, exportable | Held in your own database |
| Best for | High stakes, varied document types | Simple, frequent, uniform agreements |
Most businesses should start with a service. It connects like any other integration, as explained in what is an API integration. Whichever route you take, keep your own copy of every signed file and its audit record. Do not let the only copy live in an account you might close.
What mistakes should you avoid when adding e-signatures?
The common mistakes are treating the signature image as the record, skipping the consent step, storing signed files where they can be overwritten, and making signing hard on a phone. Each one weakens either the evidence or the completion rate.
- Collect the trail, not only the mark. A signature image with no log proves very little.
- Lock the document before sending. If the text can change after the link goes out, the record is compromised.
- Design for a phone. Many people will sign on one. Small tap targets and sideways scrolling lose signers.
- Send reminders. An unsigned document is usually forgotten, not refused.
- Store signed files as read-only.
Frequently asked questions
Is a typed name a valid e-signature?
A typed name can serve as an e-signature when the surrounding record shows the person intended to sign and who they were. The form of the mark matters less than the evidence around it. Confirm the requirements for your specific document type with your attorney.
What is the difference between an electronic signature and a digital signature?
An electronic signature is any electronic indication of agreement. A digital signature is a cryptographic method that binds a signer's key to a document so that changes are detectable. Many e-signature products use digital signatures to seal the final file.
Can someone sign from a phone?
Yes, and many signers will. The signing page should work in a mobile browser without an app or an account, and the document should be readable without zooming.
How long should signed documents be kept?
That depends on the document and your industry's retention rules. Ask your attorney or regulator.
If your process still involves printing, signing, and scanning, tell us where the document comes from and who signs it. We will tell you whether signing can live in the system that produced it.