Articles on: Signatures

Signature audit trail

Every signed envelope is cryptographically sealed — the primary mechanism that makes a Katalyz signature legally defensible if challenged.


Tamper-evident seal


When an envelope reaches Signed, the final PDF is sealed with a cryptographic signature issued by Katalyz.


This seal:


  • Identifies Katalyz as the issuer of the document
  • Binds the document to its exact content at time of sealing — any modification invalidates the seal
  • Can be verified by anyone who opens the PDF in Adobe Acrobat or any compliant reader


If someone later tries to alter a signed PDF — even a single character — the seal becomes invalid and the PDF reader displays a warning. This is your tamper-evidence.


Verifying the seal


  1. Open the signed PDF in Adobe Acrobat (or any PDF reader with signature support).
  2. Look at the signature panel — a valid document displays:

    "Signed and all signatures are valid." ✅

  3. Inspect the certificate details. The issuer should be one of Katalyz's published public certificates (identified by serial number and SHA-256 fingerprint).


If the seal is invalid, the document has been modified after sealing and should not be relied on.


What's recorded during signing


Throughout the envelope's lifecycle, Katalyz records:


  • Envelope creation — who, when
  • Documents attached — file metadata and integrity hash
  • Envelope sent — timestamp, recipient list, signing order
  • Recipient notifications — when signing invitations were delivered
  • Envelope viewed — timestamp per recipient
  • Authentication events — method used (Email link, SMS code, Access code, ID verification) and outcome
  • Fields completed — each signature, initial, date or text field, with timestamp and recipient
  • Envelope signed — timestamp when the last signer finished
  • Final sealed PDF generated — timestamp and document hash
  • Declines, expiry and voids (if applicable) — who, when, and the decline reason where given


These events are retained and associated with the envelope for its full retention lifetime.


Accessing the record


Open any envelope in Katalyz (from the room or the Signatures page). The envelope view lists every recipient with their status and the date they signed.


For legal / dispute purposes, the sealed PDF itself is the primary evidence — the cryptographic seal confirms the document's integrity and the identity of the issuer. The in-app view is a convenience layer on top.


Retention


  • Signed envelopes and their sealed PDFs are retained for the lifetime of your Katalyz workspace — no auto-deletion
  • Voided, declined and expired envelopes are retained similarly
  • Draft envelopes follow your workspace's general data retention policy


If you cancel your subscription, we retain signed documents for a legally appropriate period before deletion. Contact contact@katalyz.co if you need specific retention guarantees for compliance purposes.


Using the record in a dispute


If a signature is ever challenged:


  1. Download the sealed PDF from the envelope.
  2. Verify the cryptographic seal is intact (a valid seal is itself evidence of integrity).
  3. Reference the unique envelope ID.
  4. Share the PDF and envelope ID with your legal counsel.


In most jurisdictions, the cryptographic seal plus the envelope ID are sufficient evidence of execution for commercial contracts.


Privacy


Technical signing metadata (IP addresses, browser fingerprint, authentication events) is collected to establish identity in a legal context. Signers are informed of this via the consent notice shown before they sign.


Updated on: 01/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!