Audit trail and certificate: proof no one can change

Every document you send through Suresign produces a detailed, unchangeable record of its entire journey. This record is called an audit trail. It is combined with a certificate of completion to create evidence anyone can check. Together they prove who signed, when, and that nothing was altered after the fact. Think of the audit trail like a bound ledger. Once something is written in it, you cannot rip a page out or rewrite a line without every page after it looking wrong.

​

What the audit trail records

For every document, Suresign records every event in a table that cannot be edited:

​

How the hash chain works, in plain words

A hash is a mathematical fingerprint of a piece of data. Change even one comma in a document and the fingerprint becomes completely different. In Suresign, each event in the audit trail is hashed together with the hash of the previous event. This creates a chain where every link depends on the one before it. If anyone tried to remove an event, insert a fake one, or change a timestamp, every hash after that point would break. The chain is recomputed and checked every time a document is viewed or a certificate is created, so tampering shows up immediately rather than staying hidden.

​

The certificate of completion

When the last person signs, Suresign creates a certificate that includes:

• The document title and unique identifier
• Every party with their name, email address, role, and signing order
• The Signature ID for each signer
• The SHA-256 fingerprint of both the original and the completed file
• The complete audit trail with timestamps, network addresses, and browser details
• When each signer adopted their signature, if they did it in Settings under Signatures
• Any file attachments uploaded by signers
• A count of total fields and completed fields

Anyone holding the signed file can check it at suresign.si/verify. The result shows whether the file is unchanged.

​

The sealed, flattened PDF

The completed PDF is flattened, which means filled form fields become part of the page image and cannot be edited back into blank fields. Each page is also stamped with the document identifier and the address suresign.si/verify. This creates a single file that matches the fingerprint on the certificate.

​

What this proves

Together, the audit trail and certificate prove three things:

1. The file you hold is exactly the file that was sealed when signing finished.
2. You can see who was asked to sign, and when each person did.
3. The history behind it is unbroken and unedited.

​

The public log, in one minute

You never need to use this. It is a safeguard that works in the background. What it is: a public list at suresign.si/ledger that holds a fingerprint of every finished document. No names, emails, or document content are in it. Why we built it: so that not even Suresign can quietly change or delete a signed record later. Because the list is public and only ever grows, any change would be visible to everyone.

​

Next steps