A signature is a moment; the audit trail is the story
Most people picture an electronic signature as the end product: a PDF with a name on it. But when a signed agreement is questioned — by a counterparty, an auditor, or a court — the argument is rarely about the picture of the signature. It is about everything around it: who received the document, when they opened it, what they did next, from where, and whether the file changed afterwards. The audit trail answers those questions: an append-only, timestamped log of every meaningful event in the life of a signing request, kept alongside the document itself.
We covered the Certificate of Completion — the one-page summary of this evidence — in its own guide. The audit trail is the raw material behind it: where the certificate says a document was signed on a given day, the trail is the sequence of timestamped events that lets it say so. The two answer different questions, and in a dispute you will want both.
The events tuyaform records
tuyaform writes an audit event at each meaningful transition of a signing request. Sent: the request went out to a recipient. Viewed: a signer actually opened the document — logged the first time it happens, so refreshing the page does not flood the record. Signed: the signer completed a deliberate signing action. Declined: the signer refused, with their stated reason stored on the event. Completed: the last required signature landed. Sealed: the final PDF was locked with its cryptographic fingerprint. Two housekeeping events round out the vocabulary: Reminder, each time a nudge email goes out, and Voided, when the owner cancels the request.
Every event shares the same anatomy: what happened, exactly when (a UTC timestamp), which signer it concerns, the acting party's email address, the IP address and browser captured at that moment, and structured details specific to the event type.
Those details are where the record earns its keep. The signed event does not merely note that a signature happened — it stores a SHA-256 fingerprint of the exact signature image applied, binding that image to that moment. The sealed event carries the hash of the final document. The voided event remembers what state the document was in when cancelled, and why. Specifics are the point: the more precise the log, the harder it is to argue with later.
Why append-only matters
An audit log that can be edited is a diary, not evidence. tuyaform's trail is append-only by design: events are written by our servers at the moment an action happens, and there is no edit or delete anywhere in the product — not for signers, and not for the document's owner either. Your own view of your documents' trails is strictly read-only. That cuts against you on purpose: because you cannot tidy up your own record, the record is worth something when you present it.
Append-only also preserves what a summary loses: order and rhythm. A trail showing a document viewed at 14:02 and signed at 14:11 from the same IP tells a coherent human story; a lone 'signed' stamp with no context tells almost none. With sequential signing, the trail also documents the relay — one signer finishes, the next is invited — proof in itself that the agreed process was followed.
A small detail that shows how seriously we take the log: tuyaform's own reminder feature is throttled by consulting it — before another nudge email goes out, we check for the last reminder event to that signer. When a product's own features depend on the log being right, the log has to be right.
The tamper-evident seal: proving the file, not just the story
A timeline is only as trustworthy as the file it describes, which is why the trail works in tandem with a cryptographic seal. When the last signature lands, tuyaform computes a SHA-256 hash of the final signed PDF — a fingerprint derived from every byte of the file. Change anything, even one character, and the recomputed hash no longer matches. That hash is recorded in three places at once: the certificate record in our database, the printed Certificate of Completion, and the sealed audit event itself.
Where configured, tuyaform also signs that hash with an Ed25519 private key, printing the signature and the verifying public key on the certificate — upgrading 'this hash was recorded' to 'tuyaform attests to this hash', an attestation anyone can verify without asking us.
Trail and seal reinforce each other: the trail explains how the document came to be signed; the seal proves the file in your hand is byte-for-byte the file the trail describes. Either alone leaves a gap; together they close the loop.
Where the trail ends up: the Certificate of Completion
When a document completes, tuyaform generates the Certificate of Completion as a separate PDF alongside the signed document. It opens with a per-signer summary — name, email address, authentication method, the UTC timestamps for viewing and signing, IP address and device — and then prints the audit trail itself, event by event, followed by the document hash.
Keeping the certificate as a separate file is deliberate. The hash is computed over the signed document alone, so the certificate can state that hash without changing the file it describes. Store the two files together: the signed PDF is the agreement, and the certificate is its proof.
How an audit trail holds up in a dispute
Under the US ESIGN Act and UETA and the EU's eIDAS regulation, a signature cannot be denied legal effect merely because it is electronic — so real disputes are rarely about principle; they are about facts. Did this person sign? When? Did they see these exact terms? Has the file changed? An audit trail answers with specifics instead of assertions: attribution (the emailed link, IP address, device, and an optional access code), intent (a recorded, deliberate signing action), and integrity (the seal). That specificity is what shifts the practical burden onto whoever claims something went wrong.
Two honest caveats. tuyaform produces Simple Electronic Signatures (SES) — the tier most everyday business agreements rely on — and a strong audit trail is precisely what gives an SES its evidentiary weight. But no tool can guarantee that a particular document is enforceable; some categories, like wills and many family-law matters, are commonly excluded from e-signature laws; and eIDAS's higher tiers require identity verification that tuyaform does not perform. This is general information rather than legal advice — our guide on whether electronic signatures are legally binding and the legality page on our site cover the frameworks in depth.
What it costs and what you have to configure: nothing
Every signing request on tuyaform records its full audit trail automatically — there is no toggle to find, and no premium tier that unlocks 'real' evidence. The free plan includes unlimited signing through share links and 30 emailed signature invitations per month; paid plans (Starter at $8/month for 3,000, Growth at $19/month for 10,000) raise that email allowance, and nothing about the evidence varies by plan. Signers never need an account.
The practical takeaway: the best time to have an audit trail is before anyone asks for it. If a document matters enough to sign, send it through a flow that records the story by default — the record you did not keep is the one you will wish you had.