Froovo Sign — E-Signatures for Modern Products

An audit trail is a chronological record of every action taken on a document — from creation to final signature. For e-signatures, it's not just good practice; it's often a legal requirement.

What is an audit trail?

In the context of e-signatures, an audit trail captures: who took what action, when they took it, from what IP address and device, and what the document state was at each point. A strong audit trail lets you prove in court that a signature was made by the right person under the right conditions.

Legal requirements

ESIGN Act (US) — Requires that electronic signatures be attributable to the signatory and that records be retained.
eIDAS (EU) — Requires qualified electronic signatures for the highest-assurance transactions; audit trails are mandatory.
UETA — State-level US law requiring record retention and attribution.
HIPAA — For healthcare documents, audit logs must be tamper-evident and retained for at least 6 years.

What Froovo Sign captures

Every Froovo Sign document generates an immutable audit log that includes:

Document created — timestamp, creator ID, document hash
Invitation sent — timestamp, recipient email, delivery status
Document viewed — timestamp, IP address, user agent
Signature applied — timestamp, IP address, GPS coordinates (if permitted), signature image hash
Document completed — final timestamp, combined document hash
Any decline or expiry events — timestamp and reason

Immutability and cryptographic integrity

Each audit event is hashed and chained to the previous event — similar to a blockchain. Tampering with any single event invalidates the entire chain, making the audit trail cryptographically verifiable. The final signed PDF embeds the full audit trail as an attachment.

How to export and download audit reports

Audit reports are available from the Froovo Sign dashboard or via the API. Each export includes a machine-readable JSON log and a human-readable PDF certificate.

typescript

// Download audit report via API
const audit = await client.documents.getAuditTrail("doc_01HXYZ...");

// audit.events — array of timestamped events
// audit.certificateUrl — link to the PDF certificate
// audit.integrityHash — SHA-256 hash of the full event chain

Best practices

Retain audit reports for at least 7 years for most commercial contracts
Store the integrity hash separately from the document to detect tampering
For regulated industries, use Froovo Sign's export API to archive reports in your own system
Include the audit certificate when sharing signed documents with counterparties