--- title: "Can an e-signature company alter an audit trail? · Attest" description: "Who controls an e-signature audit trail, what a vendor's seal proves and what it can't, and how Attest anchors its audit trail's fingerprint on a blockchain." url: https://attest.datahubz.com/guides/can-e-signature-company-alter-audit-trail updated: 2026-10-12 --- [Attest](https://attest.datahubz.com/)/[Guides](https://attest.datahubz.com/guides) # Can an e-signature company alter an audit trail? A service that both keeps the audit trail and holds the key that seals it can, technically, produce a different record, so with services that seal the record with their own key, you rely on the vendor's internal controls and on the sealed copies you downloaded at the time. Attest puts the fingerprint of its audit trail up to completion, not the trail itself, into an anchor on a public blockchain written when the agreement completes, and each signer's own passkey signature names the document's fingerprint, so neither can be changed afterward, by Attest or anyone else, without verification failing. By DataHubz · Updated October 12, 2026 · 6 min read ## Who writes an audit trail An **audit trail** is the signing service's log of an agreement's steps: when it was created and sent, when each signer opened it and signed, and when it was completed. The service writes it, from what its own systems saw, and usually turns it into a certificate or audit report at the end. That makes the question fair to ask of any service, Attest included: the company that writes the record also stores it. What matters is whether a change made later would show. ## What protects a typical audit trail E-signature services protect the copies they issue. As published on their own pages on October 11, 2026: - **Adobe Acrobat Sign** "uses public key infrastructure (PKI) to certify final signed PDF documents and audit trails with a digital signature before distribution of the document to a recipient" (Acrobat Sign Security Overview, June 2026). - **Dropbox Sign:** "To help ensure that any tampering of the audit trail is detectable, we process the audit trail with hashing technology." - **DocuSign** seals documents with PKI, and says the seal "indicates the electronic signature is valid and that the document has not been tampered with after it was downloaded from DocuSign eSignature". These are real protections. Once you download a sealed audit report, an edit to that file shows when its seal is checked. ## What a vendor's seal can't show A seal proves that a file hasn't changed since it was sealed. Three things sit outside it: 1. **Whether the record was right when it was sealed.** The seal covers whatever the service wrote. 2. **Who holds the sealing key.** The seal belongs to the service, not to the signers, so the service can seal a new version of a record as easily as the first one. The copy you downloaded at the time is what you can compare against. 3. **Records that stay with the service.** Some proof never leaves the vendor: Dropbox Sign, for example, says that to prove there was no tampering it "can provide you with the two unique document records". None of this means a vendor has altered anything. It means that, for the record itself, you rely on the vendor's internal controls, and on your own downloads. ## What makes a later change detectable Three kinds of evidence don't depend on trusting the service that wrote the record: - **Evidence the signer made.** A signature made with the signer's own key, over a fingerprint of the document, can't be produced by the service. - **A fingerprint fixed in public at the time.** A **fingerprint** (a SHA-256 hash) is a short code calculated from a file's contents: change one character and it changes completely. Written to a public blockchain, a public ledger anyone can read, it fixes what the record was and when. - **Copies every party holds,** with a checker anyone can run. ## How Attest binds its audit trail Every signer on Attest approves with a **passkey**, a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN. Attest never sees a passkey's secret. | Part of the record | What binds it | Could it be changed later without detection? | | ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------- | | The document | Its fingerprint is in every signer's passkey-signed statement | No: the signatures would fail | | Each signer's entries | Their fingerprint is in that signer's statement | No | | Who signed and when | Each signing time is in the passkey-signed statement, and the signed state, listing every signer, is anchored on Horizen | No | | The audit trail up to completion (created, sent, opened, key set up, released, signed, reminded, completed, with times in UTC) | Its SHA-256 is in the completion details that Attest's anchor of the agreement binds, written right after completion | No: the verifier re-hashes the trail and re-makes its printed page from it | | The pages of the signed copy | Anchored when the copy is sealed, and re-made by the verifier byte for byte | No | | The anchors themselves | Attest's registry contract records when each value was anchored and has no function to change or remove that record | No | Attest's anchor of the agreement also commits to every signer's statement, passkey public key and signature, so a signature or key swapped in later would not match what was anchored. Two points of precision. The audit trail is Attest's record of the steps up to completion: it is fixed when the agreement completes, not step by step as it happens, and steps after completion aren't part of it. And the core evidence, who signed which document, never depended on trusting the trail: it is in each signer's own passkey signature. ## Check it yourself 1. **Download the signed copy** when the agreement completes. Every party gets the same sealed PDF: the signed pages, with a "Signed with Attest" stamp on each signature and a seal line at the foot of every page, a certificate of completion, the audit trail up to completion and a "Verify it yourself, without us" page, with the full evidence, the original document and a standalone verifier attached inside. 2. **Drop it on the verifier** attached inside it. The verifier checks the original document inside against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed. It also re-makes every page you see from what was signed and compares the result with the copy byte for byte, so pages drawn with anything else fail. Or drop it on [attest.datahubz.com/verify](https://attest.datahubz.com/verify), which fingerprints it in your browser and confirms it is the exact file that was recorded and anchored. 3. **Compare with the other party's copy** if anything is in doubt: every party holds the same file, so a genuine copy verifies. The verifier is open source under the MIT license, runs with no Attest service and reads only a public blockchain node. It pins its trust root (the chain, Attest's registry and the keys it checks against are built into the verifier, never read from the file being checked) and accepts only anchors from Attest's registered wallets. ## Questions to ask any e-signature service 1. Does each signer sign with their own key, or does the service seal the document with its key? 2. Can a party verify the record without the service, and with what software? 3. Is anything fixed outside the service's systems at the time of signing? 4. Do all parties receive the same sealed copy, with the evidence inside it? 5. What happens to the records, and to the way to check them, if the account closes or the service ends? ## Questions people ask Can Attest edit an audit trail after an agreement is completed? Not without verification failing. The audit trail up to completion is bound by its fingerprint to Attest's anchor of the agreement on Horizen, written right after completion, and the verifier re-hashes the trail and re-makes its printed page from it. The registry contract has no function to change or remove an anchor. Could Attest change a signature or the document? No. Each signer's passkey signs a statement naming the document's fingerprint and their entries, and Attest never sees a passkey's secret, so it can't make a new signature. A changed document or a swapped signature no longer matches what was signed and anchored. Is a sealed audit report from another service still good evidence? Yes: a sealed report is evidence that the file hasn't changed since the service sealed it. Keep the copy you downloaded at the time, with the signed document and your correspondence, because that copy is what you can compare against later. Does a blockchain stop anyone from recording something false? No. An anchor fixes what was recorded and when; it doesn't make the record true. That is why Attest's evidence also rests on each signer's own passkey signature, which names the document's fingerprint. Can Attest add a step to an audit trail after completion? Not to the trail in the signed copy. That trail is fixed at completion, bound by its fingerprint to Attest's anchor of the agreement, and the verifier re-hashes it. Steps recorded after completion aren't part of it. ## Sources 1. [Adobe Acrobat Sign Security Overview (June 2026)](https://www.adobe.com/cc-shared/assets/pdf/trust-center/ungated/whitepapers/doc-cloud/adobe-acrobat-sign-security-overview.pdf), Adobe, read October 11, 2026 2. [Dropbox Sign legal](https://www.dropboxsign.com/about/legal), Dropbox, read October 11, 2026 3. [Docusign eSignature features](https://www.docusign.com/products/electronic-signature/features), Docusign, read October 11, 2026 ## Read next - [Is an audit trail enough proof on its own?](https://attest.datahubz.com/guides/is-audit-trail-enough-proof) What an e-signature audit trail proves in a dispute, where it falls short alone, and what makes it hold: the signer's own signature, fingerprints and anchors. - [How to tell if a document was changed after signing](https://attest.datahubz.com/guides/document-changed-after-signing) Fingerprints (hashes) explained simply: why one changed word shows, how Attest's verifier catches a change after signing, and what to do if a check fails. - [How to prove someone signed a document electronically](https://attest.datahubz.com/guides/prove-someone-signed-electronically) The evidence that proves an electronic signature: intent, identity, integrity and timing. How most services record it, and how Attest makes it checkable. - [Verify](https://attest.datahubz.com/verify) Check a signed document, receipt, certificate or proof for free, with no account. Drop the file, or enter its ID or fingerprint: it is checked in your browser. --- Source: https://attest.datahubz.com/guides/can-e-signature-company-alter-audit-trail