Is an audit trail enough proof on its own?

What an audit trail is

An audit trail is the list of an agreement's steps that the signing service records: when the document was created and sent, when each signer opened it and signed, and when it was completed, each with a time. Most services add it to the finished document or offer it as a separate report, often under a name such as certificate of completion or audit report.

It is useful evidence. It is also the service's own account of events, built from what the service's systems saw.

How courts treat an audit trail

General information, not legal advice. Courts weigh evidence case by case, and the rules differ by country.

• It can be admitted. In the United States, UETA, the model law most states have enacted, says evidence of a record or signature "may not be excluded solely because it is in electronic form" (section 13). Under eIDAS, an electronic document "shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in electronic form" (Article 46).
• It has to be authenticated. In US federal courts, the party offering a record "must produce evidence sufficient to support a finding that the item is what the proponent claims it is" (Federal Rule of Evidence 901(a)). A record generated by an electronic process can be authenticated by a qualified person's certification (Rule 902(13)), which goes to authenticity only and leaves other objections open. In Canada, the person offering an electronic document carries that burden under the federal Canada Evidence Act (section 31.1) and provincial acts such as Ontario's (section 34.1(4)); under the federal Act, the integrity of the system that kept it can be presumed in some cases, for example on evidence that the system was operating properly (section 31.3).
• Its weight depends on the rest of the evidence. Under UETA, a signature is attributable to a person "if it was the act of the person", which "may be shown in any manner, including a showing of the efficacy of any security procedure" (section 9(a)); the comments published with UETA say the use of a security procedure "is not accorded operative legal effect, through the use of presumptions or otherwise, by this Act" (comment on the definition of security procedure, section 2). In Italy, a court freely assesses the probative value of an electronic document with a simple electronic signature, "in relazione alle caratteristiche di sicurezza, integrità e immodificabilità" (in light of its security, integrity and unalterability) (Codice dell'amministrazione digitale, article 20(1-bis)). In Argentina, if a simple electronic signature is disowned, the party relying on it must prove it (Ley 25.506, article 5).

So an audit trail gets a document through the door. Whether it settles a dispute depends on what stands next to it.

Where an audit trail alone falls short

1. It records what the service saw. A typical entry says that a link sent to an email address was opened and that a signing step was completed. It can't, by itself, show that the person behind the mailbox was the signer.
2. It describes events, not the document. Unless the trail is tied to a fingerprint of the exact document, it doesn't show which version was signed or that the file is unchanged. A fingerprint (a SHA-256 hash) is a short code calculated from a file's contents: change one character and it changes completely.
3. It is written and stored by one party. The other side can ask who could change it, and the answer usually depends on the service's internal controls.
4. It may depend on the service later. Dropbox Sign, for example, says its audit trail identifier "can be used to look up a record in our database" (as published on October 11, 2026), a step that needs the service.

The layers that make it hold

Layer	What it adds	How Attest provides it
The audit trail	The sequence of steps and their times	Every step up to completion, in order, in UTC, in the sealed copy, bound by its fingerprint to Attest's anchor of the agreement
The signer's own signature	Evidence the signer made, not the service	Each signer approves with a passkey, a cryptographic key only the signer controls, unlocked with Face ID, Touch ID, Windows Hello or the device PIN
A fingerprint in that signature	Which version was signed, and that it is unchanged	The passkey signs a statement that begins "I have reviewed and I sign", naming the document's fingerprint and the signer's entries
An independent time	A time the signing service can't move afterward	Anchors on Horizen, a public blockchain anyone can read, in a registry contract with no function to change or remove an anchor
The same copy for every party	No "your copy against mine"	Every party downloads the same sealed PDF
A check anyone can run	The other side can test it	A free, open-source verifier inside every signed copy
Context	The deal around the signature	Your emails, invoices and conduct, which "may be shown in any manner" under UETA

On Attest, the audit trail page lists, with times in UTC, when the document was created and sent and when each signer opened their signing link, set up their key, had the document released to them, signed and was reminded, and when the agreement completed. It names each signer by name and the sender as "the sender". The verifier re-checks the trail against Attest's anchor and re-makes the page from it, and it checks the original document inside the signed copy against what every signer signed, each signer's passkey signature and entries, Attest's anchored record of the agreement on Horizen, and that nothing was added to the PDF after it was sealed.

If you are relying on an audit trail today

Whatever service you used:

1. Download the signed document and its audit trail together when the agreement completes, and keep both exactly as downloaded.
2. Check how each one is sealed, and whether you can verify it without the service.
3. Keep the correspondence around the agreement: the emails that sent it, discussed it and acted on it.
4. Know who would vouch for the trail. If it ever needs a witness or a certification from someone at the service, note how you would reach them.
5. For new agreements, choose evidence beyond the log: each signer's own signature over the document's fingerprint, a public anchor, and a copy every party holds.

Electronic signatures are recognized for most agreements in the United States (the ESIGN Act and UETA) and the European Union (eIDAS). Some documents, such as wills or certain notarized deeds, have special rules in many places: check yours.