What makes an audit trail tamper-evident?

A log isn't the same as tamper-evidence

Lots of tools keep a log: "Alex opened the document at 2:14 PM." Useful — but a plain log has a weakness. If someone can edit the log, or swap the document after the fact, the record proves nothing. Tamper-evidence is the property that closes that gap: it doesn't necessarily prevent changes, but it makes any change detectable. That's the difference between a record you hope is accurate and one you can trust.

The two halves of a tamper-evident trail

A strong audit trail has two parts working together.

1. Complete event logging (the "what happened")

For every meaningful action, the trail should capture:

• Who — the signer's name and email
• When — a precise timestamp, ideally in UTC, for each event (sent, viewed, signed, completed)
• Where — the IP address and device/user-agent
• How — the authentication method used to verify the signer
• What they agreed to — the consent to sign electronically

This builds a chain of custody: a step-by-step account of the document's journey from draft to completion.

2. Cryptographic integrity (the "proof nothing changed")

Logging alone can be edited. Cryptography is what makes the record tamper-evident. Two techniques do most of the work:

• Hashing — the system computes a SHA-256 hash of the document: a fixed-length fingerprint unique to those exact bytes. Change anything — a number, a signature, a hidden metadata field — and the hash changes completely. Recording the hash at completion means anyone can later recompute it and confirm the file is unaltered.
• Digital sealing — the completed document is sealed with a digital certificate (for PDFs, typically a PKCS#7 structure). If the file is modified after sealing, the seal fails to validate. When that certificate is AATL-backed, common PDF readers show the tampering automatically.

Together, hashing and sealing mean you don't have to trust that the document is unchanged — you can verify it.

What a certificate of completion looks like

When a document finishes, a good platform generates a certificate of completion that consolidates the trail into a single, portable record. It typically includes:

• The document's SHA-256 hash
• Each signer's identity and email
• Every event with its UTC timestamp
• IP addresses and devices
• Authentication methods
• Confirmation of the tamper-evident seal

This certificate travels with the signed PDF, so the evidence is self-contained — you don't need to log back into a platform to prove what happened.

Why this matters in the real world

Most documents are never disputed. But when one is — a contract disagreement, an audit, a compliance review — the audit trail is your evidence. The questions that come up are always the same: Did this person really sign? When? Is this the exact document they agreed to? A tamper-evident trail answers all three with proof rather than assertion.

It also matters for compliance. Regulations across finance, healthcare, and government increasingly expect not just a signature, but a demonstrable, unalterable record of how it was obtained.

What to look for in a signing tool

When evaluating platforms, ask:

• Does it capture identity, timestamp, IP, device, and authentication method for every event?
• Does it record a cryptographic hash (e.g., SHA-256) of the completed document?
• Does it seal the finished file so alterations are detectable — ideally with an AATL-backed certificate?
• Does it produce a portable certificate of completion you can keep and share?

How PearSign handles it

PearSign builds a tamper-evident audit trail into every completed document. Each event records the signer's name and email, a UTC timestamp, IP address, device, and authentication method. The finished document is fingerprinted with a SHA-256 hash and sealed with an AATL-backed digital certificate, and a certificate of completion captures the whole chain of custody — so if a document is ever questioned, it can defend itself.

FAQ

What does "tamper-evident" mean for a document?

Tamper-evident means that any change made to a document after it's been signed can be detected. It's usually achieved by fingerprinting the document with a cryptographic hash and sealing it with a digital certificate — if the file is altered, the fingerprint no longer matches and the seal fails to validate.

What information should an audit trail capture?

A strong audit trail records, for each event, the signer's name and email, a precise timestamp (ideally UTC), the IP address and device used, the authentication method, and the signer's consent to sign electronically. This builds a chain of custody from draft to completion.

What is a SHA-256 hash and why does it matter?

SHA-256 is a cryptographic function that turns a document into a unique fixed-length fingerprint. If even one byte of the document changes, the fingerprint changes completely — so recording the hash at signing lets anyone later verify the file hasn't been altered.

What is a certificate of completion?

A certificate of completion is a portable record generated when a document is finished. It consolidates the audit trail — the document hash, each signer's identity, timestamps, IP addresses, authentication methods, and confirmation of the tamper-evident seal — into a single document that travels with the signed file.

Does PearSign provide a tamper-evident audit trail?

Yes. PearSign records a detailed audit trail for every document, fingerprints the completed file with a SHA-256 hash, seals it with an AATL-backed digital certificate, and generates a certificate of completion capturing the full chain of custody.