BlogSecurity
What the completion record keeps
Download the record with the PDF. The hash is how you check that the file still matches.
The record describes the completed file. It does not replace the file.inSigner
After the last signature, the workspace holds the completed PDF and a completion record. The record includes a SHA-256 hash of the final file. This guide lists what that pair is for, and what it does not prove.
01 · The hash
The hash
SHA-256 reduces the final file to a fingerprint. If one byte changes, the fingerprint changes. That is an integrity check. It does not encrypt the file, and it does not identify a signer by a government document.
02 · The download
The download
Download the PDF and the record together. Email reminders and delivery are included, but the inbox is a poor archive. Put both files in the matter folder.
Keep the record because it names the file. Keep the file because the record is not the agreement.
03 · What it does not include
What it does not include
The record is not a court judgment, a notary certificate, or a qualified signature. It is not a promise that a file you could upload is valid wherever the signer lives. Those questions stay with counsel and with the country guide for the governing law.
- ✓Did we download the PDF and the record?
- ✓Does the record include a SHA-256 hash?
- ✓Are we treating the hash as encryption?
- ✓Is the pair stored outside a single inbox?
04 · Who can see it
Who can see it
People you invite into the workspace can reach the completed document according to the product's access. The record is not a public web page. Do not post the hash as if publication itself made the agreement enforceable.
05 · A later comparison
A later comparison
When a copy arrives by email months later, hash it and compare. A match means you are looking at the same final file. A mismatch means you should not treat that copy as the completed one.
Primary sources
inSigner security overview