Signing and verification

What a signer does

The invitation opens a public signing page. Witness emails a six-digit verification code to the signer; the code expires after ten minutes. After the challenge succeeds, the signer accepts electronic-record consent and completes every required field assigned to them.

Signatures and initials may be typed or drawn. A signer may also decline instead of signing. This flow demonstrates control of the invited email inbox and records the actions taken. It is not government-ID verification.

What happens after the last signer

The last completed signature dispatches queued completion work. Witness stamps the fields into a new PDF, stores it privately, updates the envelope, and emails the sender and signers.

Completed PDFs up to 10 MiB may be attached to completion email. Larger files use a signed download link that expires after seven days. The document remains available to authorised users in Witness after an email link expires.

The Certificate of Completion includes the original-document hash, final-content hash, and audit-chain head. The audit chain is tamper-evident, but an operator with full database control could rewrite the history and recompute it. Preserve the final PDF and certificate as the durable record.

Verify a completed PDF

Anyone can open /verify and upload a completed PDF. Witness hashes the upload during the request and reports a match only for a completed envelope. It does not store the uploaded file and does not reveal pending envelope details.

A successful match says that the file matches a completion record held by this Witness deployment. It is not a legal judgment, a qualified-signature validator, or proof of government identity.

If completion appears stuck, check the managed worker and follow Troubleshooting. Do not resend or modify the envelope until you understand whether completion work is merely delayed.