E-signature security and compliance
How PenMarker supports e-signature security and compliance under the ESIGN Act, UETA and eIDAS, and what it records as proof.
Updated
Are e-signatures made with PenMarker legally valid?
For most business documents, yes. PenMarker is built to support the main e-signature laws below. Whether a particular document can be signed electronically depends on the document and the law that applies to it.
| Law | Where | What it means for your signatures |
|---|---|---|
| ESIGN Act | United States (federal) | A signature or record can't be denied legal effect only because it is electronic. Signers consent to doing business electronically. |
| UETA | United States (adopted by most states) | Electronic signatures and records satisfy laws that require a signature or writing, when the parties agree to transact electronically. |
| eIDAS | European Union | An electronic signature can't be refused as evidence only because it is electronic. PenMarker provides simple electronic signatures, not advanced or qualified ones. |
Some documents can't be signed electronically, such as certain wills, court orders and notices the law requires on paper, and some need an advanced or qualified signature that PenMarker doesn't offer. PenMarker doesn't give legal advice; check with a lawyer when you're unsure.
How does sealing protect a signed document?
When the last person signs, PenMarker seals the document: any later change to the file no longer matches its recorded fingerprint.
- The final PDF's SHA-256 fingerprint is calculated and stored with the document.
- Every event (sent, viewed, signed, sealed) is logged with its time and IP address, and each entry's hash is chained to the previous one, so a changed or missing entry breaks the chain.
- A certificate of completion lists the parties, how each one signed, and when.
- Each signature has an ID and a QR code that opens a public check page. It shows the signer's name, the date and the document's fingerprint, never email or IP addresses.
What does an XRP Ledger record add?
An optional, independent timestamp: one hash per sealed document, written to a public ledger that nobody can edit afterwards.
- The hash is the SHA-256 fingerprint of the sealed document's manifest: its name, PenMarker id, the sealed file's fingerprint, the signers and the time it was sealed.
- It is sent in a memo on a transaction from PenMarker's own wallet. The document, names and email addresses are never written to the ledger.
- Records usually confirm within 5 to 10 seconds, and link to a public XRP Ledger explorer.
- Verifying a file checks it against PenMarker's own records of sealed documents; the ledger record is the independent timestamp behind them.
How are PenMarker accounts protected?
With two-step verification, short-lived sessions, and an archive that needs a second code to open.
- Two-step verification with an authenticator app, a text message or an email.
- Sign-in tokens are kept in memory and in a secure, HttpOnly cookie, never in browser storage. Idle sessions sign out automatically.
- The archive of sealed documents opens for 15 minutes with a code from your authenticator app.
- Signing links are single-use and are stored only as hashes.
What PenMarker doesn't do
- It doesn't check a signer's identity beyond the email address or link the request was sent to.
- It doesn't read or judge the content of your documents.
- It doesn't provide advanced or qualified electronic signatures under eIDAS.
Send your first document for signature today
Create an account in a minute. Your signers never need one.