What makes an electronic signature binding

Ask somebody what makes an e-signature count and they will describe the picture: a cursive line drawn with a trackpad, ideally wobbly enough to look human. It is the part of the process everybody can see, and it is the part the law has least to say about.

In the United States two instruments govern this. The federal ESIGN Act (15 U.S.C. § 7001) and the Uniform Electronic Transactions Act, adopted in nearly every state, both start from the same position: a signature, a contract or a record is not unenforceable merely because it is electronic. What they then require is not a particular kind of mark. It is evidence about four things.

The four requirements

Each of those is a thing a system either records or does not. Here is how XDocs records them, and where each one sits in the process.

Intent is its own act

Typing a name into a field is not intent; it is typing. So the signature is applied by a confirmation of its own, which states what is about to happen and waits. There is a reason the dialog is not merged into the last field: a flow where the final keystroke silently executes the agreement makes intent indistinguishable from momentum, and the record of it indistinguishable from a log of cursor movements.

Declining is an act too, and it is offered in the same place. A signer who will not sign can say so with a reason, which is recorded and sent to the sender — a better outcome for everyone than an envelope that sits unopened while somebody guesses whether the email arrived.

Consent comes first, and carries a version

The consent disclosure is the least glamorous screen in the product and the one most likely to matter if anything is ever disputed. It covers the six things the statute expects a signer to have been told: that they may ask for a paper copy, that they may withdraw consent and how, what this consent covers, the hardware and software they will need, how to update their contact details, and how long the record is kept.

Three details about it are deliberate. The box is unticked by default, because a pre-ticked box records our preference rather than their decision. The consent is stored with a timestamp, an IP address and the version of the wording that was on screen — so a disclosure improved next March does not quietly rewrite what somebody agreed to last week. And it is taken before any field will accept input: consent obtained after the fact is a formality, and a system that collects the signature first and the consent second has the order of the statute backwards.

Association is why the field sits in the sentence

This is the requirement most often satisfied by accident and least often satisfied well. A signature matters because of what it sits next to. In XDocs the fields are nodes in the document body — a signature block lives between the clause above it and the clause below it, bound to a named recipient — rather than coordinates on a page that happens to be attached.

Uploaded PDFs work the other way round, because they must: fields are dragged onto the pages and stamped back at the same coordinates on completion. In both cases the association is then made permanent by the same two mechanisms. Sending freezes a snapshot of the document, so what is signed is a fixed text rather than a draft somebody can still edit. And every captured value is hashed into a completion digest, printed on the certificate, so the pairing of this signature with this wording is checkable later by recomputing it.

Retention means everybody holds a copy

On completion XDocs builds one PDF carrying the document as signed, every signature image or typed mark, and a certificate of completion: the audit trail, the consent records, and two SHA-256 digests — one over the document, one over the completed record. That file is archived and emailed to every party, not only to the sender. Retention held by one side of an agreement is a weaker thing than retention held by both.

What we add beyond the statute

• Per-recipient access codes — an out-of-band shared secret for a sensitive recipient, with failed attempts logged rather than silently retried.
• Integrity digests printed on the certificate, so the record can be verified by anybody holding the file and the algorithm, with no appeal to us.
• An append-only audit trail: every view, consent, field entry, signature, reminder, decline and void, with timestamp, actor and IP address.
• Sequential routing with real gates, so a counter-signature cannot be collected before the signature it depends on.

Where this leaves the squiggle

It is still there, and signers still want it: drawn, typed in one of several hands, or uploaded. It carries real weight as a ritual, and the ritual is part of why intent is legible. But it is the visible end of a record that was mostly assembled before the pen touched the glass — and when somebody asks, two years later, whether this thing was properly signed, the squiggle is not the part of the file you will be reading.