Signatures that hold up with the record to prove it
Tally Sign signatures are electronic signatures under the U.S. ESIGN Act and UETA. Every signer agrees to sign electronically, and every signed PDF ends with a Certificate of Completion: who signed, when, from which IP address and device, and a SHA-256 fingerprint of what they signed.
Is it legally binding? yes, and here's why
Electronic signatures have been legal in the United States since 2000 and across the EU since 2016. Here's what each rests on.
United States
ESIGN Act and UETA
The federal ESIGN Act (15 U.S.C. § 7001) and the state laws based on the Uniform Electronic Transactions Act say a signature, contract or record can't be denied legal effect just because it's electronic. That covers sales contracts, order forms, NDAs, SOWs, leases and most other business agreements.
European Union
eIDAS Regulation
A Tally Sign signature is a simple electronic signature under eIDAS. Under Article 25 it can't be denied legal effect or refused as evidence just because it's electronic. It isn't an advanced or qualified signature, so documents that require those need another tool.
Everywhere else
Check the document's law
Most countries accept electronic signatures for commercial contracts. Whether a particular document is valid still depends on the law that governs it and what it says, so check with your lawyer for anything unusual.
What e-signature isn't for
ESIGN leaves a few kinds of documents out, and some need a notary or a stronger signature. Use paper or a specialist service for these. The full terms signers agree to are in the Electronic Records and Signature Disclosure.
- Wills, codicils and testamentary trusts
- Adoption, divorce and other family law matters
- Court orders, notices and official court documents
- Notices of utility shut-off, foreclosure, eviction, or cancellation of health or life insurance
- Product recall notices and documents that must travel with hazardous materials
- Anything that must be notarized, or signed with an EU qualified signature
What each signature records start to finish
If anyone ever asks whether a person really signed, the answer is in the record: a link sent only to them, their agreement to sign electronically, the signature they chose, and where and when they signed it.
A link only they receive
Each signer gets their own signing link by email. Nobody needs an account. Each new send or hand-off makes new links, and the old ones stop working. Someone who starts from a company's public signing link confirms their email the same way, by opening a link emailed to them, unless the company turned that off; the certificate says which.
An access code, if you set one
You can give a signer a code by phone or text. Their link shows nothing of the document until it's entered, five wrong tries lock it for 15 minutes, and the certificate records when the code was verified.
They agree to sign electronically
Before they can fill in anything, signers read the electronic record disclosure and tick the box. It tells them how to get a paper copy and that they can decline instead.
A real view, not a link scanner
A view counts only when the signer scrolls, clicks or types. Email security that opens links first is logged separately and left off the certificate.
They adopt a signature and confirm it
They draw a signature or pick a typed one, then confirm that it's the legal equivalent of their handwritten signature on this document.
The moment is recorded
Time, IP address and device are saved with the signature, and every step before it is in the audit trail.
Everyone gets the signed PDF
When the last person signs, each signer and CC receives the signed PDF by email, with the Certificate of Completion at the end.
The certificate on every signed PDF
Every signed PDF ends with a Certificate of Completion. This is a real one, made by Tally Sign for the sample order form on this site. Yours are in your signers' language, with your logo and colors.
The document fingerprint
A SHA-256 fingerprint of the exact content that was sent, with its exhibits. A new version gets a new fingerprint.
Every signer
Name, email, title and company, the signature they adopted, when they consented, viewed and signed, when they entered an access code, their IP address and device, and each file they uploaded with its SHA-256.
The audit trail
Each event with a UTC timestamp to the millisecond: sent, emailed, viewed, signed, reminders, edits accepted, hand-offs and the signed PDF's own hash.
Order Form — 00000042
This fingerprint was computed when the document was sent for signature. It uniquely identifies the exact content (text, pricing, fields and exhibits) every signer reviewed; any change to that content would produce a different value.
Signers
2- Consented to e-sign
- Sep 25, 2026, 15:05:02 UTC
- Viewed
- Sep 25, 2026, 15:04:20 UTC
- Signed
- Sep 25, 2026, 15:05:02 UTC
- IP address
- 198.51.100.24
- Device
- Chrome 129 on macOSMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
- Consented to e-sign
- Sep 25, 2026, 16:47:39 UTC
- Viewed
- Sep 25, 2026, 16:41:12 UTC
- Signed
- Sep 25, 2026, 16:47:39 UTC
- IP address
- 203.0.113.58
- Device
- Safari 18 on iOSMozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1
Audit trail
11| Timestamp (UTC) | Event | Detail | IP address |
|---|---|---|---|
| Sep 25, 2026, 15:03:41 UTC 2026-09-25T15:03:41.000Z | Document created | Document created | — |
| Sep 25, 2026, 15:04:00 UTC 2026-09-25T15:04:00.000Z | Sent for signature | Sent for signature to Avery Brooks, Dana Whitfield | — |
| Sep 25, 2026, 15:04:01 UTC 2026-09-25T15:04:01.000Z | Signing request emailed | Signing request emailed to Dana Whitfield <dana.whitfield@brightline.example> | — |
| Sep 25, 2026, 15:04:20 UTC 2026-09-25T15:04:20.000Z | Document viewed | Viewed by Avery Brooks <avery@northbeam.example> | 198.51.100.24 |
| Sep 25, 2026, 15:05:02 UTC 2026-09-25T15:05:02.000Z | Document signed | Signed by Avery Brooks <avery@northbeam.example> | 198.51.100.24 |
| Sep 25, 2026, 16:41:12 UTC 2026-09-25T16:41:12.000Z | Document viewed | Viewed by Dana Whitfield <dana.whitfield@brightline.example> | 203.0.113.58 |
| Sep 25, 2026, 16:47:39 UTC 2026-09-25T16:47:39.000Z | Document signed | Signed by Dana Whitfield <dana.whitfield@brightline.example> | 203.0.113.58 |
| Sep 25, 2026, 16:47:39 UTC 2026-09-25T16:47:39.000Z | Completed | All parties have signed | — |
| Sep 25, 2026, 16:47:43 UTC 2026-09-25T16:47:43.000Z | Signed PDF generated | Signed PDF generated (SHA-256 c6e4e38d1b6ce51e…) | — |
| Sep 25, 2026, 16:47:45 UTC 2026-09-25T16:47:45.000Z | Signed copy emailed | Signed copy emailed to Avery Brooks <avery@northbeam.example> | — |
| Sep 25, 2026, 16:47:45 UTC 2026-09-25T16:47:45.000Z | Signed copy emailed | Signed copy emailed to Dana Whitfield <dana.whitfield@brightline.example> | — |
Proof it wasn't changed before or after signing
A signature belongs to one exact version of a document. Tally Sign makes sure nobody can swap the content underneath it, and keeps what you need to show that.
Frozen when it's sent
Sending freezes the document's content and exhibits and fingerprints them. Nobody can edit a sent document in place.
Signatures follow the version
Each signature is checked against the version the signer read. If the document changed in the meantime, the signature isn't accepted.
Changes are on the record
Accepting a redline makes a new version with its own fingerprint. Unlocking a document to edit it stops signing, clears signatures and is logged.
Signed documents stay
Completed and declined documents can't be edited or deleted. Only drafts and voided documents can.
Check any copy
The SHA-256 of the signed PDF is recorded. Anyone can drop a copy on the Verify a document page to see if it's the exact file Tally Sign produced.
Every version kept
Earlier versions stay with the document, with exactly what changed between them and who accepted it.
Your team's accounts locked to your company
Sign in with your identity provider, see every new browser, and decide who can do what.
Single sign-on on every plan
SAML 2.0 or OpenID Connect with Okta, Microsoft Entra ID, Google Workspace and others. Require it for everyone, and your identity provider's MFA applies.
Passwords and sessions
Passwords are stored only as salted scrypt hashes. Repeated wrong passwords are blocked for 15 minutes, and changing a password signs out every other browser.
Two-step sign-in and alerts
A code from an authenticator app after the password, with single-use recovery codes; admins can require it for everyone. Everyone is emailed when their account signs in from a new browser.
Roles
Owners, admins and members. Each request reaches only your own company's data, from the app, the API or Salesforce.
Keys and connections
API keys are stored only as hashes, rate-limited and revocable, and API webhooks are signed. ChatGPT and Claude ask before sending anything, and an admin can disconnect them all at once.
Encrypted secrets
Salesforce tokens and single sign-on secrets are encrypted with AES-256-GCM. Everything travels over HTTPS, with HSTS.
Your data where it lives and who touches it
Everything is stored in the United States, with a short list of providers and commitments written into the Data Processing Addendum.
Stored in the United States
The app and database run in Railway's US West region in California, and files are in private storage in San Jose. Daily backups are kept up to 3 months.
Four subprocessors
Railway for hosting, Resend for email, and OpenRouter with Anthropic Claude hosts for the AI assistant, only when someone uses it.
Not used to train AI
We don't train AI models on your documents or your signers' data, and our AI providers' terms don't allow them to either.
Yours to take or delete
Download every signed PDF with a CSV of who signed what, any time, even while paused. The owner can delete the company from Settings.
Told within 72 hours
If a breach affects your data, we tell you without undue delay and within 72 hours, as the Data Processing Addendum commits.
Written down
The Data Processing Addendum's Annex II lists every security measure in place, and every one that isn't yet.
Data Processing AddendumSubprocessorsPrivacy PolicyE-signature disclosure
Not in place yet said plainly
If your security review needs one of these, tell us. The complete list is in Annex II of the Data Processing Addendum.
- A SOC 2 report or ISO 27001 certification
- Signer identity checks beyond email and access codes, such as SMS codes or ID document checks
- Qualified electronic signatures under eIDAS, and remote online notarization
Questions
Security questionnaires and vulnerability reports go to security@tallysign.com.
Are Tally Sign signatures legally binding?
Yes, for business agreements such as order forms, NDAs, SOWs and leases. They're electronic signatures under the U.S. ESIGN Act and state UETA laws, and simple electronic signatures under the EU's eIDAS Regulation. A few documents, such as wills, court documents and anything that must be notarized, need another way to sign.
What if someone says they didn't sign?
The certificate shows the signing link went to their email address, that they agreed to sign electronically, when they opened the document and signed it, the IP address and device they used, and the signature they adopted. If you gave them an access code, it also shows when the code was entered, so opening the document took something sent outside email too. That's the evidence e-signature disputes turn on.
How can I check a signed PDF hasn't been changed?
Drop it on the Verify a document page (/verify). Your browser fingerprints the file without uploading it, and Tally Sign says whether it's the exact signed PDF it produced. The same SHA-256 is in the document's audit trail and in the export of your signed documents, so you can also run shasum -a 256 on a copy (or certutil -hashfile on Windows) and compare.
Do signers need an account?
No. They sign in the browser on a phone, tablet or computer from the link in their email. They can also sign in person on your device, and the certificate records whose device it was. The signing page is built to WCAG 2.2 AA; see the accessibility statement.
Where is our data stored?
In the United States: the app and database in Railway's US West region in California, and files in San Jose. There's no choice of region today.
Do you support multi-factor authentication?
Yes. Two-step sign-in asks for a code from an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password after the password, with 10 single-use recovery codes. Anyone can turn it on, and owners and admins can require it for everyone, including sign-ins with Google, Microsoft and Salesforce. With single sign-on, your identity provider's MFA applies.
Do you have SOC 2?
Not yet. Annex II of the Data Processing Addendum describes the security measures in place and the ones that aren't. Send your questionnaire to security@tallysign.com and we'll answer it.
Can we use it for health information?
No. Tally Sign isn't built for protected health information under HIPAA and doesn't sign business associate agreements, so keep PHI out of documents you send with it.
How do I report a vulnerability?
Email security@tallysign.com. We acknowledge reports within 5 business days. The address is also in /.well-known/security.txt.
Step-by-step guides
Tally Sign Support walks through each part with screenshots of the real product.
- AdminSecurity and your dataWhere your documents are stored, encryption, the audit trail, signer access codes, sign-in options and how long data is kept.Read the guide
- Getting startedSend a document and track itSend for signature in your customer's language, ask for an access code, see who opened and signed it, remind people, download the signed PDF and check a copy later.Read the guide
- Getting startedWhat your customer sees when signingThe signing page from the signer's side: consent, fields, adopting a signature, finishing and their language.Read the guide
- AdminSingle sign-onLet your team sign in through Okta, Microsoft Entra ID, Google Workspace or any SAML 2.0 or OpenID Connect provider, test it, then turn it on or require it.Read the guide