How to prove an e-signed document has not been changed

1. A checksum of the document

A checksum is a fingerprint of a file. The SHA-256 algorithm turns every byte of a PDF into a 64-character value; change one character, one pixel or one byte of metadata and the value changes completely. It is not practical to make a different file with the same SHA-256 value.

Pactivo records the SHA-256 checksum of every document when the envelope is sent, and freezes the document from that point. The checksum is shown on the document’s public verification page. If your copy of the original produces the same value, it is the document that was sent for signature.

2. A hash-chained audit trail

An audit trail is the record of what happened: sent, opened, passcode verified, signed, completed. On its own, a log is only as trustworthy as whoever controls the database. A hash chain fixes that: each event stores a SHA-256 hash covering its own contents and the previous event’s hash. Change, delete or reorder any event and every link after it breaks.

Pactivo’s audit trail is append-only and hash-chained, and the verification page re-checks the chain every time it is opened.

3. A PAdES digital signature on the PDF

PAdES (PDF Advanced Electronic Signatures) is the standard way to embed a digital signature inside a PDF. A PDF reader such as Adobe Acrobat Reader checks it when the file opens and shows, in its signature panel, whether the document has been modified since it was signed.

When an envelope completes, Pactivo seals the finished PDF with a PAdES digital signature. That seal is Pactivo’s, applied over the completed document; it shows the file has not changed since it was sealed. Whether the reader also lists the certificate as trusted depends on the reader’s own list of trusted certificates; the “not modified” check works either way.

4. An RFC 3161 timestamp

A timestamp authority is an independent service that signs a document’s fingerprint together with the current time (the RFC 3161 standard). It proves the document existed in exactly that form at that moment, without relying on the signing platform’s own clock. Pactivo’s sealed PDFs carry an RFC 3161 timestamp, and the verification page shows the timestamp authority and time.

How to check a Pactivo document yourself

1. Find the verification code on the evidence certificate or the completion email.
2. Enter it on the verify a signed document page. You will see whether the audit trail’s hash chain verifies, who signed and when, and each document’s recorded checksum. No account is needed.
3. On the same page, choose your copy of the original PDF. Its SHA-256 checksum is calculated in your browser (the file is not uploaded) and compared with the recorded one.
4. Open the signed PDF in a PDF reader and look at its signature panel for the PAdES seal and timestamp.

Together these show who was asked to sign, how they proved it was them, what they signed, and that none of it has changed since.