Keeping records — retention and audit trails
Keeping a signed record you can still prove in five years
Signing is the easy part. The part that decides a dispute is whether you can still produce the document, show who signed it, and show that it has not been touched since.
A signed agreement is only as good as the record behind it. Federal law says an electronic record satisfies a retention requirement only if it accurately reflects the information and stays accessible in a reproducible form. In practice that means three things: keep the document, keep the trail of who did what to it, and keep a way to prove the file has not changed.
What the law generally requires
ESIGN §7001(d) sets the federal floor: an electronic record counts as a retained record only if it accurately reflects the information in the original and remains accessible to everyone entitled to it, in a form that can be accurately reproduced later. State UETA provisions say substantially the same thing.
How long you keep it is a separate question, and it comes from your industry rather than from signature law. Employment and payroll records, tax records, healthcare records, and regulated financial records all carry their own retention periods, set by their own agencies and by state law. Signature law tells you what a kept record has to look like; it does not tell you how many years to keep it.
Statutes of limitation matter as much as retention rules. If someone can still sue on a contract years after it ends, the record has to outlive that window, not the project.
What a usable audit trail actually shows
Who was invited, at what address, and when.
When each person opened the document, and from roughly where.
What they agreed to before signing — including consent to sign electronically.
Every completed action, in order, with timestamps that were not typed by a person.
A fingerprint of the finished file, so a copy can be checked against the record without trusting anyone's word.
The trail should be append-only. A log that can be edited proves less than no log at all, because it invites the question of who edited it.
What the export register adds
An audit trail says what happened inside the document. It does not say what happened to the copies that left it — and copies are how documents leak.
XOsign registers every export. A download, a print, an email attachment, a certified letter: each one gets its own serial and a record of who took it, when, and from where. That register is called XOTrace, and it turns "a copy of our agreement is going around" into a question with an answer.
On paid plans every exported copy also carries a concealed mark that survives printing, photocopying, scanning and screenshots, so a page that leaked can be matched back to the export it came from. It is not a stamp across the page, and we do not explain how it works. Free accounts get neither the register nor the mark.
None of this changes what the law requires of you. It changes what you can show: not only that the record is intact, but which copy of it ended up where.
What most agreements include
A records clause saying electronic copies are treated as originals.
A retention obligation — sometimes mutual, sometimes on one side — naming how long records are kept.
An audit or inspection right in commercial deals, letting one side check the other's records under stated conditions.
A notices clause, because when a notice was received is usually a records question.
What XOsign does about it
- Preserves the original file you uploaded, unchanged, next to every version produced from it.
- Records an append-only trail of activity on the document and keeps it with the signed record.
- Fingerprints the finished PDF with SHA-256 and attaches an RFC 3161 trusted timestamp from an independent time authority.
- Publishes a verification page at /verify where anyone holding a copy can check the fingerprint against the record.
- Registers every export in XOTrace — each download, print, email attachment or certified letter gets a serial and a record of who took it, when and from where; on paid plans each copy also carries a concealed mark.
- Keeps the signed record anchored to the original text, including when a translated version was shown alongside it.
What to ask an attorney
- What retention period applies to my documents, and where does it come from?
- How long can someone bring a claim on this kind of agreement in my state?
- Do I have any obligation to produce records in a particular format if I am audited or sued?
- Do my records include anything I am required to protect or delete on request?
Frequently asked questions
Is a PDF in my email good enough?
It is a copy of the document. It is not, by itself, evidence of who signed it or that it has not been edited since. That is what the trail and the fingerprint add.
What does the timestamp prove?
That the file existed in exactly that form at that moment, according to an independent time authority — not according to XOsign and not according to your computer's clock.
How long should we keep signed agreements?
Longer than you expect. The common approach is the life of the agreement plus the longest limitation period that could apply, but the number comes from your industry and your attorney, not from us.
XOsign is not a law firm and this page is not legal advice. It explains, in plain English, what the law generally requires so you can have a better conversation with your own attorney. Laws differ by state and change over time, and only a licensed attorney who knows your situation can tell you what to do about yours.
Look at a real audit trail
Sign the sample document and read the record it produces — the trail, the fingerprint, and the independent timestamp.