When you sign a document with SequrSign, we don't just store a copy and hope nothing changes. Every signed document is fingerprinted using SHA-256 cryptographic hashing (via Apache Commons Codec), and that hash is stored alongside the document. If a single byte of the signed PDF is altered afterward, the hash comparison fails, and the tampering is detectable.
That's what "tamper-evident" means in practice: any change to the file after signing is provable, because the stored fingerprint no longer matches the document.
What a hash actually gives you
A SHA-256 hash is a fixed-length value derived from the entire contents of a file. Change anything at all, a digit in a payment amount, a date, one pixel of a scanned logo, and the resulting hash is completely different. It is not a partial match or a close call. It either matches the value recorded at signing or it does not.
The practical consequence is that nobody has to take anyone's word for it. If a counterparty produces a copy of the agreement two years later and you suspect a clause has moved, you do not argue about recollection. You hash their copy and compare it against what was recorded when the document was signed.
The audit trail around it
The fingerprint answers whether the file changed. The audit trail answers who did what and when: when each recipient was sent their link, when they opened it, when they signed, and whether they completed identity verification first. Those two things together are what makes a signed document defensible rather than merely stored.
What this doesn't mean
One thing worth being upfront about: SequrSign does not embed a PKI-based X.509 digital signature inside the PDF itself. That means if you open a SequrSign-signed document in Adobe Acrobat and check its built-in "Signature Panel," Acrobat won't show a validated signature the way it would for a document signed with a Certificate-Authority-issued certificate. Our tamper-evidence works at the application level — through hash verification when you check the document against our records — not at the PDF format level.
If your use case specifically requires PDF-native PKI signatures that validate inside standard PDF readers without checking back with SequrSign, that's a different signing model than what we offer today. For most business signing workflows — contracts, agreements, approvals — hash-based tamper evidence combined with our audit trail is what protects you.
How to tell which one you need
The question to ask is whether anyone in the chain has to validate the document offline, with no access to SequrSign. Some regulated filings and some cross-border submissions require exactly that, and they will specify a certificate issued by a recognised authority. For those, you need a PKI signing product.
For a commercial contract, an offer letter, an NDA or a supplier agreement, the parties involved can verify against the platform that issued the signature, and that is the normal way disputes over these documents get settled anyway. Our Disclaimersets out the platform's position on legal validity in full, and it is worth reading before you standardise on any signing tool. Whether an electronic signature satisfies a specific requirement in a specific jurisdiction is a question for your own counsel.
For the rest of what is in the platform, see what SequrSign does.