Audit trail and sealed PDFs · Autessa Document Signing
PAdES digital signatures
Autessa embeds every signer’s signature in the PDF as a PAdES-B-T digital signature: CMS SignedData plus an RFC 3161 trusted timestamp, keyed to an ephemeral per-signer certificate. Signatures accumulate, each covering everything before it, so any change after signing is detectable in any standard PDF reader, not only in Autessa.
The problem it solves
A picture of a signature proves nothing
Many e-signature PDFs are just images stamped onto pages; the proof lives on the vendor’s servers. If the vendor is gone or the file is opened elsewhere, the document cannot speak for itself. PAdES puts the proof inside the PDF, using the PDF Advanced Electronic Signatures standard.
What you get
- Each signer’s submission stamps their fields and embeds a PAdES-B-T advanced electronic signature.
- Each signature includes an RFC 3161 trusted timestamp.
- Each signer gets an ephemeral per-signer certificate.
- Signatures are applied as incremental updates, so each one covers everything before it.
- The canonical document every signature is computed over is the PDF with your prefilled content flattened in.
- SHA-256 hashes of the original, prefilled and sealed versions are kept on the envelope.
- Any change after signing shows up in any standard PDF reader’s signature panel.
How it works
PAdES digital signatures, step by step
Prefill
At send, static content is flattened into the PDF. These bytes are the canonical document.
Per-signer signing
Each signer’s fields are stamped and a PAdES-B-T signature with an RFC 3161 timestamp is embedded.
Accumulate
The next signature covers the document plus every signature before it.
Finalize
When the last signer is done, a Certificate of Completion is appended and the sealed PDF is stored.
Every option
What is inside a sealed PDF
| Option | What it does |
|---|---|
| Signature format | PAdES-B-T: CMS SignedData plus an RFC 3161 trusted timestamp. |
| Signing certificate | Ephemeral, per signer. |
| Coverage | Each signature covers everything before it. |
| Hashes kept | SHA-256 of the original, prefilled and sealed PDFs. |
| Final page | Certificate of Completion. |
| Verification | Any standard PDF reader’s signature panel. |
Permissions
Who can do what?
| Who | Can |
|---|---|
| READ | View the envelope and its audit trail; download the in-progress copy or sealed PDF. |
| PUBLISH | Also direct links, reminders, resend, void and mark as executed. |
| ADMIN (and the owner) | Also share, unshare, transfer ownership and delete eligible envelopes. |
| Signer | Generates their own events (viewed, signed, delegated, rejected) but never sees the sender’s workspace. |
FAQ
PAdES digital signatures: questions and answers
Are Autessa signatures digital signatures or images?
Both. The signer’s drawn, typed or uploaded mark appears on the page, and a PAdES-B-T digital signature with an RFC 3161 timestamp is embedded in the PDF for each signer.
Can I verify a signed PDF without Autessa?
Yes. Open it in any standard PDF reader and check the signature panel. A change after signing is detectable there.
What is PAdES?
PAdES (PDF Advanced Electronic Signatures) is the standard for embedding advanced electronic signatures in PDF files. The B-T level adds a trusted timestamp.
100% customizable, code and all
Make Autessa Document Signing fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours