Security and the Audit Trail

Docshark's security model is built on one idea: every claim should be checkable. Documents carry access gates, signatures carry a complete event record, and finished agreements are sealed so later changes are detectable.

The audit trail

Every meaningful action lands in a hash-linked event chain:

• Each event, upload, send, open, consent, field completion, signature, decline, reminder, gate acceptance, denied attempt, is recorded with its timestamp, actor, and context.
• Each record links to the previous one by hash. Altering history breaks the chain and is detectable.
• The trail is exportable as audit evidence JSON from any envelope. See exports.

This is what makes a Docshark signature defensible: not the image of a signature, but the recorded path that produced it. Who was sent what, when they saw it, that they consented, and what they signed.

Sealed documents

At completion the document seals: a final PDF that bundles the signed document with its certificate. The seal is integrity-protected. Anyone can check a copy at the verification page to confirm it matches the recorded envelope.

Access protection

The defense-in-depth stack around content:

• Gates, passwords, email verification, allowlists, NDAs, see access controls.
• Watermarking. Viewer identity stamped on every page; overlay or burned in.
• Capture shield, blur on leave, capture-key blocking, spotlight, idle blur, see download controls.
• Instant revocation. Links die immediately on revoke; every denied attempt is logged.

Data protection

• Encryption in transit (TLS) and at rest.
• Viewer IPs and user agents stored as SHA-256 hashes; location derived at country level only.
• Webhook secrets encrypted at rest and shown once.
• See data protection for the full retention and privacy model.

Legal validity

A simple electronic signature, the kind Docshark produces, is legally valid for the overwhelming majority of agreements under ESIGN and UETA in the US and eIDAS in the EU: intent + consent + an audit trail is the legal test, and Docshark records all three. See legal validity for the detail. And note that page is general information, not legal advice.