E-sign · 14 min read

How E-Signatures Work: From “Please Sign” to Proof

Sid VarmaOct 20, 2026

At the last company I started, we had five different versions of our NDA in circulation. Which one you had signed depended on when you joined. Our IP assignment agreement covered some employees and not others, and nobody had a list of which was which. An audit exposed it: I spent days chasing signatures across Word documents and an online attestation tool, and one of the missing signatures was mine.

None of those agreements were fake. Lawyers had drafted them, and people had signed them, mostly. What we could not produce was the thing an electronic signature exists to produce: the exact agreement one specific person is bound by, plus proof that nothing in it has changed since they signed.

This post is the plain-language version of how it all works: what a signing request is, why one document produces many separate agreements, which five layers of evidence stand behind a signature, and how a fingerprint made of arithmetic keeps everyone honest. The first half is true of any serious signing tool. The second half is what changes when the signatures live next to the policies they came from. If your company is starting to accumulate NDAs, IP assignments, and countersigned policies, this is the map.

Four signals this is your problem now

More than one version of the same NDA or IP assignment is in circulation, and which one someone signed depends on when they joined.
You’ve got an audit or a dispute coming, and your signed agreements are spread across Word documents, email, and an attestation tool.
People sign NDAs and IP assignments often enough that the paperwork recurs, and each one has to cover the right people.
Someone left recently, and you’re not sure you could produce their signed agreements, unchanged, if a lawyer asked.

Key takeaways

An acknowledgment records that someone read a policy. A signature executes an agreement between two parties. Different jobs, different weight, different evidence.
The unit of electronic signing is the signing request: one request, one approved version, two sides. One NDA sent to 31 employees is 31 separate agreements, not one document with 31 names on it.
A signature that holds up is five layers of evidence holding together: identity, intent, integrity, event trail, retention. A dispute attacks whichever layer is thin.
A file’s hash is its fingerprint. If the stored fingerprint matches the file in front of you, that file has not changed since signing. No trust in the vendor required.

An acknowledgment is a receipt. A signature is an agreement.

An acknowledgment records “I have read and understood this.” A signature does something heavier: it executes an agreement between two parties. The difference sounds academic until a dispute makes it concrete. Nobody sues over whether an employee read the dress code. People absolutely sue over whether the IP assignment binds, and when they do, a lawyer will hold up the signed copy and ask exactly what was signed, by whom, and whether it changed since.

So the employee handbook usually needs acknowledgment or sometimes even a signature depending on the industry you operate in. An NDA, an IP assignment, an employment agreement, a consulting contract: those need signatures. Which document needs which weight is a judgment call for you and your lawyer, and a decent tool lets each document carry its own answer instead of forcing everything through one door.

Most policy tools stop at the receipt. Most signature tools know nothing about the policy behind the paper. Signed agreements fall into the gap between them, which is roughly where my five NDA versions lived.

One document, many agreements: what a signing request is

If you have ever sent a document out to be signed, you have already met the signing request, even if the term never registered. It is the single most useful idea in electronic signing, and once you see it, everything else follows.

Start with the problem it solves. With acknowledgment, one policy produces many receipts, and every receipt points at the same document. With signing, each completed request produces a separate executed agreement. Picture a 31-person company sending its NDA to everyone: Employee A’s signed NDA and Employee B’s signed NDA share a source document and nothing else. They are distinct legal artifacts with different signatures, different dates, and different access rules. A should never be able to open B’s.

The signing request is the unit that keeps this straight: one signature request against one approved version of a document, with two sides. Your company sits on one side, the counterparty on the other, and each side holds one or more signers. Each completed request produces its own signed PDF.

So that one NDA becomes 31 signing requests, each with its own signed result, each tied to one approved version of the source document.

Who signs, and in what order

Real agreements come in four shapes, and a signing model has to express all of them:

One to one. The CEO signs a consulting agreement with one contractor. One signing request, two signatures.
One to many. The company signs, and each of 31 employees countersigns their own copy. One document, 31 signing requests.
Many to one. The CEO and the CFO both sign on the company side, and one vendor signs the other side. One signing request, three signatures.
Many to many. A partnership NDA with two directors on each side. One signing request, four signatures.

Order matters too. Signing can run in parallel, everyone at once, or in sequence, one after another. The order can matter inside a side (the CEO signs before the CFO) and across sides (the company completes before the counterparty is invited). In AllyMatter, you choose parallel or sequential signing when you distribute the document and pick the e-sign option.

What makes an electronic signature hold up?

Picture the challenge that arrives three years from now: a former employee claims they never signed the IP assignment. Whether the signature survives that claim has surprisingly little to do with what the signature looked like. Non-repudiation, the property that someone cannot credibly deny having signed, is not one feature. It is five kinds of evidence holding together, and a challenge aims at whichever one is thin:

Identity. Evidence tying the signature to a person. Verifying a signer by email and a one-time code proves that the person controlling that mailbox, at that moment, signed.
Intent. Proof they knew they were signing and meant to: explicit consent to sign electronically, the attestation they saw, and an affirmative click. Never a pre-ticked box.
Integrity. Proof the document has not changed since signing. This is the hash’s job, and it gets its own section next.
The trail. Sent and signed: each event timestamped, with IP address and device.
Retention. The ability to produce the record years later, intact and readable.

A completion certificate is the usual summary of all five for one signed document: who signed, when, from where, verified how. In AllyMatter, every signer receives the signed document and its completion certificate by email, and Admins see both attached to the policy.

Now the legal part, said carefully. In the United States, electronic signatures are enforceable under the federal ESIGN Act and the state-level UETA, and both laws are deliberately technology neutral: they care about process and evidence, not about any particular vendor or cryptography. The honest claim a well-built system can make is an ESIGN and UETA enforceable electronic signature with a permanent audit trail on the record. Notice what that sentence does not say. It does not say “legally binding” with a period after it, because enforceability is decided in a dispute, by a court, on the strength of the five layers above. A vendor who promises more than that is selling past the truth.

The fingerprint that keeps everyone honest

Hashing sounds like cryptography homework. It is actually the simplest idea in this article.

A hash function is a fingerprint machine for files. Feed it a file and it returns a short string of characters. The same file produces the same fingerprint every single time. Change one comma and the fingerprint changes completely, not slightly. And it only works in one direction: you cannot reconstruct the file from its fingerprint. The standard choice is called SHA-256.

Here is why that matters for signatures. The question a lawyer or an auditor eventually asks is: is this file, today, byte for byte the file that was signed? Without hashes, the answer is “trust us.” With hashes, the answer is arithmetic. A well-built system records the file’s fingerprint at signing time. Years later, anyone holding the file can recompute the fingerprint and compare it against the recorded value. If they match, the file is untouched. If they do not, something changed. No trust in the vendor required, which is the point.

Know what hashing does not do. It proves the file is unchanged. It says nothing about who signed or whether they meant to; those are the identity and intent layers. Hashing is one layer of the stack, never the whole stack, and any pitch that leads with the fingerprint while skipping consent capture has the stack upside down.

How we built signatures into AllyMatter

Everything above is true of any serious signing tool. What follows is what changes when the signatures live in the same system as the policies they come from.

The document decides its own strictness. Every document in AllyMatter carries a type, set at creation: notify, acknowledgment required, or e-signature. The type is a property of the document, not a choice somebody makes at send time, so the strictness travels with the document forever and nobody downgrades an NDA to a casual FYI on a busy Friday.

Only approved versions go out for signature. A signing request is sent against a version that has already been through approval, so what a signer signs is the text your approvers signed off on.

A pending request can be cancelled. If the plan changes before everyone has signed, the signing request can be withdrawn instead of left hanging.

People outside your company can sign too. A contractor, a vendor, a new hire who has not started yet: they can sign, and they receive the e-signed document and its completion certificate by email. They do not see it inside AllyMatter, so one agreement can sit between your CEO and their contractor.

Everything lands where the document lives. The signed PDF and its completion certificate are stored in the document’s Attachments tab, next to the policy it came from, where Admins can see every one. Who viewed and who signed is the document log’s job, and “done” is your auditor’s word to use, not ours.

Signing is built in. AllyMatter’s e-signature is native, an add-on on the Scale plan, so the signed document is stored in the Attachments tab, next to the policy. If your company runs one-off deal paper through a standalone signing tool, that can stay where it is. The pen matters less than where the signed paper lives: the agreement, its evidence, and the document it came from, in one governed place.

Start your 30-day free trial. No credit card to start, and a 30-day money-back guarantee if you convert and change your mind.

Where a standalone e-sign tool is still the right call

Fair is fair. If what you sign is mostly deal paper, sales contracts and one-off vendor agreements, a standalone signature tool is excellent and you do not need us attached to it. Those documents have no audience to manage and no policy behind them. They are transactions, and transaction tools handle them well.

The math changes when the signed thing is a governed document: the NDA every new hire signs, the IP assignment that must cover everyone in engineering, the handbook your counsel wants signatures on, the client-required attestation that renews every year. Now the document has versions, an audience, and an audit in its future, and a signing tool that cannot see any of that leaves you exactly where I was: sure the agreements exist, unable to prove which one binds whom. That is the gap we built for.

Three scenarios

If your company is under about 30 people and signed agreements are occasional one-offs, a standalone e-sign tool and a tidy folder will hold for a while. The discipline is annoying but the volume is survivable.

If you are 30 to 500 people and signed documents recur as part of how you operate (NDAs at onboarding, IP assignments, a countersigned handbook, client attestations), this is the moment. We built AllyMatter for exactly this company.

If you are regulated, multi-site, or client-audited, countersigned proof is already table stakes, and the only question is whether the evidence assembles itself or gets rebuilt by hand before every audit. We’d start with AllyMatter.

Questions people ask about electronic signatures

Are electronic signatures legally valid?
In the United States, yes: the ESIGN Act and UETA make electronic signatures enforceable, and courts apply them routinely. What actually gets tested in a dispute is the evidence: who signed, whether they meant to, whether the document changed afterward, and whether the trail survived. A signature with those layers intact is what can honestly be called an ESIGN and UETA enforceable electronic signature with a permanent audit trail on the record.

What is a signing request in electronic signing?
One signature request against one approved version of a document, with two sides: the company side and the counterparty side, each holding one or more signers. Each completed request produces its own signed PDF. One document sent to 31 people produces 31 signing requests.

What is the difference between an e-signature and an acknowledgment?
An acknowledgment is a receipt: it records that a person read and understood a policy. An e-signature executes an agreement between two parties and is built to survive a legal challenge. Handbooks usually need the receipt; NDAs, IP assignments, and employment agreements need the signature.

Where does the signed document end up?
In the Attachments tab of the document it came from, next to the policy, with its completion certificate, where Admins can see them. Every signer also receives the signed document and the certificate by email. People outside the company do not see it in AllyMatter.

Does the employee handbook need signatures?
Usually not. Acknowledgment is the right weight for most internal policies, and it re-collects cleanly when the policy changes. Some companies’ counsel wants actual signatures on the handbook, and the type is your call, per document. The question to ask your lawyer: would we ever need to enforce this document against a specific person in a dispute?

The days I spent chasing signatures before that audit produced a folder that looked complete and proved nothing. That is the standard most companies unknowingly accept: agreements that exist but cannot be produced, bound to versions nobody can name. The bar is higher, and it is reachable: agreements you can produce on demand, with proof that nothing has changed since the day they were signed.