How to Verify an Audit Trail Has Not Been Altered
To verify an audit trail in Inkfree, open the request, scroll to the Audit Trail card and click Verify. Inkfree recomputes the seal on every event and tells you whether any of them has changed. This article explains what is sealed, how to run the check and what each result means.
How Does Inkfree Seal the Audit Trail?
Every event on a sign request is sealed the moment it is recorded. Inkfree computes a keyed cryptographic hash (HMAC-SHA256) over the event's details: what happened, who did it, when, the IP address, the browser and device, and any reason given. Each seal also includes the seal of the event before it, so the events form a hash chain. Change one event, remove it or slip a new one into the middle, and every seal after it stops matching.
The key used to compute the seals is held separately from the database that stores the events, so editing a stored event cannot produce a valid new seal.
This makes the trail tamper-evident: a change cannot be hidden. It is the record behind the audit trail and Certificate of Completion that support an Inkfree signature's legal standing.
How to Run the Check
- Open the request to reach its detail page.
- Scroll to the Audit Trail card. The Tamper-evident trail bar sits at the bottom of the card.
- Click Verify. The button reads Checking… while Inkfree rechecks each event.
- Read the result. To run it again later, click Re-check.
The check only runs when you click, so opening a request never slows down while a long trail is checked.
What Each Result Means
- Integrity verified: every event still matches its seal. The line beneath shows how many events were checked and when sealing began, for example "12 events unchanged". Hover the icon to see the trail's final fingerprint, the seal of the latest event.
- Trail altered: at least one event no longer matches. The line beneath names the problem, such as "Event 4 no longer matches its seal" or "An event was added outside the sealed trail". Note the request ID and contact support.
- Not sealed: the events were recorded before tamper protection was turned on, so there is nothing to check yet. Older requests are sealed as they receive new activity, and the sealing date shown is when that happened, not when the original events took place.
The Seal on the Certificate of Completion
The Certificate of Completion produced when a request completes carries the same check. Its Integrity line reads "Verified" with the number of events, and it prints the trail's Final hash, the fingerprint of the trail as it stood when the certificate was issued. Keep the certificate with the signed document: if anyone later questions the record, the final hash shows what the trail contained at completion.
A later fingerprint on the request page can differ from the certificate's final hash without anything being wrong. Actions after completion, such as sharing or transferring the document, are added to the same chain, so the latest fingerprint moves on while the certificate keeps the value it was issued with.
Who Can Verify a Trail?
Members of your account who can open the request and have permission to view audit trails see the Verify button. If a teammate cannot see it, an admin can grant audit access in their role's permissions. Signers do not see the check; it is available to the sending account only.
Tip: Run the check before you send a signed agreement and its certificate to a lawyer, auditor or opposing party. A fresh "Integrity verified" result is a quick, documented answer to "has this record been changed?"