LegalNerds Electronic Signatures

The Electronic Signatures in Global and National Commerce Act (ESIGN), enacted in 2000 and codified at 15 U.S.C. § 7001 et seq., establishes the legal equivalence of electronic signatures and handwritten signatures across the United States. ESIGN coverage is broad: it applies to commercial and consumer transactions in interstate or foreign commerce, which captures the vast majority of legal agreements customers sign through LegalNerds.

ESIGN does not simply assume any electronic mark is valid. It imposes specific requirements on the signing process: the signer must affirmatively consent to electronic records, demonstrate intent to sign, have access to retain a copy, and the signed record must be tamper-evident. Compliance with these requirements is what gives an electronic signature the same legal weight as a handwritten one in court, before regulators, and across state lines.

Most state laws also recognize electronic signatures via the Uniform Electronic Transactions Act (UETA), adopted in 47 states plus the District of Columbia. Federal ESIGN preempts where state law conflicts, but UETA generally tracks ESIGN's substantive requirements. LegalNerds is designed to satisfy both.

ESIGN is built around six core requirements. Each is addressed by a specific design decision in the LegalNerds signature pipeline.

The cornerstone of legal weight in an electronic signature is integrity: the signed record must be impossible to alter without detection. Without verifiable integrity, an electronic signature is no stronger than a typed name in an email. LegalNerds achieves cryptographic integrity using SHA-256 hashing, the same algorithm used by banks, certificate authorities, and major signing platforms (DocuSign, Adobe Sign).

A cryptographic hash function takes an input of any length and produces a fixed-size fingerprint — for SHA-256, a 64-character hexadecimal string. Two important properties: changing even a single byte of the input produces an entirely different hash, and the hash cannot feasibly be reversed to forge a matching document. SHA-256 hashes are not currently considered breakable with any known computational technique.

When a signing request is created, the source PDF is hashed and the hash is stored in the signing request record. Before each signature is embedded, LegalNerds re-hashes the current document and compares it against the stored hash. If they do not match, the embedding aborts, an audit-log entry records the failure with expected and actual hashes side by side, and no signature is captured. The signer sees a tamper-evidence error message; the customer is notified.

For multi-signer documents, signatures form a chain. The first signer's mark is embedded in the canonical PDF; the second signer's mark is embedded in the first-signed PDF; and so forth. Each step is hashed and the hash recorded in the signing request's metadata. The audit certificate lists the source hash and the latest signed-document hash; anyone reviewing a finished signed PDF can recompute its SHA-256 hash and verify it matches the value on the certificate. Modification after the fact is detectable in seconds without specialized tools.

A tampered document does not merely lose its signature — it loses its evidentiary value entirely. Courts and regulators routinely admit hash-based integrity proofs as evidence of authenticity. The chain hash is the cryptographic equivalent of a sealed, numbered envelope: opening it changes the seal in a way nobody can reverse.

Every step of the signing flow is recorded in an append-only audit log. The log is designed for forensic completeness: each event captures who acted, when, from what network address, with what client software, and what specifically happened. The following events are recorded automatically:

• request_created — customer creates the signing request
• request_sent — invitation email dispatched to a recipient
• document_viewed — recipient opens the signing link
• consent_acknowledged — recipient checks the consent box (with disclosure version)
• intent_confirmed — recipient affirms intent to sign (with intent text version)
• second_factor_verified — recipient completes SMS one-time-passcode verification (Tier-2 instruments; see below)
• signature_captured — recipient submits a signature image
• signature_embedded — image is embedded into the PDF; signed-PDF hash recorded
• request_completed — all signers complete; final hash recorded
• request_voided — customer cancels the request
• request_declined — recipient declines to sign
• envelope_converted — a self-signed request is converted to a multi-party envelope

Each entry includes a server-side timestamp, the actor's email or user ID, the source IP address (from the request headers, with proxy-aware fallback), a coarse location label derived from the network address, the user agent string, and event-specific data. Audit log entries are append-only at the schema level: database triggers refuse UPDATE and DELETE outright — not merely by application convention — and the log's foreign keys are set so audit history survives even if a parent signing request is removed. Altering the audit log would require a database administrator to disable those triggers, an action that is itself logged.

When a signing request completes, LegalNerds automatically generates a printable PDF audit certificate listing each signer's identity, signing method (typed-cursive vs hand-drawn), IP address, approximate location, user agent, consent and intent timestamps with disclosure versions, any second-factor identity verification (the identity tier and a masked record such as "email + SMS to ***-1234"), the embedded signature image, the cryptographic hash chain, and a chronological event timeline. The certificate is attached to the completion email alongside the signed PDF, is downloadable on demand from the customer dashboard, and can be retrieved by each signer from their own signing link.

Audit records are retained as durably as the signed record they document — they are append-only and non-deletable (see Record retention above). They are not expired on a timer today; a configurable per-tier retention schedule is a planned future feature. For legal proceedings or regulatory inquiries, contact LegalNerds support at support@legalnerds.com.

LegalNerds achieves ESIGN compliance and is appropriate for the overwhelming majority of contracts, agreements, and consents customers handle through the platform. There are categories of documents where electronic signatures are not legally sufficient on their own, and customers should be aware. Honest disclosure of platform limits is a value commitment: better to defer one signing request to a notary than to ship a record that fails in court.

• Notarization-required documents. Wills (in most states), deeds of trust, certain affidavits, and some real estate closing documents require notarization — a sworn act before a notary public, not merely a signature. ESIGN explicitly excludes notarization-required records from its coverage at § 7003(a)(1). LegalNerds does not provide notarization. For these documents, sign in front of a notary in person or use a Remote Online Notarization service.
• Identity assurance — what we do, and what we don't. For most documents, signer identity rests on control of the email address the signing link is sent to. For the highest-stakes instrument classes — prenuptial and postnuptial agreements, merger and acquisition instruments, and settlement agreements — LegalNerds steps identity up to a second factor: the signer must verify a one-time passcode texted to their phone before signing, and the certificate records it ("email + SMS to ***-1234"). What we do not offer is Knowledge-Based Authentication (KBA) — dynamic identity questions drawn from credit-bureau records, standard for residential mortgage signings — or documentary government-ID verification. Transactions that require KBA or ID-document verification should use a service that provides them; the party sending the request remains responsible for identity assurance beyond the tiers above.
• Remote Online Notarization (RON). Many states have enacted RON statutes permitting notarization via secure video conference, generally requiring KBA, identity-document scanning, tamper-evident audio-video recording, and a commissioned remote notary. LegalNerds is not a RON platform. For RON-required documents, use a state-licensed RON service.
• Court filings under specific state rules. Some state courts require pleadings and motions to be signed in a particular electronic format (often a state-managed e-filing portal with its own signature mechanism). LegalNerds-generated signed PDFs are not a substitute for that workflow; they may be acceptable as exhibits but not as the filing document itself.
• UCC Article 3 negotiable instruments. ESIGN explicitly excludes negotiable instruments (checks, promissory notes governed by UCC Article 3) from its coverage at § 7003(a)(2). Electronic signatures on these documents are governed by separate regimes; consult an attorney before relying on a LegalNerds signature for an instrument intended to be negotiable.

For documents that fall into one of these categories, customers should consult a licensed attorney before using LegalNerds for the signing step. The platform is designed to be honest about scope: when in doubt, the matter intake will surface concerns about whether electronic signing is appropriate for the matter type.

The Uniform Electronic Transactions Act (UETA) is adopted in 47 states plus the District of Columbia. UETA was promulgated by the Uniform Law Commission in 1999, a year before ESIGN, and was designed as a state-level analog. UETA generally tracks ESIGN's substantive requirements: legal equivalence of electronic and handwritten signatures, consumer consent, intent to sign, association, and integrity. Most states adopted UETA with minimal variation.

Three states are notable exceptions. New York enacted the Electronic Signatures and Records Act (ESRA) rather than UETA; it tracks UETA in most respects but applies differently to government records and certain consumer transactions. Illinois enacted its own Electronic Commerce Security Act, which predates UETA and contains definitional differences. Washington adopted UETA but layered additional consumer protection requirements on top.

Federal ESIGN preempts state law where state law would deny legal effect to an electronic signature solely because it is electronic. The preemption is narrow: ESIGN respects a state's authority to specify the manner of signing for state-specific records (state tax filings, state-court pleadings, certain trust and estate instruments). Where state-specific requirements apply, ESIGN does not override them.

Customers transacting across state lines or with parties in New York, Illinois, or Washington — or in any state-specific filing context — should consult an attorney for state-specific compliance questions. LegalNerds intake includes a state field for matters that turn on state-specific law; the platform will flag matter types where electronic signatures are not the preferred path under state law.

• ESIGN Act — Pub. L. No. 106-229, codified at 15 U.S.C. § 7001 et seq.
• Uniform Electronic Transactions Act (UETA) — Uniform Law Commission, 1999; adopted in 47 states + DC.
• Cryptographic hash function: SHA-256 (NIST FIPS 180-4).
• Sample audit certificate available on request to support@legalnerds.com.