When a small-business owner sends a contract for signature, a fair question comes up right away: is this actually secure? It is a document with names, terms, and sometimes dollar figures on it, traveling across the internet to someone else's phone. Understanding how e-signature security works helps you make an informed choice -- and it is less mysterious than the marketing language around it suggests.

No system anywhere can promise that a document can never be accessed by anyone. What good e-signature security does is layer several protections so that documents are encrypted while they move and while they sit, the people who touch a document are limited to the ones who should, and any tampering after signing is made evident. This post walks through each layer in plain language, so you know what you are getting and what each piece actually does.

Encryption in Transit (HTTPS/TLS)

The first place a document is exposed is the moment it travels -- from your device to the server, and from the server to your signer's device. This is where encryption in transit does its work.

When you use AddSign, that traffic moves over HTTPS, which relies on TLS (Transport Layer Security). In plain terms, TLS scrambles the data as it leaves one device and unscrambles it only when it arrives at the intended destination. Anyone who intercepts the traffic in between -- on shared office Wi-Fi, at a coffee shop, on a mobile network -- sees encrypted noise rather than the readable contents of your contract.

You have relied on this same technology thousands of times without thinking about it. It is what protects your information when you log into your bank or enter a card number at checkout. The padlock icon in your browser's address bar is the visible sign that TLS is active. E-signature traffic uses the same category of protection so that a document in motion is not readable by a bystander on the network.

What encryption in transit does not do is protect the document once it has arrived and is stored. That is a separate layer, and it is the next one.

Encryption at Rest

After a document reaches the server, it has to be stored somewhere until the signing is finished and afterward, when you want to download the signed copy. Encryption at rest is the protection for a document while it sits on disk.

Encryption at rest means the stored file is kept in an encrypted form rather than as a plain, readable file. If the underlying storage were somehow accessed directly, the contents would appear as scrambled data rather than a legible contract. It is the difference between leaving papers loose on a desk and locking them in a safe -- the safe does not make theft impossible, but it means that getting to the drawer is not the same as getting to the papers.

Together, encryption in transit and encryption at rest cover the two states every document lives in: moving and stored. AddSign uses encryption for both. Neither layer, on its own or combined, makes a document impossible to access under every circumstance -- no honest provider can claim that -- but they raise the bar meaningfully compared with emailing an unprotected PDF back and forth.

The Audit Trail: Who, When, and Where

Encryption protects the contents of a document. The audit trail protects the story around it -- the record of who did what, and when.

Every document signed through AddSign generates an audit trail automatically. It captures the signer's name and email, the timestamps for when the document was sent, viewed, and signed (recorded in UTC to avoid timezone confusion), the IP address the signer connected from, and device information such as the browser and device type. Each action taken on the document is logged in sequence.

This matters for security because it turns a signature into an accountable event rather than an anonymous one. If a signer later says "I never opened that," the audit trail shows the document was delivered to their email and viewed from their IP at a specific time. It is the difference between your word against theirs and a documented sequence of events. We cover this in depth in our guide on why audit trails matter for legal and business documents, and the delivery side of the same record is explained in how proof of delivery works.

The audit trail does not prevent someone from disputing a document -- nothing can stop a person from making a claim. What it does is give you an independent, timestamped record to point to when they do.

The Document-Integrity Hash (SHA-256)

Of all the security layers, the one people find most reassuring once they understand it is the document-integrity hash. It is the piece that makes tampering evident.

When a document is signed through AddSign, the system computes a SHA-256 hash of it. A hash is a long string of characters -- a kind of digital fingerprint -- produced by running the document's exact contents through a fixed mathematical function. The important property is this: if even one character in the document changes afterward, the hash computed from the altered version comes out completely different. There is no way to make a meaningful edit and keep the same fingerprint.

Here is what that buys you in practice. Suppose a signed agreement is stored, and later someone quietly changes a number -- a price, a date, a term. Recomputing the hash on the changed document produces a value that no longer matches the hash recorded at signing time. The mismatch is the evidence. The original terms were fixed at the moment of signing, and any deviation from them becomes detectable.

Notice the precise claim: the hash makes tampering evident, not impossible. It does not lock the file so that no one can ever alter it. What it does is guarantee that if the contents are altered, the alteration cannot hide -- the fingerprint will betray it. For a business owner, that is often exactly the protection that matters: not that a document is untouchable, but that you can tell whether it was touched.

Access Controls: Only the Intended Signers

The final layer is about limiting who can reach a document in the first place. Encryption protects contents, the audit trail records events, the hash catches tampering -- access controls decide who is allowed in.

When you send a document through AddSign, each signer receives a unique signing link tied to that specific document. The link is what routes the intended signer to the document meant for them. Documents are not sitting on a public page waiting to be stumbled upon; a person reaches the signing screen through the link delivered to them. On your side, the signed documents and their audit trails live behind your account login, so retrieving a finished document requires signing in to the account that owns it.

This is the everyday, practical layer of security. Most real-world exposure does not come from someone breaking encryption -- it comes from a document being sent to the wrong place or left somewhere open. Unique links and account-gated access are designed to keep a document flowing to the people who are supposed to see it rather than broadcasting it. As with every other layer, access controls reduce risk rather than eliminating it -- protecting the delivery path is different from a promise that a document can never be reached -- but it closes off the most common everyday openings.

How the Layers Work Together

No single one of these layers is the whole answer, and that is the point. They are meant to overlap:

Encryption in transit keeps the document unreadable while it moves across the network.
Encryption at rest keeps it encrypted while it is stored on the server.
The audit trail records who did what and when, in an independent log.
The SHA-256 hash makes any change to a signed document detectable.
Access controls route each document to its intended signer and keep finished documents behind your login.

Each layer covers a gap the others leave open. Encryption does nothing about a signer disputing that they participated -- the audit trail handles that. The audit trail does nothing about a later edit to the file -- the hash handles that. The hash does nothing about who can open the document -- access controls handle that. Security in a tool like this is not one feature; it is the combination.

And the honest framing throughout is the same: these layers reduce risk and make problems evident, they do not deliver a guarantee. Any provider who tells you their system is completely safe or cannot be accessed is overselling. What AddSign offers is encryption in transit and at rest, an automatic audit trail, document-integrity hashing, and access controls that limit a document to its intended signers -- a stack of practical protections you can understand and reason about.

What This Means for a Small Business

You do not need to become a security expert to make a sound decision. What you need is to know that when you send a document:

It is encrypted while it travels and while it is stored.
Every action on it is logged with a timestamp.
Any tampering after signing can be detected.
Only the signer you sent it to reaches it, and finished copies stay behind your login.

That is a meaningful step up from printing, signing, scanning, and emailing an unprotected file -- where there is no audit trail, no integrity check, and no control over where a forwarded copy ends up. Electronic signatures are generally legally binding under the ESIGN Act and UETA when the usual conditions are met, and the security layers above are what make an electronic record something you can stand behind rather than just a picture pasted onto a PDF.

If you are weighing which plan fits how many documents you send, our pricing page lays out the free and Pro options in plain terms. And if you are ready to try it, you can create a free account and send your first document to see the whole flow -- encryption, audit trail, and all -- for yourself.

The Bottom Line

E-signature security is not a single lock; it is a set of overlapping protections. Encryption in transit and at rest keep the contents of a document unreadable to bystanders while it moves and while it is stored. The audit trail records who signed, when, and from where. The SHA-256 hash makes tampering evident. Access controls keep a document flowing to its intended signer.

None of these promises that a document can never be accessed -- and you should be skeptical of any tool that claims otherwise. What they do, together, is make everyday business document signing measurably more secure and more accountable than the paper-and-scanner alternative most small businesses are still using. Understanding what each layer does is what lets you choose with your eyes open.

This post is for informational purposes only and does not constitute legal advice. Electronic signature laws vary by state and document type. Consult a legal professional to determine whether electronic signatures are appropriate for your specific use case.

Ready to stop chasing paper signatures? AddSign lets you upload, send, and get documents signed in minutes -- with a full audit trail on every document. Free plan available -- no credit card required.

Get Started Free

How E-Signature Encryption Keeps Your Documents Secure