Electronic Signature Security: Best Practices for Secure Signing

Electronic signatures are safe when two things are true: the platform protects documents and accounts, and your own process doesn't leave gaps around it. In practice that means four layers working together: a secure platform, signer authentication, documents that show any change, and evidence kept for the long run. The ten practices below cover all four.

Most real problems don't come from someone cracking encryption. They come from a hijacked email account, a fake signature request, a shared password, or a re-saved copy that no longer matches what was signed.

Are electronic signatures safe?

Yes, with the right setup. A well-run eSignature process can leave far more evidence than ink on paper: who opened the document, how they proved their identity, when each step happened, and whether the file changed afterward. A paper signature leaves you with a squiggle and, at best, a witness.

The risks are real, though, and they're mostly human:

• Compromised email accounts. If someone controls a signer's inbox, an email link alone won't stop them.
• Fake signature requests. Phishing emails that imitate signing platforms try to steal passwords or push malware.
• Weak sender accounts. A reused password on the account that sends contracts puts every document behind it at risk.
• Loose sharing. Completed documents forwarded around, or stored where anyone can open them.
• Altered copies. A file that was edited, printed and rescanned, or re-exported after signing.

None of these is solved by the platform alone. That's why the practices below mix settings with habits.

What makes an electronic signature secure?

It helps to separate four layers, because each one protects against a different failure:

1. Platform security: encryption in transit and at rest, protected sender accounts, and independently audited security controls.
2. Signer authentication: confirming that the person opening and signing the document is the person it was sent to.
3. Document integrity: a cryptographic seal that shows if anything changed after signing.
4. Evidence: an audit trail and completion certificate that record what happened and stay available if a question comes up later.

A gap in any one layer weakens the others. Strong signer checks don't help much if the sender's account is wide open, and a perfect audit trail is little use if nobody can find it two years later.

What are the best practices for electronic signature security?

1. Turn on two-factor authentication for every sender

The account that sends contracts is the most valuable account in the process. Protect it with two-factor authentication, so a stolen password isn't enough to get in. If you manage a team, require it for everyone rather than leaving it optional, and use single sign-on where your company already manages identities centrally.

2. Match signer authentication to the document's risk

An email link is fine for a routine internal approval. A contract with money, personal data, or a new counterparty deserves more: a passcode shared by phone, a one-time code by text message, or a government ID check with a selfie for people you have never met. Our guide on how electronic signature authentication works explains what each method proves.

3. Make sure documents are encrypted in transit and at rest

Documents should be encrypted while they travel between browsers, apps, and servers, and while they sit in storage. Ask your provider which protocols it uses. Current standards are TLS 1.2 or 1.3 for data in transit and AES-256 for stored data.

4. Keep documents tamper-evident and work from the original file

A digital seal doesn't stop someone from editing a file, but it makes any edit visible: change one character and the seal breaks. That only helps if you keep the sealed original. Printing, rescanning, or re-saving a signed PDF in another editor produces a copy that can no longer prove it is unchanged. File and share the version you downloaded from the signing platform.

5. Save the audit trail and completion certificate with every signed document

The audit trail records who did what and when, including how each signer was verified. The completion certificate packages that evidence into one file. Store both alongside the signed document, because they're what you'll need if anyone ever asks how to verify the signature.

6. Limit who can see completed documents

Signed contracts often hold salaries, bank details, or health information. Share completed documents with the people who need them, through the platform's sharing controls rather than as email attachments, and review shared folders now and then. When someone leaves the team, remove their access the same day.

7. Use expiration dates and cancel requests you no longer need

A signature request that sits open for months is a request someone can still act on. Set an expiration date so requests close automatically, and void any request that was sent to the wrong person or is no longer needed.

8. Teach your team and your signers to spot fake signature requests

Phishing emails often copy the look of signing platforms. The US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission (FTC) point to the same warning signs: urgent pressure to act now, requests for personal or financial information, and email addresses or links that are slightly off.

• Check that the sender's email address and the link destination match the platform and the person you expect.
• Be wary of a request you weren't expecting, especially one that asks you to log in before you can see the document.
• If something feels off, don't click. Contact the sender through a channel you already trust and ask whether they sent it.

Senders can help by telling counterparties to expect a request, and by adding their company's logo and branding to signature emails so legitimate requests are easy to recognize.

9. Choose the signature level the document needs

For most business contracts, a Simple Electronic Signature (SES) with good evidence is enough. Some situations call for an Advanced Electronic Signature (AES), and some documents in the EU and Switzerland require a Qualified Electronic Signature (QES). When the law or the other party asks for a specific level, nothing else substitutes for it.

10. Review your settings and access on a schedule

Security settings drift. Once a quarter, check who has admin rights, whether two-factor authentication is still enforced, which signer checks your templates use, and who can see shared folders. It takes an hour and catches most of the problems that build up quietly.

How can you protect your own electronic signature?

If you're the one signing, a few habits go a long way:

• Don't forward signing links. The link is tied to you. If someone else needs to sign, ask the sender to add them.
• Check before you click. Make sure you were expecting the request and that it comes from someone you know.
• Protect your email account. Turn on two-factor authentication for your inbox, since signing links usually arrive there.
• Keep your own copy. Download the completed document and its completion certificate once everyone has signed.
• Read before you sign. An electronic signature is as binding as you intend it to be. Don't sign anything you haven't reviewed.

How does electronic signature security apply in regulated industries?

Some industries add their own rules on top of general eSignature law. Two come up most often in the US.

Healthcare (HIPAA). The HIPAA Security Rule lists encryption of electronic protected health information as an "addressable" safeguard, which means you must assess it and implement it where reasonable, and document an equivalent alternative if you don't. If a signing platform will handle patient information, you also need a Business Associate Agreement (BAA) with the provider. HIPAA-compliant signing with Sign.Plus is available on the Enterprise plan with Advanced Security Controls enabled and a signed BAA.

Life sciences (FDA 21 CFR Part 11). For records the FDA regulates, Part 11 sets specific signature controls. The signed record must show the signer's printed name, the date and time, and the meaning of the signature, such as review or approval. Signatures must be linked to their records so they can't be copied to another one. Signatures that don't use biometrics need at least two distinct identification components, such as an ID code and a password. If you work under Part 11, confirm with your provider that its system meets these controls before you rely on it.

What should you ask an eSignature provider about security?

Before you trust a platform with your contracts, get clear answers to these questions:

• Which independent certifications and audit reports does it hold, such as ISO/IEC 27001 and SOC 2 Type 2?
• How are documents encrypted in transit and at rest?
• Can you choose where your documents are stored?
• Can you enforce two-factor authentication and single sign-on for your team?
• Which signer authentication options are available, from passcodes to ID checks and qualified signatures?
• Are completed documents sealed so any later change is visible?
• What does the audit trail record, and how long are the audit trail and documents kept?
• How can you control sharing and remove access when people leave?

How does Sign.Plus keep electronic signatures secure?

Sign.Plus is built by Alohi, a Swiss company headquartered in Geneva, and covers all four layers:

• Platform: documents are encrypted with TLS 1.2 or higher (TLS 1.3 supported) in transit and AES-256 at rest, with unique encryption keys per user. Alohi is certified to ISO/IEC 27001:2022 by EY CertifyPoint, has a SOC 2 Type 2 report from EY, and is listed on the CSA STAR Registry. Organizations can require two-factor authentication for every member, and larger teams can use single sign-on and choose from more than 40 data storage locations.
• Signers: recipient verification adds a passcode, an SMS code, or ID Check with a government ID and liveness check, chosen per recipient. Until a recipient passes their check, even the document preview stays hidden.
• Signature levels: Simple signatures are the default, and Advanced and Qualified signatures are available on paid plans. For QES, Swisscom Trust Services, a Swiss qualified trust service provider, verifies the signer's identity and issues the qualified certificate.
• Evidence: a tamper-proof audit trail records every action and every verification step, and the Certificate of Completion collects it in one file. Sign.Plus doesn't put a clock on that evidence: completed documents stay available while you use them, and the audit trail and Certificate of Completion are kept indefinitely. The certificate is kept separate from the signed document by default to protect signers' personal data.

You'll find every certification and policy in the Alohi Trust Center. Ready to put these practices to work? Add recipient verification to your next Sign.Plus signature request.