The completion certificate
When the last person acts, Refrendo produces the signed PDF, with every value drawn onto the page so nobody can edit a field afterwards, and a separate completion certificate. Everyone who took part is emailed a link to both, unless the sender turned the certificate off. It records:
- the document, your organisation, the sender and the request’s reference;
- each person, their role, what they did (approved, signed, reviewed or witnessed) and when, how they signed, and how they were identified;
- when each person agreed to electronic records, which disclosure they agreed to, and every statement they confirmed, word for word in the language they saw it;
- their approximate location where it’s known, any comment they left, and who received a copy;
- SHA-256 fingerprints of the original document and the completed one.
How people are identified
The certificate says, for each person, how Refrendo knew it was them:
- Secure emailed link: they opened the link sent to their own email address.
- Email verified by code: they started a public form and entered the code sent to their email.
- Signed-in session: a colleague signed in to Refrendo, with two-step verification or a passkey where they use one.
- + access code: added to either of those when the sender asked for an access code and gave it to them by phone or in person.
Refrendo doesn’t check identity documents, and there are no text-message codes.
A chain the database won’t let anyone edit
Every event on a request is recorded: sent, opened, approved, signed, passed on, reminded, downloaded. Each record notes who, when, which version of the document, the method, the IP address, an approximate location and the device. Views and downloads by your own team are recorded the same way as a guest’s.
Each record carries a hash of the one before it, so changing any record later breaks the chain from that point on. The database itself refuses to edit or delete records, and the request page shows whether the chain verifies.
That makes the audit trail tamper-evident: a change made after the fact can be detected. We don’t call it tamper-proof, because nothing is.
Every version kept
A document is never overwritten. A revision is always a new version with its own fingerprint, and each approval stays tied to the version it was given on. Before producing the signed PDF, Refrendo checks that the original is byte for byte the one that was sent.
Files made to be kept
The certificate is PDF/A-2b (ISO 19005-2), the archival standard: every font is inside the file, so it opens and looks the same for as long as it’s kept. The signed document is PDF/A-2b too when the uploaded file allows it, and the certificate’s Signed document format line says whether it is. To accept only PDFs that can be kept that way, an administrator can require PDF/A for the organisation. Business and above
Anyone downloading the signed document or the certificate can take a password-protected copy to share, with a password they choose or one Refrendo makes. The certificate’s fingerprint is of the original file, not the protected copy. More on PDF/A and protected copies.
How long it’s kept
Download the signed PDF and the certificate when the request completes, and keep them with your own records for as long as you need them. Refrendo keeps them too, for at least the period of the plan the sender was on; the pricing page sets it out.