In the United States the ESIGN Act (15 U.S.C. §7001 et seq.) and the Uniform Electronic Transactions Act (UETA), as adopted by the states including Arizona (A.R.S. §44-7001 et seq.), provide that a signature, contract or record may not be denied legal effect solely because it is in electronic form, where the parties have consented to transact electronically. Article 25(1) of EU Regulation 910/2014 (eIDAS) states the equivalent principle for the European Union.
DBX Sign is built to those requirements: it obtains and records each signer's affirmative consent to transact electronically before any document is shown, captures the signer's act of signing, and produces a retainable, tamper-evident record that every party can obtain a copy of. What follows below is a description of what the service actually does — the consent flow, the evidence captured, and the integrity protections — so that you and your advisers can judge it for yourselves.
What we do not claim. We do not warrant that any particular signature, document or transaction is legally valid, enforceable, or admissible. That depends on your document, your jurisdiction, your industry and your counterparties, and it is not something any signing platform can determine for you. DBX Sign is not a Qualified Trust Service Provider, issues no qualified certificates and uses no qualified timestamps, so its signatures are not Qualified Electronic Signatures (QES) under eIDAS Articles 28–34, and we make no Advanced Electronic Signature claim under Article 26. DBX Sign is not a law firm and provides no legal advice.
Some documents cannot be signed electronically, or carry formalities that an electronic signature does not satisfy. Wills, trusts, court orders, many family-law instruments and certain real-property and probate documents are common examples, and some regulators impose their own requirements on top of the general law. Lists like that one are illustrative and change — they are not a safe harbour.
You are responsible for deciding whether a document is appropriate for electronic signature, whether your transaction involves a consumer and what that requires of you, and how long you must retain the executed record. DBX Sign does not make those determinations and is not a party to any document you send. Where the law requires a notarial act, a witness, a qualified signature or wet ink, use the required formality. If you are unsure, ask your own attorney — not us.
Every envelope produces a Certificate of Completion recording: envelope ID; SHA-256 fingerprint of each original document and the sealed executed file; each signer's consent to electronic business (with the exact disclosure version they saw, by hash), authentication method, adoption of signature, signing timestamp (UTC), and IP address; and the complete event history. The event history is hash-chained — each entry's SHA-256 incorporates the previous entry — so alteration of any past event is mathematically detectable. Completed envelopes cannot be modified, re-signed, or deleted. The sealed PDF additionally carries an embedded PAdES digital signature (DBX Sign Document Seal certificate): any modification after sealing is flagged by standard PDF readers and cryptographic validation, making the executed document self-verifying independent of this service.
Before viewing any document, each signer is shown the Electronic Records and Signatures Disclosure covering: scope of consent (this envelope only); the right to paper copies at no charge; the right to withdraw consent before signing and the consequences of withdrawal; how to update contact information; hardware and software requirements; and record retention. Consent requires an affirmative act (checkbox plus button), and reading the disclosure electronically reasonably demonstrates the signer's ability to access electronic records. Signers may decline, which halts the envelope and notifies the sender.
Signing links are unique 256-bit single-purpose tokens; senders may additionally require a per-signer access code (stored only as a bcrypt hash) conveyed outside email. Passwords are bcrypt-hashed; credential endpoints are rate-limited; sessions are HttpOnly/Secure cookies. All traffic is TLS via Cloudflare; the origin enforces HSTS, a content-security policy, frame-ancestors 'none' (no embedding), and nosniff. Uploads are validated by type, content signature, size, and page count. Application data lives on a private server with nightly encrypted-transport backups; documents are never shared with third parties beyond the envelope's own participants and the operator's email provider for delivery.
Executed documents, certificates, and audit trails are retained so every party can obtain accurate copies (ESIGN §7001(d)); signers keep permanent access through their signing link and receive the executed PDF by email on completion. Paper copies are available from the sender at no charge. To request deletion of an unsent draft or raise any records question, contact the sender of your envelope.