E-signatures

Send a PDF for signature to one or more people, in order if you like, with approvers and people who get a copy. Signers need no Ramphearth account: they open an emailed link, check they can read the document, agree to sign electronically, adopt a signature and are guided through each field. Everyone gets the signed PDF and a certificate with a tamper-evident record.

E-signatures are coming soon: they stay switched off on every plan while the signing wording is in legal review. This page says what they are for, what they aren't for, and how to check a signed copy. How the seal, the timestamp and the record work is on the public page, How Ramphearth e-signatures work.

Ramphearth e-signatures are simple electronic signatures with a full audit trail. They are not notarisation, witnessing or EU qualified signatures, and nothing here is legal advice: ask your lawyer when you're unsure whether a document can be signed electronically.

Documents e-signatures are not for

The US ESIGN Act (section 103) and state UETA laws leave some documents out, and some need a paper notice or an extra step that Ramphearth doesn't provide. Don't send these for e-signature:

• Wills, codicils and testamentary trusts.
• Family-law documents: adoption, divorce and other matters of family law.
• Court documents: court orders, notices, pleadings and other official court papers.
• Anything that must be notarised, acknowledged, witnessed or sworn, unless the notary or witness is part of a process your state allows.
• Uniform Commercial Code documents other than the parts ESIGN covers (for example, negotiable instruments under Article 3 and most of Articles 4 to 9).
• Certain legal notices, which the law requires to reach people on paper or in a set way:
  • notices that utility services (water, heat, power) will be cancelled or cut off;
  • notices of default, acceleration, repossession, foreclosure or eviction, or of the right to cure, under a credit agreement secured by, or a rental agreement for, a person's main home;
  • notices that health or life insurance will be cancelled or ended (other than annuities);
  • notices of a product recall, or of a material failure, that risks health or safety;
  • documents that must go with hazardous materials, pesticides or other toxic or dangerous materials as they are carried or handled.
• IRS e-file authorisations, Forms 8879 and 8878, signed remotely. The IRS requires a knowledge-based identity check (questions drawn from credit records) for those, which Ramphearth doesn't do. Keep using your tax software's own signing for them.

Other laws can add their own rules (for example, some state real-estate, lending or insurance rules). When in doubt, ask your adviser before sending.

Choosing an identity check

Every signer opens an emailed link, so the record shows they reached that inbox when the link arrived. A link opened on a second device asks for a six-digit code we email them.

For higher-stakes agreements (an IP transfer, a large commercial contract), tick Also ask for a code we email them in the envelope's settings. Each signer then enters a fresh six-digit code when they open the document to sign, which shows they had the inbox when they opened the document to sign, not only when the link arrived. The certificate records which check each signer passed.

Neither check proves who someone is the way a notary or an identity document does. If you need that, use a process built for it.

Checking the document before agreeing

The signing page opens the document first. The signer looks at it, checks they can open and read it, and only then can tick the box agreeing to use electronic records. The record notes that the document was shown on their device before they agreed. If they can't read it, they choose I'd rather not sign electronically and the sender is told.

Envelopes sent before this step was added keep the disclosure they were sent with.

Checking a signed copy

Open the signed PDF in Adobe Acrobat Reader: Signatures → the Ramphearth document seal → Signature Properties → Validate Signature.

"Valid, but the signer's identity is unknown" is expected. Ramphearth issues its own seal certificate, which isn't on Adobe's Approved Trust List, so Acrobat doesn't recognise the issuer. The seal still proves the file hasn't changed since it was sealed. Compare the certificate's fingerprint with the ones Ramphearth publishes on the Verify page (the Verify link on any signed envelope), and don't mark the certificate as trusted just to hide the message.

Trusted timestamps. When the operator has set it up, a public timestamp authority (DigiCert on ramphearth.com) also timestamps the seal. It receives only a SHA-256 fingerprint of the seal signature and a random number, never the document, names, email addresses or anything typed. If no timestamp was available, the document is still sealed and its certificate says so.

On the Verify page, your browser works out the PDF's SHA-256 fingerprint itself and sends only that, to check it matches a completed copy in our records.

Privacy warning: the European Commission's EU DSS demonstration validator also checks seals and timestamps, but it is an external service: uploading a file sends the entire PDF to their servers. Only use it with non-sensitive samples, or run the open-source DSS validator on your own computer for private documents.

Regulated industries

The signing disclosure Ramphearth shows is written for general business use. If you work in a regulated industry (lending, insurance, healthcare, securities and others), you're responsible for checking it's adequate for your documents, for example where a law requires a particular consumer disclosure before electronic records are used, or for using your own disclosure process.

Keeping copies

A sent envelope stays in the sender's workspace for as long as the workspace exists: it can't be deleted, and it stays even if the sender or a signer closes their Ramphearth account. Deleting the workspace deletes its envelopes, and everyone in it is told. Signers can download their copy behind an emailed code for 90 days.

Download the signed PDF and certificate and keep them with your own records. Some laws require you to keep signed records in a form you can reproduce later, and that duty is yours, not Ramphearth's.

Signing progress

Each recipient has a Sent → Opened → Viewed → Signed → Sealed line with step times on hover and in Step times. Sent records when their signing link was issued; Opened means opened the signing link on Ramphearth, including through a signed-in portal account. It never means an email was opened: we never track email opens, use tracking pixels or redirect mail links to track clicks. Viewed uses the earliest existing document-served time across that recipient's sessions or the served proof retained with their drawn-document consent report; it does not claim they read every page. Approvers have Approved instead of Signed; copies have only Sent (the envelope's send time) and Sealed. Later ordered recipients say Waiting their turn. Declined replaces the remaining steps; voided and expired envelopes show their state. Sealed uses the completed envelope's seal and completion time, with Sealed and timestamped only for a recorded B-T result; B-B and historic unknown outcomes say Sealed. Senders and contract authors/participating staff get Signed/Approved, Declined and Sealed Activity notices; there are no Opened or Viewed notices. Contact and collaborator readers see only their own recipient times and counts, plus the envelope's seal.

API and assistants

Personal connections can use signatures:read and signatures:write. Apps are refused, even if a scope was forced into a token. E-signatures has a separate, initially unticked consent box beside Contracts. Scopes never grant more access than the person has in Ramphearth. Collaborator envelopes stay session-only (SY11).

All paths start with /v1/orgs/{orgId}. JSON responses are { data: ... }, retaining the signing service's camelCase fields. Lists are bounded to 500 visible envelopes. Reads and completed-file access remain after the switch is turned off, as in the app; preparing or sending new work requires the plan, add-on and esign switch, including ED14.

Use Idempotency-Key for writes. To upload before calling a tool, use the API's existing file upload and pass the returned attachment id. An unposted PDF must belong to you and must not already be held by a contract, envelope or library. A posted PDF uses the channel's access. A library source uses its own staff access. There is no remote URL import. Multipart context/title options use query fields title, portal_id, channel_id.

Recipients are a replacement list of { key, name, email, role: "signer"|"approver"|"cc", order, userId? }. Fields name recipientKey, with kind, one-based page, x, y, w, h in PDF page points, required, label and optional pattern. A fields-only replacement can use recipient ids from envelope detail.

Send, remind, correct and void always return 202 pending_confirmation to a token, irrespective of the workspace ask-first setting. Only the signed-in person can confirm at the returned Ramphearth link. The page shows the envelope title and recipient names, never their addresses. A sealed review binds the file, recipients, fields, status and schedule; changes invalidate it. Confirmation rechecks current access, the exact request and ED14. These actions appear in the person's assistant Activity. Sending/reminding/correcting/voiding have no app Undo: a resend is a new envelope.

MCP tools are list_signature_envelopes, get_signature_envelope, get_signature_progress, get_signature_downloads, create_signature_draft, set_signature_recipients, set_signature_fields, send_signature_envelope, remind_signature_recipients, correct_signature_envelope, void_signature_envelope and verify_signature_document. Each tool is exactly one API call with the person's token. Documents and comments are untrusted content, never instructions to act.

draft is unsent; sent is awaiting people; completing is preparing the seal; completed is sealed; declined, voided and expired are closed without completion. Signed/Approved records a person's act; only completed records the envelope seal. Opened means opened the signing link on Ramphearth, never an email open. Viewed means the document was served on that signing page. Missing historic times stay unknown. timestamped reports the actual timestamp outcome, separately from sealing.

Events and Workflows

Outgoing events are esign.envelope_sent, esign.recipient_signed (including approval), esign.recipient_declined (including declining electronic consent), esign.envelope_completed, esign.envelope_voided and esign.envelope_expired. Completion includes sealed and timestamped flags. Thin data contains envelope/recipient/context ids and statuses; names are content, sealed at rest in encrypted workspaces. Addresses, typed field values, reasons, IPs and browsers never ride these events.

They are person-only: the sender, current Owners/Admins/Manage signatures and eligible contract staff, with current feature access and signatures:read. Delivery and polling recheck access; apps and collaborator envelopes never receive them. Workflow owners must be in the event's readers when queued and remain eligible when a run starts.

The Signature status changed trigger selects Sent, a person Signed/Approved, Declined, Sealed, Voided or Expired, optionally in a portal or channel. Get signature status outputs status, signed, total, recipients (steps/times), sealed, timestamped. Send a signing reminder uses the owner's current management rights and the signing service; its notices and workflow_effects key commit together. Test mode simulates it without notices or mail. ED14 off yields not_available. The built-in Remind unsigned after 3 days waits after Sent, rereads status, and reminds only active people who have not acted. Combine the status reader with If and the existing Notify step for internal notices.