Guide · Legal

E-signatures for law firms
and legal teams

Automate NDA signing, client engagement, settlement agreements, and retainer contracts. Every completed document is sealed with a PKCS#7 digital signature and backed by a hash-chained audit trail — built for legal defensibility.

Document types legal teams sign with GetSigned

NDAs and confidentiality agreements

Automate bilateral and mutual NDA flows. Sequential routing ensures Party A signs before Party B receives their link.

Client engagement letters

Onboard new clients without chasing paper. Send engagement letters as part of the intake flow and receive signed copies automatically.

Fee agreements and retainer contracts

Collect signed fee agreements before work begins. Completion webhooks trigger invoice creation in your billing system.

Settlement agreements

Multi-party settlements with sequential or parallel routing. Every party gets a sealed, tamper-evident copy on completion.

Corporate resolutions and authorizations

Board and officer resolutions requiring multiple authorized signatories. Mixed routing groups handle parallel approvers at each tier.

Vendor and supplier agreements

Standardize vendor onboarding with reusable templates. One template covers all vendor agreements — only the signer details change per request.

Why GetSigned signatures hold up

Legal defensibility requires more than a "sign here" button. GetSigned captures the full chain of evidence — identity, intent, document integrity — in a format that survives scrutiny.

PIPEDA (Canada)

Electronic signatures are recognized under the federal Personal Information Protection and Electronic Documents Act and provincial e-commerce legislation.

ESIGN Act (US)

The Electronic Signatures in Global and National Commerce Act gives e-signatures the same legal weight as wet signatures for most commercial contracts.

UETA (US States)

The Uniform Electronic Transactions Act, adopted in 49 states, provides state-level recognition for electronic contracts and signatures.

PKCS#7 digital seal

Every completed document is sealed with a CA-issued PKCS#7 digital signature. Any byte-level modification invalidates the seal — verifiable in any PDF reader.

Hash-chained audit log

Every event — view, consent, OTP verification, signature, seal — is appended to an append-only, hash-chained audit log. Tampering with any row breaks the chain.

IP + timestamp + consent capture

Each signer's IP address, user agent, geolocation, and explicit e-sign consent click are recorded and included in the audit certificate page of the sealed document.

Every sealed document includes an audit certificate page

The final page of every completed document is a machine-generated audit certificate listing every event in the signing workflow: when the document was viewed, when consent was given, the OTP verification timestamp, the signature event with IP and user agent, and the sealing event with document hashes (SHA-256 of the original and the final sealed PDF). The certificate is burned into the PDF before the PKCS#7 seal is applied — so it can't be removed without invalidating the seal.

Read the audit trail guide →

Frequently asked questions

Are e-signatures legally valid for law firm documents?

Yes, for the vast majority of legal documents. E-signatures are valid under Canada's PIPEDA, the US ESIGN Act, and UETA (adopted in 49 states) for NDAs, engagement letters, retainer agreements, settlement agreements, and most commercial contracts. Exceptions include wills, powers of attorney in some jurisdictions, certain real estate deeds, and court filings — check your jurisdiction's specific requirements for those document types.

What makes a GetSigned e-signature legally defensible?

Three elements: (1) signer identity verification via email or SMS OTP before signing; (2) an explicit e-sign consent click that is recorded in the audit log with IP, timestamp, and user agent; and (3) a hash-chained, append-only audit trail attached as a certificate page to the sealed document. The sealed PDF is protected by a CA-issued PKCS#7 digital signature — any byte-level alteration is detectable by any PDF reader. This is sufficient for PIPEDA and ESIGN/UETA defensibility.

Can we use e-signatures for NDAs with confidentiality requirements?

Yes. GetSigned is designed for exactly this. Documents are stored encrypted at rest and in transit. Access is scoped by tenant — no other customer can see your documents. The sealed PDF and its audit trail are available only to your application. If you need additional data handling terms for highly sensitive matters, contact us for a DPA or BAA.

How do we handle multi-party contracts where all parties need to sign before any sees the other's signature?

Use parallel routing (set routing_order to the same value for all signers). All parties receive their signing links simultaneously and sign independently. The document is sealed only when all have signed — no party can see intermediate state through the API or document itself.

Can we white-label the signing page with our firm's branding?

The signing page shows "Powered by [Brand]" where Brand resolves from your application's branding configuration. Full white-labelling — removing the Powered-by credit and showing only your firm's branding — is available on the Enterprise plan.

How long are signed documents retained?

Retention is configurable per tenant — the default is 7 years, which covers most legal document retention requirements. You can configure shorter or longer periods. On retention expiry, the PDF blob is purged but the audit trail tombstone (hashes + event metadata) is retained permanently so the document's authenticity can still be verified without the file.

This page is for informational purposes only and does not constitute legal advice. Consult qualified legal counsel regarding jurisdiction-specific requirements for electronic signatures and document retention.

Related: E-signature legality guide · Audit trail guide · Multi-signer routing · E-signatures for HR

Start signing legal documents today

Free tier includes 25 envelopes per month. Full API access, PKCS#7 sealing, and audit trails from day one.

Get free API keys →