What the signer sees

An email with a link. What the link's page asks for depends on validationMode: in "sign" mode, a typed name, a drawn stroke, or a preset style, plus a slide-to-confirm gesture and an explicit consent tick — no code. In "email" mode, the same mark options plus a one-time code sent to the signer's own address: six digits, ten minutes, five guesses, and a fresh code resets the guesses. When the last signer (or, in an ordered envelope, the last group) is done, the marks are composited onto the PDF, a certificate of completion is appended — every signer, how each was verified, timestamp, IP address, consent and the full evidence trail — and the finished file is fingerprinted with SHA-256.

The page is hosted by DoConure at a secure public URL; the signer's browser opens it on our domain. It is not embedded in your site, there is no iframe or SDK, and embedding is not promised — it is a possible future evolution, not a plan. Any questions you put on the document (text, checkbox, dropdown) appear on the same page, and a test envelope is stamped TEST on the page, in the signature block and on the certificate.

The page speaks the envelope's language (Italian or English), works on a phone, and works without JavaScript: the signer types their name as the mark and the consent tick is the whole confirmation. A link that stopped working before it was used — the request expired, was revoked, or the signer was replaced — opens a page that says which, in the envelope's language, and nothing else. Times on the certificate of completion are written in your organisation's locale, with the UTC instant beside them. The line printed under each signature (Signed by …) and a date field are in that locale too, the zone named.

Anybody can check a file at /verify by uploading it: the page re-computes the fingerprint and says whether it matches, in Italian or English. A single changed byte does not match — see Check a signed file later.

They can also tell us it should not have been sent

Every signer-facing page and every signature request we send carries a Report this document link to /report. It needs no credential, because the person using it is a stranger who believes they have been sent a fraud — and before it existed their only channel was a WHOIS lookup.

Worth knowing as an integrator, and it is short: a report suspends nothing. It is an anonymous assertion about a paying customer, so it goes into a queue a person reads, alongside whatever reference the reporter happened to have. Nothing the reporter writes reaches you, and we never confirm to them that a reference matched anything of yours. If we ever act on one you hear from a human being, not from an API error.

If a legitimate document of yours is being reported, that is usually worth knowing on its own: it means the covering message did not make clear who was asking and why.

Validation modes in full: Signing on its own. Legal status of the mark and the trail behind it: Signature levels: SES, AES, QES.