A SHA-256 audit chain for every signature. On every page. Forever.
Every action — upload, send, view, sign, decline, expire — writes an immutable audit row with a SHA-256 hash of the file at that moment. IP, user agent, geolocation, all captured. Completion certificates carry the full chain. Auditors get evidence, not screenshots. Your SOC 2 review takes hours, not weeks.
Trust & Audit
Doc #DOC-7841 · MSA Vandelay
File hash matches at every signing event
WorksBuddy SSO · OAuth 2.0 + PKCE
httpOnly cookie · 5s session check · cross-product logout
Completion Certificate · #CERT-4422
IP, UA, geolocation, full audit chain embedded
Audit log retention · auto-purge 2am
90-day compliance window · cron cleanup verified
Your e-signature tool is a vendor. Your audit is your problem.
Audit response is hours of digging
The auditor asks: who signed contract X, when, from where. You spend the morning in PDF metadata, email headers, and shared-drive timestamps. The proof you produce is "we have a screenshot."
No way to prove a file wasn't altered
Someone claims a clause was changed after signing. You believe them or believe yourself. There's no cryptographic chain that proves the file is identical to what was signed. The dispute settles on which lawyer is more aggressive.
Retention policies live in policy docs, not systems
Your retention policy says audit logs purge at 90 days. The implementation: nobody does. The logs accumulate. The compliance review finds the gap. The next audit calls out missing automation.
Sigi ships compliance as code. Hash chain. SSO. Automated retention.Evidence built in. Not bolted on.
SHA-256 file hash on every audit row
Every state transition writes an audit row that includes a SHA-256 hash of the file at that exact moment. If the file is altered, the chain breaks. If two events have identical hashes, the file is provably unchanged between them. Cryptographic evidence, not procedural claims.
- SHA-256 hash on upload, send, sign, complete
- IP, user agent, geolocation on every signer event
- Completion certificate embeds the full chain
SSO with OAuth 2.0 + PKCE
WorksBuddy SSO with OAuth 2.0 and PKCE flow. JWT minted by Sigi backend, set as an httpOnly cookie — no JS-readable tokens. Cross-product logout via a five-second session check plus BroadcastChannel. Sessions terminate everywhere when terminated anywhere.
- OAuth 2.0 with PKCE for mobile-safe flow
- httpOnly cookies — no token in JS scope
- Cross-product session check + BroadcastChannel
Retention and cleanup as automation
Audit log retention is enforced by a daily cron job that purges rows older than 90 days. The policy isn't a doc — it's code, running on schedule, with the cron schedule itself a deployable artifact. Compliance review checks the code, not the procedure.
- Daily 2am cron purges audit logs older than 90d
- Cloudflare R2 for encrypted file storage
- Public endpoint isolation (sign / approve / acknowledge)
Three things the auditor opens first.
Risk evidence on every contract
AI Risk Detection records every flag it raises into the document_risk_flags table — including the severity, the clause, and the timestamp. When the auditor asks how you screen contracts for risk, you show them the table.
Built-in audit evidence.
The SOC 2 auditor looked at the SHA-256 chain, asked one clarifying question about retention automation, and accepted the evidence on first pass. The review window we'd budgeted six weeks for closed in nine days.
— Head of Security, Regulated SaaS
0
Hash function on every audit row
0
Background jobs running for compliance
0
Audit retention policy (days)
0%
Tamper-evident audit coverage
SOC 2, HIPAA, FINRA, or all three.
SOC 2 Operators
Audit chain, SSO, automated retention. Evidence the auditor accepts. The Trust Services Criteria around CC7 and CC8 map directly to features that already exist.
HIPAA-bound Industries
Encrypted file storage on Cloudflare R2. Tamper-evident chain on every signature. Public endpoints isolated from authenticated endpoints. Retention enforced by automation.
Financial Services
FINRA-grade evidence per signature. SSO and httpOnly cookies for session security. The signing chain stands up to broker-dealer dispute resolution.
Enterprise IT & Security
OAuth 2.0 + PKCE SSO integrates with your IdP. Cross-product session check kills sessions on logout everywhere. JWT in httpOnly cookies — never readable by JavaScript.
What auditors and security leads ask before they approve a new vendor.
How is Sigi different from DocuSign or Adobe Sign?
DocuSign and Adobe Sign route paper. Sigi reads it too. Four AI features run on every document: risk detection on clauses, gap analysis on missing clauses, language suggestions while drafting, and behavior analysis on signers. On top of that, Sigi lives inside the WorksBuddy suite — Lio deals push contracts in, Taro picks up follow-up tasks on stalled docs, Inzo invoices on completion. You get the e-sign primitive plus the AI plus the native automation, in one product.
What workflow types does Sigi support?
How does the AI risk detection actually work?
Is the audit trail actually tamper-evident?
How does the Lio, Taro, and Inzo integration work?
What about signers without a Sigi account?
Pass the audit on first review.
See the SHA-256 audit chain, SSO flow, and automated retention in a 30-minute demo.