How Long Does an E-Signature Audit Trail Need to Be Kept?

Keep the audit trail for as long as you have to keep the document it belongs to, then a little longer. That's the whole rule. The rest of this post works out what that means for client contracts, leases, change orders, releases and the occasional employment agreement.

What the federal e-sign law says about keeping records

The ESIGN Act doesn't set a retention period of its own. It tells you how an electronic copy satisfies a retention rule written somewhere else. If a statute or regulation requires a contract or record to be retained, that requirement is met by an electronic record that accurately reflects the information in the contract and remains accessible to everyone entitled to it, for the period the rule requires, in a form that can be accurately reproduced later by printing or transmission. A rule that demands the original is satisfied the same way.

Read that twice. It cuts both ways. Where a record is required to be in writing, the electronic version can be denied legal effect if it isn't in a form that the people entitled to keep it can retain and accurately reproduce. A signed PDF stranded in a vendor account you stopped paying for is exposed on exactly that point.

There is one small carve-out. Information whose only purpose was to send or receive the record doesn't have to be kept. Routing details can go. The signature events, the signer identity details and the document hash aren't routing details. They stay with the file.

Why the trail and the document share one shelf life

The clearest statement of the principle sits in the FDA's electronic records rule, 21 CFR Part 11. Firms under that rule have to use secure, computer-generated, time-stamped audit trails that record when operators create, modify or delete electronic records, and that audit trail documentation must be retained for a period at least as long as the subject electronic records. The records themselves have to be protected so they can be retrieved accurately and promptly throughout the retention period.

The logic travels well beyond drug makers. An audit trail that outlives its document is harmless. A document that outlives its audit trail has lost the part that proves who signed it and when. So the trail's minimum is always the document's minimum.

In practice that means downloading the completion certificate alongside the signed PDF every time something finishes, and storing the two together in a folder you back up. A completed envelope that lives only inside the signing platform depends on that platform, your login and your subscription all surviving the whole period. Export on the day the last signature lands. With a hash-chained trail like the one on every Vouch plan, the exported certificate can be checked against the exported PDF years later without logging in anywhere. The plan comparison covers which tools include that export on a free plan.

Tax records set the floor for most small businesses

For a signed contract that supports income or a deduction, the IRS period of limitations is the number to start from. Keep records for 3 years in the ordinary case. The clock stretches to 6 years if you left out income that is more than 25 percent of the gross income shown on the return, and to 7 years for a claim involving worthless securities or a bad debt deduction. Employment tax records run at least 4 years after the tax becomes due or is paid, whichever is later. If you never filed a return, or filed a fraudulent one, the IRS says to keep the records indefinitely.

Property is the big exception. Records connected to property should be kept until the period of limitations expires for the year you dispose of the property. For a landlord, the purchase contract, the signed lease history and any signed contractor agreement for a roof or a furnace stay on file for as long as you own the building, then through the limitations period for the year you sell.

The IRS also says that when records are no longer needed for tax purposes, you shouldn't discard them until you've checked whether someone else, such as your insurance company or a creditor, requires you to keep them longer.

Retention rules that come with specific paperwork

Some documents carry their own retention period. These tend to run longer than people guess.

Landlords and property managers renting housing built before 1978 have to keep the completed lead disclosure attachment, or the lease that contains the disclosure, for no less than 3 years from the start of the leasing period. That disclosure has to carry the signatures of the lessor, any agent and the lessee, along with the dates of signature. If you e-sign your leases, the audit trail is what shows those dates were real.

Anyone with employees keeps payroll records and written employment contracts for at least 3 years under the federal wage and hour rules at 29 CFR 516.5. Trades with workplace exposure records are in a different league: each employee exposure record is kept for at least 30 years, and employee medical records for the duration of employment plus 30 years.

Health practices that handle protected health information keep their HIPAA security policies and related documentation for 6 years from the date of creation or the date the document was last in effect, whichever is later. Lenders retain credit applications and the information used to decide them for 25 months after notifying the applicant of the action taken, or 12 months for business credit.

If a signed document contains consumer report information, the FTC's disposal rule governs the day you finally let it go. Anyone who holds consumer information for a business purpose must dispose of it by taking reasonable measures against unauthorized access, and the rule names burning, pulverizing or shredding paper as examples. For a PDF and its certificate, the equivalent is deleting the file from live storage and from the backups.

A retention schedule you can write on one page

Open a spreadsheet with 4 columns: document type, the rule that drives its period, how long you keep it, and where the signed PDF and its certificate live. Most solo businesses end up with 6 to 10 rows.

A wedding photographer's rows might read: client service agreements, tax, 3 years after the return for the year of the shoot, cloud folder by year. Model releases get their own row and a much longer period, because the release matters for as long as you publish the image.

A remodeling contractor adds rows for signed proposals, change orders and lien waivers. The tax floor still applies, but a 5-year workmanship warranty is a reason to hold the signed scope for at least 5 years, since the signed change order is what settles an argument about what was in and out of the work. Our post on how long signing itself takes covers the front end of that same paperwork.

A landlord's rows start with the lease and lead disclosure, then move-in inspection forms, notices and renewals. Date each row from the end of the tenancy rather than the start. A dispute over a deposit or a repair arrives after the tenant leaves, not before.

Then pick one day a year to purge. Pull everything whose period has run, confirm nothing on the list is tied to an open claim or an open tax year, and delete the PDF and certificate together.

Questions people ask

Does the audit trail have to stay inside the signing platform? No. Federal law treats an electronic record as meeting a retention requirement when it accurately reflects the document and stays accessible and reproducible for the required period. An exported PDF plus its certificate in your own backed-up storage meets that as well as a vendor dashboard does.

What happens if the signing vendor shuts down? If you exported the signed PDF and the completion certificate when the document finished, nothing changes. If you didn't, you have a document and no proof of who signed it.

Is three years long enough to keep a signed lease? Three years from the start of the tenancy is the federal minimum for a lease with a lead disclosure in pre-1978 housing. Records tied to property run until the limitations period ends for the year you sell. Treat 3 years as the floor.

Can I shred the paper once I have the electronic copy? Where a rule requires a record or an original to be kept, an electronic record that accurately reflects it and can be reproduced later satisfies that requirement. Keep the electronic version complete, including the certificate, and the paper can go.

You can try this on your own documents at https://vouch.ink/. Every plan, including free, includes the full audit trail. Compare plans at https://vouch.ink/pricing.