How electronic signatures work, and what makes them legally binding

What the major laws actually require

The US ESIGN Act, the EU's eIDAS regulation, and India's IT Act 2000 differ in wording but share the same core idea: an electronic signature is generally valid if the signer intended to sign, consented to sign electronically, and the record reliably associates the signature with that person and shows the document wasn't altered afterward.

None of the three requires a specific technology. A typed name plus a clear consent step and a record of the transaction can meet the bar — the substance is what matters, not the format of the mark itself.

Tiers that DO have extra technical requirements

eIDAS specifically defines higher tiers — 'advanced' and 'qualified' electronic signatures — that add cryptographic identity binding and, for qualified signatures, a certificate from a supervised trust provider. India's IT Act similarly recognises a separate class of 'digital signatures' tied to licensed certifying authorities, distinct from an ordinary electronic signature.

These higher tiers exist for cases — certain government filings, some categories of contract — where the law names a specific requirement. Most everyday business documents (offer letters, NDAs, vendor agreements) don't need them, but it's worth checking the specific requirement for your document type and jurisdiction rather than assuming.

Audit trail vs. cryptographic signature — the distinction that actually matters

An audit trail is a record: who signed, what they typed or drew, when, and from what network address. A cryptographic (PKI-based) digital signature is different — it uses a private key tied to a verified identity to produce a mathematical proof that the exact bytes of the document weren't altered after signing, checkable without trusting the platform that created it.

An audit trail is evidence of a process. A cryptographic signature is proof about the specific bytes. Both can support that a document was legitimately signed, but they demonstrate it in different ways, and some qualified-signature requirements specifically call for the cryptographic kind.

How Mudra's Sign module handles this

Mudra records who signed, when, and from what IP address in an audit trail, and appends a Certificate of Completion page to the finished PDF summarising it. A SHA-256 hash is computed over the finished document and stored, which detects any later change to those exact bytes.

That's an audit record, not a PKI-issued qualified signature — Mudra doesn't hold or claim SOC 2, ISO 27001, or a certifying-authority credential. For everyday agreements this covers what most businesses need; for a document type where your jurisdiction specifically requires a qualified or licensed digital signature, check that requirement before relying on any general-purpose e-signing tool, including this one.

Keep reading