Evidence
A verifiable audit trail for contracts an AI agent sends
When an agent sends a contract, the agent's own logs are the weakest possible evidence: whoever ran the agent can edit them. Signathing fixes that by writing every signing event into one public hash chain, sealing each day and archiving the seal with the Internet Archive and on Bitcoin, and publishing a verifier that recomputes everything from a document's evidence package. A second agent, a counterparty or a court can check the result with no account and no trust in anyone.
What goes into the public log
Each event on a document (created, sent, viewed, attached, consented, signed, completed, voided) becomes one entry: a sequence number, a timestamp, the event type, the document's fingerprint, and a hash of the private details. The entry's own hash covers the previous entry's hash, so changing or removing anything breaks every entry after it. The log at signathing.com/transparency is public JSON.
What the log never contains: names, emails, phone numbers, IP addresses, devices or documents. Those live only in the sender's evidence package and in the certificate inside the signed PDF. The hash in the public entry commits to them without revealing them.
What makes it hard to rewrite
At the end of each UTC day the day's last hash is sealed, the day page is captured by the Internet Archive, the head hash is posted from the @Signathing account, and the head is timestamped through OpenTimestamps so a Bitcoin block commits to it. Rewriting history would mean changing the public log, the Internet Archive's copy, the post, the Bitcoin blockchain and every verifier that already ran.
The five checks an agent runs
Hash the original and signed PDFs and compare them to the package. Hash each event's canonical preimage and compare it to its detail hash. Recompute each chain entry from the previous hash, sequence, time, type, fingerprint and detail hash. Fetch each entry from the public log and confirm it is byte-identical, with its neighbours linking to it. Once the day is sealed, confirm the day head against the Internet Archive snapshot and check the OpenTimestamps proof against the Bitcoin block it names.
The verifier script does all five with no dependencies, and the agent loop example runs send, wait, fetch and verify end to end. Both are public domain and both are linked from the developers page and from the evidence package itself.
Why humans skip this and agents will not
People sign, download the PDF and move on; the audit trail only matters in a dispute, years later, when it is too late to have checked. An agent checks at the moment of completion because the check is one call, deterministic and cheap, and because the alternative is asking the next party to trust the agent's word. That is the difference between a signature that lives inside one system and one that anyone can re-verify against a public record.
Common questions
- Do I need a Signathing account to verify a document?
- No. The verifier works from the evidence package and the public log. The package is the sender's to share.
- Does the public log expose my documents or signers?
- No. It holds hashes, timestamps, event types and sequence numbers only.
- What if Signathing disappears?
- The GitHub mirror of the sealed days, the Internet Archive snapshots and the OpenTimestamps proofs exist outside Signathing. A package plus those copies still verifies.
- Is this legal advice?
- No. It is a description of the evidence Signathing produces. Whether a given document is enforceable depends on its content and the law that governs it.
Free, and not the kind of free with a catch
Unlimited documents, up to 25 signers each, certified PDFs on every one. No trial clock and no card to start.
Start signing free