E-signature and what it legally means

Docora’s contract signing is a lightweight electronic signature: the client confirms their email, then types their name to accept.

What the client does

1. Opens the public contract link.
2. Reviews the contract.
3. Confirms their email — must match the client email stored on the contract (the address the contract was sent to). Wrong email blocks signing.
4. Reads the notice that typing their name constitutes their electronic signature.
5. Enters their Full legal name.
6. Clicks Sign & Accept.

This is not full login authentication, but it stops a stranger with only the link from signing without knowing the intended client’s email.

What Docora stores (audit trail)

• Signed name
• Confirmed email (the address entered before signing)
• Timestamp (signedAt)
• IP address from the signing request
• Browser user-agent string

This appears on the confirmation and in your dashboard as an audit trail. After signing, the contract status is Signed and content locks. You also receive a Contract signed email immediately with these details.

Security notes

• Public contract tokens are long random hex values from crypto.randomBytes (not sequential IDs).
• The signing API rate-limits attempts (about 5 per hour per IP and per link) to slow email guessing.

Plain-language legal note

This is not a certified or qualified electronic signature product (no digital certificates, no third-party identity verification, no “advanced” eIDAS/SES vendor compliance packaging). It is a practical record that someone who knew the client email typed a name on your contract page at a given time from a given IP and browser.

Whether that is enough for your agreement depends on your jurisdiction, contract type, and counsel’s advice. Docora does not provide legal advice — if you need certified e-sign or wet-ink, use a specialist tool or process alongside (or instead of) Docora contracts.