How mndok proves who signed what, and when

1. Consent to sign electronically

Before anyone can sign, they read and accept an electronic signature disclosure. mndok stores the time, IP address and browser of that acceptance, plus a SHA-256 hash of the exact wording shown, so you can later prove which text they agreed to.

2. Identifying each signer

Each signer receives a unique, unguessable link by email. Opening it shows they had access to that inbox. Every action they take is recorded with their IP address, device, browser, time zone and language.

3. A tamper-evident audit trail

Key events (upload, sending, each view, consent, each signature, decline and completion) are written to a hash chain. Every record includes the hash of the one before it, like links in a chain. If anyone edits, deletes or reorders a record, the chain no longer checks out, and mndok shows that the history has been altered.

4. A sealed PDF with a Certificate of Completion

When everyone has signed, mndok writes their signatures and field values into the PDF and appends a certificate listing each signer, their consent and signing times, IP addresses and devices. The certificate also prints a SHA-256 hash of the signed pages. Change a single character and the hash no longer matches.

5. Verification anyone can run

Anyone holding the certificate can enter its hash at mndok.com/verify to confirm the document was completed on mndok and that its audit trail is intact. Signer emails are partly hidden on that page.

How your data is protected

• All traffic to mndok.com is encrypted with HTTPS.
• Passwords are stored only as bcrypt hashes, never in readable form.
• Uploaded and signed PDFs are stored outside the public website and are only served to the document’s owner or to a signer holding a valid link.
• API keys are stored as hashes, can expire, and can’t be used to manage your account.
• Sign-in attempts are recorded with the device they came from, and you can review recent sign-ins in your account.
• Signing links and password-reset links are stripped from page data before it reaches Google Analytics, and mndok shows no ads.

Limits you should know about

mndok creates simple electronic signatures. It doesn’t verify government ID, send SMS codes, or issue certificate-based (qualified or advanced) digital signatures, and it isn’t independently certified to standards such as SOC 2 or ISO 27001. For documents that legally require those, use a provider that offers them. See are electronic signatures legal?