What Happens to Your Signed Documents If the E-Signature Company Shuts Down?

If my e-signature vendor shuts down, are my signed documents still valid?

It depends entirely on how the vendor built their proof. With most platforms, the evidence that a document was signed — the audit log, the verification page, the "view certificate" button — lives on the vendor's servers. If the company disappears, that evidence can disappear with it. Sign For Free is built the opposite way: the proof is embedded inside the PDF itself and the tool to check it is published in three independent public places, so a signed document stays verifiable even if Sign For Free ceases to exist. This article explains how that works.

The problem: vendor-hosted proof

Think about what "verify this signature" usually means. You click a link, it goes to the vendor's website, their server looks up their private records, and it tells you the document is genuine. That is convenient — right up until the server is gone. Company acquired and sunset, domain lapsed, business folded: the link 404s, and now the strongest proof of your agreement is a screenshot.

The document might still hold up in court on other grounds, but the clean, one-click "this is authentic" check is gone, because it was never really about the PDF — it was about the vendor's database.

The solution: a seal you can check without the sealmaker

Here is the mental model Sign For Free is built on. Imagine the operator has a unique wax seal. Only the operator owns the seal itself — that is the private key. But anyone can be handed a matching inspection tool that only answers one question: "did this exact mark come from that exact seal — yes or no?" That inspection tool is the public key.

Two things make this powerful:

• The inspection tool cannot forge the seal. You can hand out millions of copies of it and create zero security risk, because it can only check marks, never make them.
• A mark that has already been stamped stays valid even after the seal is gone. Once the wax is pressed, the impression is permanent, and the inspection tool keeps working forever.

That is exactly the property Sign For Free gives your signed PDF. The operator "stamps" each completed document, and the "inspection tool" — the public key — is published where it can never be quietly withdrawn.

Under the hood: Ed25519 and SHA-256

For technical readers, here is what the seal and inspection tool actually are.

When an envelope is completed, the system gathers the signing metadata — envelope ID, signer email, IP, OAuth details, timestamps — together with every field's type, position, rotation, and value (each signature, initials, date, text, and stamp). It serializes that bundle deterministically (CBOR, RFC 8949) so that anyone serializing the same data gets byte-identical output, then hashes it with SHA-256 into a 32-byte fingerprint. The operator's key then produces an Ed25519 signature over that fingerprint, which is embedded in the Audit Trail PDF.

Ed25519 guarantees two things mathematically:

• Unforgeability. Without the private key, you cannot produce a signature that verifies against the public key.
• Deterministic verification. The same (message, signature, public key) always yields the same result. If it passes today, it passes in ten years — for you, your lawyer, a judge, or the opposing party.

Because the fingerprint covers every field's position and angle and value, changing a stamp's rotation by one degree or editing a single character breaks verification. Tampering is not just detectable in principle; it is baked into the math.

Why "the company is gone" no longer matters

Verification needs exactly three ingredients: the signed document, the signature embedded in it, and the public key. It does not need the operator's private key, a live server, or even an internet connection once you have the public key downloaded.

Sign For Free publishes the public key in three independent places so no single point of failure can remove it:

• GitHub — the operator's public repository.
• DNS — a record on the operator's domain.
• archive.org — the Internet Archive, an independent long-term public record.

To forge or suppress the proof, an attacker would have to compromise all three simultaneously and break Ed25519 itself. And even in the ordinary "the business just shut down" case, nothing is lost: the PDF still carries its own seal, and the inspection tool is still sitting in three public archives.

Honest limits

We are not claiming magic. A few things worth stating plainly:

• This proves the document is cryptographically intact and operator-signed; it is the same self-claim trust model DocuSign's standard signatures use, made independently verifiable. It is not a "qualified electronic signature."
• The time of signing is a self-claim timestamp, not a qualified timestamp from an accredited authority. If you need court-grade time-of-signing trust, that is a different tier of product.
• The single-operator key is a deliberate one-person trade-off: if the operator's GitHub or domain control were compromised, a forged public key becomes possible. The three-location publication is the mitigation, not a guarantee.

FAQ

Do I need Sign For Free's website to verify a document later?

No. You need the PDF, the signature inside it, and the public key. The public key is on GitHub, in DNS, and on archive.org, so you can verify entirely without our servers — even offline.

What if someone edits the signed PDF?

Any change to the covered content — metadata, field position, rotation, or value — changes the SHA-256 fingerprint, and Ed25519 verification then returns FAIL. The tampering is detectable by anyone who runs the check.

Is the public key being public a security risk?

No. The public key is designed to be published. It can only check signatures, never create them. Exposing it is what makes universal, permanent verification possible.