Sealed Signed Documents

When someone signs a Merge Document and submits it, ProcessPlan saves it as a sealed PDF. The seal is a digital signature over the whole file. If anyone changes the file afterwards, PDF readers such as Adobe Acrobat Reader show that it was changed.

At the end of the PDF, ProcessPlan adds a Certificate of Completion that records who signed, when, and from which internet address. The seal covers the certificate too.

What You Need

• A Merge Document with at least one signature block. See Collect a Signature.

• A Merge Document Link field on the process for that document. The sealed PDF is saved in this field, the same place the document’s PDF has always gone.

What Happens When Someone Signs

1. The person opens the document’s link, types their name in the signature block, and submits the document

2. Within about a minute, ProcessPlan creates the PDF: the document’s pages, followed by the Certificate of Completion

3. ProcessPlan seals the PDF and saves it in the Merge Document Link field, named after the document

4. The process’s Instance Audit Log records Signed document sealed, with the document’s ID

If several people sign the same document at different times, each submit creates a new sealed PDF that replaces the one before it. Its certificate lists everyone who has signed so far.

Submitting the same document twice without changing anything doesn’t create a second PDF.

What the Certificate of Completion Shows

• The seal stamp - “Electronically sealed by ProcessPlan”, the time it was sealed, and the line “Verify at processplan.com/verify” with the document’s ID

• Document - the document’s name, how many pages it has, a fingerprint of the signed content, the Document ID, your account, and the process it belongs to

• Each signer - their name, where they signed, how they reached it, when they signed, and the internet address they signed from. An email address and the time the link was sent appear only when ProcessPlan has a record of the link being emailed to that person.

A document also shows signatures given on a public form in the same process run. The seal covers those too, and the certificate lists each one as signed on A public form, so it’s clear the person signed the form rather than this document. Signatures given on the document itself are listed as signed on This document.

• History - every recorded event, with its time in UTC, who did it, and the internet address it came from

Checking a Sealed Document

Anyone who receives the PDF can check it themselves. processplan.com/verify explains how to do it in Adobe Acrobat Reader, step by step, and how to confirm the seal is ProcessPlan’s.

In short, Acrobat’s Signature Panel shows Signed by ProcessPlan Document Seal and the line “Document has not been modified since this signature was applied.” Acrobat also warns that the signer’s identity is unknown. That warning is expected: it means Acrobat doesn’t know ProcessPlan’s certificate. It doesn’t mean the document changed.

Caution

Keep the sealed PDF exactly as it is. Any change to the file, even a comment, a highlight or text added with Acrobat’s Fill & Sign, shows up in Acrobat as a change made after the document was sealed. Send people the PDF from the Merge Document Link field, not a copy that someone has opened and saved in an editor.

If a Document Can’t Be Sealed

If something goes wrong while sealing, ProcessPlan tries again, for about eight hours. If it still can’t seal the document, the Instance Audit Log records Signed document could not be sealed, and no PDF is saved. The signatures stay recorded on the process. Contact support and we’ll sort it out.

If a signature record doesn’t pass ProcessPlan’s integrity check, the document isn’t sealed at all, because the seal would vouch for a signature nobody can stand behind. The PDF is saved without a seal, and the Instance Audit Log records Signed document not sealed. Contact support if you see it.

A document that shows a signature from another process run isn’t sealed either, for example a parent process’s signature brought in through a lookup field. Its certificate can list only this run’s signatures, so it can’t vouch for that page. The PDF is saved without a seal.