Trust
Audit trail and signed PDFs
When someone signs, you keep more than a picture of a signature. You keep the answers, the form version they saw, and a hash so a later edit is obvious.
- Envelope-encrypted submission payloads in object storage — the database keeps pointers and hashes, not answers.
- Every published form version has a SHA-256 content hash. The audit record points at the version the signer actually saw.
- Signed PDFs generated from that version, emailed to the signer and/or you.
- IP address and user agent stored on the submission for the audit trail.
- Public forms can show a ConsentForms mark on Free; paid plans remove it.
Sample signed PDF
A dummy waiver PDF — not a real client. Same layout as the file we email after a signature: title, answers, signature image, and a footer with the submission id and content hash.
Sample audit record
What we store alongside a submission. Dummy data only — the IP is documentation-range, the email is example.com.
- type
- submission.created
- form
- Studio liability waiver (sample)
- version
- 3
- submissionId
- sub_demo_7f3a91c2
- signerName
- Alex Rivera
- signerEmail
- alex@example.com
- submittedAt
- 2026-10-14T16:42:11.000Z
- ipAddress
- 203.0.113.42
- userAgent
- Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X)
- contentHash
- a3f19c8e2b74d0f1c6a9b5e8d2f0417c88e1b6a34d9c0f72e5a1b8c6d4e30791
Search Console
The public sitemap is at /sitemap.xml. Robots instructions are at /robots.txt. In Google Search Console, add the domain property for consentforms.com, verify with the DNS or HTML-tag method, then submit the sitemap URL. Set GOOGLE_SITE_VERIFICATION in the app environment if you use the meta-tag method — it is emitted on every public page.
Questions about encryption keys, retention, or a DPA: contact support. We reply within 24 hours.