What a SHA-256 seal actually is:
A fingerprint of an exact file, produced from its contents as a long string of characters. Change a single character anywhere in the file and the fingerprint changes completely. It cannot be reversed into the original file, which is why it is used to show that a file has not been altered since the fingerprint was taken.
Using Verify Integrity:
Open any completed document in the admin and click Verify Integrity. The plugin recomputes the SHA-256 hash of the stored file and compares it with the value recorded at sealing. A pass tells you the file matches its seal exactly and shows the start of the fingerprint. A failure warns you that the stored file no longer matches the recorded seal, which means it has been modified or replaced since sealing. The full sealed fingerprint is displayed on the document page, and on uploaded PDF documents the original file's fingerprint is shown as well.
The two fingerprints on a document:
The sealed hash covers the finished PDF file as a whole. The evidence hash printed inside the certificate is computed from the agreed content, the original file hash where one exists, each signer's identity and signing details, and the signature images. They answer slightly different questions, and both are recorded.
If someone disputes a signature:
- Download the sealed PDF from the document's status page.
- Point to the Certificate of Completion: the consent timestamp, the IP address, the device, the view time and the signing time.
- Run Verify Integrity on your stored copy, or have the other side hash the copy they hold and compare it with the recorded fingerprint.
- If their copy's fingerprint differs from the recorded one, their copy is not the file that was sealed.
A red result is not always foul play. A file can also stop matching its seal because it was restored oddly from a backup or touched by a migration tool. Whatever the cause, the copy emailed to everyone on completion day is the one to treat as authoritative, which is a good reason to keep that email.
Because everything runs on your own server there is no third party account that can expire or lock you out. The other side of that is that your backups now contain your signed contracts, so back the site up and protect those backups accordingly.