How to sign a contract remotely — no printer, no account

Pick a signing platform, upload the contract, add each party with their contact details, and send. Every signer opens a single-use link, verifies with a code sent by SMS or email, signs on the canvas, and the envelope returns a sealed PAdES PDF plus a hash-chained audit trail to the sender.

Signers need nothing installed and no account: they open a link from their phone or browser, verify with a one-time code, and sign. The one who holds the account is whoever sends the contract — the organisation — because it is the sender that carries the retention duties and the evidence pack.

Technically, the signer's only credential is the link itself: a unique single-use token dispatched over a TLS-protected endpoint. Once used, it is spent — it cannot be replayed by whoever might see it next.

The ceremony binds, in order: the invite (single-use token), the possession of the phone (a 6-digit one-time code received and re-entered), and the session context (truncated IP address and device details bound to the verification claim). Each of these becomes a line in the audit trail — recorded as the ceremony happens, not reconstructed afterwards.

For anyone doubting what happened later, the hash-chained audit trail plus the sealed document answer the question without needing anyone's recollection: the chain links every event to the previous one, and any tampering breaks the chain visibly.

The signer draws their visual mark over the document's canvas; the platform anchors an embedded signing trace with it and signs. The ceremony follows the signer's preferred language — on a remote deal, the counterparty may only share a language with your paperwork, not with your office.

A signed PDF attached to an email is an image of an intention: no digest binds the scanner's output to what was signed, the signing time rests on the scanner's clock, and there is no checking mechanism at all. Everything described above — digest-bound content, an authority-anchored RFC 3161 time when an authority is configured, the chain — exists to give a counterparty facts instead of impressions.

The verification is public: anyone, including the counterparty, can run the check on the sealed PDF without an account. You do not have to trust the sending side's word; the evidence stands on its own.

Originals, per-signature revisions and sealed finals are kept under the customer's retention settings — default maximums of 5 to 20 years by document type — then purged with cryptographic proof of erasure. For a remote signing, that covers the questions a counterparty (or their auditor) tends to ask next: where the records are, and for how long.