Signatures that hold up.

Signatures that hold up

U.S. law (the federal ESIGN Act and each state’s version of UETA) treats an electronic signature like a handwritten one when the signing process shows four things. Here is how SignLucid covers each:

1. Intent to sign. The signer adopts a signature (typed or drawn), places it spot by spot, reviews the document, and presses Submit. They can decline instead, and the sender is told.
2. Consent to sign electronically. Before anything opens for signing, each signer reads an Electronic Record and Signature Disclosure and agrees to it.
3. The signature is tied to the document. Each signature is placed on the PDF, every page carries the envelope number, and a certificate of completion is added at the end.
4. A record you can keep. Signers and senders can download the signed PDF. The certificate lists each signer’s consent time, signing time, IP address, device, how they were verified, and the full event history, with SHA-256 fingerprints of the original and the signed copy.

A few documents can’t be signed electronically under these laws (for example wills, and certain family-law and court documents). If you’re unsure about a document, ask your attorney. E-signature laws: U.S., Mainland China, Hong Kong, Taiwan →

IRS forms

• Form 8879 and 8878. IRS Publication 1345 requires identity verification for remote electronic signatures, such as knowledge-based authentication (KBA). Built-in KBA is coming soon. Until then, have clients sign Form 8879 in your office (after you check their photo ID).
• Forms 2848 and 8821. The IRS accepts electronically signed versions only through its online submission tool; faxed or mailed forms need an ink signature.
• Form 7216 consents, engagement letters and organizers can be sent for e-signature as usual.

Encryption and accounts

• All traffic is served over HTTPS (TLS 1.2 or higher).
• Passwords are stored only as salted scrypt hashes. Sign-in attempts and access-code tries are rate-limited.
• Each signer gets a private, random link. Links stop working when the envelope is voided, and signing pages are never indexed by search engines.
• Optional access codes add a check before a document opens. (An access code is not identity verification for IRS purposes.)

How long we keep documents

• Completed envelopes (signed PDF, certificate and audit trail) are kept while your account is active, and you can download or export them at any time. Your firm is responsible for keeping records the law requires — for example Form 8879 for three years.
• If you close your account, you have 30 days to export. We then delete your data within 60 days, and it leaves our backups within 12 months.
• Demo documents from our website are deleted after one day.

Tax return information

Tax return information is protected by IRC §7216. SignLucid uses your documents only to provide the signing service to your firm. We never sell them, use them to market to anyone, or use them to train AI. Layout memory keeps only a page’s printed form words and field positions; client names are removed before anything is stored.

Who else handles your data

We’ll give 30 days’ notice before adding a provider that handles your documents. How we use AI →

What we don’t have yet

We list these openly so you know what is and isn’t available today:

• Knowledge-based authentication (KBA) for remote Form 8879 signing.
• A digital seal on signed PDFs and a public page to check a document’s fingerprint.
• Per-firm retention settings and automatic deletion.
• An off-site copy of our daily backups (being set up).
• Two-step sign-in for team members.
• We do not have a SOC 2 report, and SignLucid is not set up for HIPAA-protected health information.