Retention and redaction

A signed agreement is evidence for years and somebody's personal data from the first day. SignSealer keeps both promises by redacting, not deleting: the text and the people go, the fingerprints, the trail and the certificate stay, and the certificate still verifies.

This page is what that means for your integration. The policy, including what redaction cannot reach, such as backups, is Data retention and deletion.

How long things are kept

Both periods belong to the business, and neither can be changed from the dashboard or the API today. A document's clock starts at the first it has of: completed, voided, its expiry date, sent, created. A draft, or a document still out for signature, is never redacted, however old. The sweep runs every hour and takes at most two hundred documents per business a pass, oldest first.

What redaction removes and keeps

Goes

• The text, replaced by a dated notice, and the title, which becomes Redacted document.
• Each signer's name (Redacted), email address (one at redacted.invalid, which cannot receive mail), phone number, date of birth and reason for declining.
• The signatures themselves; the network address and browser on every event; a shared position's coordinates; and the names on a party's events (who handed a link out, whom a parent signed for).
• Every answer's value, the photographs taken as answers, and the sealed PDF kept since completion. ID evidence images go at the next hourly sweep.
• The name of each child an answer was about, which becomes Redacted child 1, Redacted child 2 and so on: one number per child, the same on every question, in the parent or guardian's statement, and in the party's list of children, which loses their dates of birth. The certificate keeps the statement's words and drops the name and the statement's SHA-256.
• Its link to the person on file it was about, so subject_party_id and subject_name read null. That person stays on file, as they were, for your other documents.
• The body, subject and recipient of every message about it (one still queued is canceled), and the people in every webhook delivery about it (one still waiting goes without them).
• Your external_ref.

Stays

• The document's id, status and dates, and the SHA-256 of its text, unchanged, as body_sha256_hex.
• Every event's kind, time and the fingerprint of the text it was made against; each signer's role, order, status and times; every question.
• The guests on a reservation you sent with PUT /v1/subjects, and the people on file: they are your records, shared by the other documents about them, and a redaction of one document leaves them as they are.
• The certificate's code, issue time and both hashes, and the SHA-256 of every sealed PDF issued for it.
• Your own metadata and return_url. Redaction leaves them, so keep personal data out of both.
• A line on the audit trail: who redacted it, when and why.

What the API answers afterwards

No webhook event fires when a document is redacted. Your system finds out by reading the document, where redacted_at is set:

{
  "document_id": "d41c…",
  "title": "Redacted document",
  "status": "completed",
  "body": "[Redacted on 2033-10-01. The text is gone. Its SHA-256 fingerprint, the times, the event trail and the certificate are kept, and the certificate still verifies against them.]",
  "body_sha256_hex": "9f2c…",
  "integrity_ok": true,
  "redacted_at": "2033-10-01T15:04:12Z",
  "redaction_reason": "retention: past 2555 days",
  "signers": [{
    "full_name": "Redacted", "email": "redacted-5f0a8c21@redacted.invalid", "phone": null,
    "status": "signed", "signed_at": "2026-10-03T14:22:09Z", "decline_reason": null, …
  }],
  "events": [{
    "kind": "signed", "signer_email": "redacted-5f0a8c21@redacted.invalid",
    "ip": null, "user_agent": null, "signature_method": "typed",
    "signature_value": "[redacted]", "matches_current_text": true, …
  }],
  "answers": [{ "key": "medical", "label": "Anything we should know?", "asked": true, "value": null, "flagged": false, … }],
  "external_ref": null,
  "metadata": { "booking": "RES-88213" },
  …
}

A webhook body is scrubbed where SignSealer keeps it, and a replay sends it scrubbed. What your receiver stored is out of our reach: redact your copy when redacted_at appears.

Redacting a document yourself

This is how a signer's request to be forgotten is served, or how you act before the period ends. On the document's page in the dashboard, open Redact the people from this document and give a reason. Anyone on the team who can void a document can do it. There is no API route for it.

• Only a finished document. A draft, or one still out for signature, is refused: void it first.
• The reason is kept. It comes back as redaction_reason and goes on the audit trail, so name the request, not the person.
• It cannot be undone.

SignSealer is the processor here, so a signer who writes to us is pointed back to you.

Legal holds

A hold takes one document, or every document a business has, out of the schedule while a matter is live. SignSealer places and lifts holds; there is no button or route for one. If you need one, write to support@signsealer.com.

• The sweep skips a held document, including after the account is closed, and redacting it by hand is refused.
• Nothing else stops. It can still be voided, expire and be read, and message bodies, webhook bodies and ID evidence images still go on their own clocks.
• Lifting a hold needs its own reason. A document already past its period is redacted at the next hourly sweep.

When SignSealer places or lifts a hold on your business, it is listed on Activity, under Who at SignSealer looked at your account.

Taking your records

An owner or admin can download everything the business holds as one JSON file, from Settings → Download the records: settings, team, templates, every document with its signers and evidence package, keys, webhooks and tablets by name (no secrets), every message sent (never its words) and the audit trail with its hash chain. Taking it goes on the trail. It does not carry the sealed PDFs: fetch those with GET /v1/documents/{id}/pdf.

Closing the account

The owner closes a business from Settings by typing its name. It is refused while any document is still waiting for a signature, and a subscription is canceled at Stripe first. At once, every API key, tablet, webhook endpoint, invitation, connected app and workflow is revoked or switched off, and everybody but the owner loses access. Thirty days later the documents are redacted, with the closing date as the reason (one whose period ends sooner goes then), unless held. The certificates stay, and still verify for the people who signed.