Signature evidence, privacy and security

When you configure a signing form, review both the evidence recorded by the product and the people who can access the answers and output. A signed document, its wording, its recipients and the surrounding process all matter to the task you are carrying out.

What the record can show

Formesign keeps response and signature activity, and generates signed output for configured signature forms. The available record can include signer details, action times, an envelope identifier and certificate information. Review the actual output of your form rather than assuming every field or certificate layout is identical across modes.

PDF verification can compare the uploaded file with a retained fingerprint. Older records can instead use document-ID verification without comparing the complete file contents. Preserve the downloaded original if later integrity checking is important.

These product records support examining what happened. They do not decide whether a person's authority, agreement wording or legal process is sufficient for your particular document. Obtain appropriate review for the agreement and jurisdiction involved before relying on a universal validity statement.

Map where the information goes

List the destinations used by your form: the Formesign response, underlying Google Form where configured, response Sheet, report Sheet, Drive folder and emailed copies. Check who has access at each destination.

Formesign processing and generated records mean that “all data only exists in my Google account” is not a useful assumption for setup. Read the current Formesign privacy policy and terms for the service arrangement, and use the account-specific controls for your data flow.

Configure access and notifications

Give staff the collaborator access needed for their task. Review the recipient view separately from an owner's preview. Check Drive folder sharing and Sheet sharing as well as the form's access controls.

For health information, use PHI field controls, inspect subjects and attachments, and complete the relevant HIPAA setup. The Google and Formesign BAA branches are distinct; a completed wizard does not replace your organization's broader review.

Keep records and respond to issues

Follow the retention schedule applicable to your process and verify deletion effects across each destination. Stopping Drive saving preserves existing Drive files. Copies already emailed or downloaded require their own handling.

Use the current support route for account or service questions. Describe the symptom and affected workflow with redacted or synthetic examples, and avoid sending credentials or private signing links through public posts. For output ownership and archival tasks, see sharing and retention.