Signature & retention
The executed copy is written once. Nothing overwrites it.
Ordered signers on a single rail, an executed PDF with its own hash, and a copy that declares which sections it governs — so supersession is computed rather than remembered.
Signatures · ENV-2026-0917 · Helios MSA · v5In-app railOut for signature
Signers · in order0 of 3 signed
1Priya KaurwaitingNorthwind Trading Co. · Email link
2Morgan LeewaitingNorthwind Trading Co. · Email + SMS code
3D. VäisänenwaitingHelios Cloud Oy · Email + SMS code
Before you sendThis counterparty’s jurisdiction and document type ask for a qualified signature, which the in-app rail cannot issue. Switch the envelope to the eID rail, or record why a simple electronic signature is acceptable here. One rail per envelope — a mixed envelope cannot produce one sealed document.
Choosing the rail · checking every signer’s required level against it…
What completion produces
Executed copyCompleted
executed/northwind/ENV-2026-0917/final.pdfsha256 4c1f·9ab2·d70e·5518OnceWritten a single time, as its own row. A second completion is a no-op — it cannot overwrite the contract it amends.
What this copy governs§5.3 · §9.1
FactA copy declares the sections it takes, so “Amendment 3 governs §5.3” is something the register knows rather than something somebody remembers. A copy is superseded when every section it took has been taken later.
Verify/verify/4c1f9ab2 confirms the hash and the names. Three outcomes: match, no match, and no hash to compare — the third is stated, not hidden behind the first.
One rail per envelope · ordered signersCompleted, not sealed · a simple electronic signature is not a qualified one
Completed · never sealed
The last mile, and the long tail.
Getting it signed, and still being able to prove what you hold four years later.
Legal · sales · procurement
Send it once, from the document you already approved.
Ordered signers, each with their own auth method — email link, email plus SMS code, or eID.
The send sheet warns before sending when a signer’s required level is not available on the chosen rail, rather than failing at completion.
The same approval gates that guard export guard this: no approved request bound to the current body hash, no send.
Compliance · records
A file you can still account for after the people have left.
The executed PDF is written once, under its own key, with its own sha256 and its own row.
Each copy declares the sections it takes, so supersession across a family is computable instead of anecdotal.
Disposal is a person’s act and produces a certificate carrying the hashes of everything that went.
02Retention & holds
The only part of this product that destroys anything.
A policy computes eligibility thirty days ahead and destroys nothing. A person disposes, with a reason and a typed confirmation and no undo — and a legal hold overrides every rule here, including your own.
Retention · Northwind · 7-year policy · HOLD-0003
Eligible for disposalcomputing
Computed, not destroyed30 days aheadThe daily job creates eligible items and stops. Nothing is removed on a schedule, which is the whole design of this part.
Legal hold · placed by Priya KaurCaught 3 documents and wrote down which three, rather than storing the search that found them. New documents matching its scope join it on creation. The hold pauses the Helios share link rather than revoking it — the link is evidence of what was shared, and with whom.
Disposal · Morgan Lee · reason recordedEleven documents, a typed confirmation, and no undo. The three under hold were refused with 423 locked — a refusal a person can act on, not an internal error. Families dispose together.
Certificate of destruction · CERT-0114Carries the sha256 of all eleven files. The register line, the hash, the certificate and the activity entry outlive the file — because a firm that cannot prove what it destroyed has not disposed of a document, it has lost one.
To release the holdA reason, and a second admin. The one who asks cannot be the one who agrees.
Nothing is destroyed on a schedule · a hold overrides every rule here, including the firm’s own
03Said exactly
It says completed. It does not say sealed.
Seal is a term of art under eIDAS Articles 35–40, and this is not one. The certificate reads from a frozen snapshot, so a later rename cannot rewrite it, and the public verify page confirms the hash and the names — and nothing else.
Certificate · ENV-2026-0917 · frozen snapshot
Statuscompleted — not “sealed”. Seal is a term of art under eIDAS Arts. 35–40.
Signature typeSimple electronic signature. Not a qualified signature.
Signers3 of 3 · Priya Kaur, Morgan Lee, D. Väisänen · each with the method used
Document hashsha256 4c1f·9ab2·d70e·5518
Verify/verify/4c1f9ab2 — confirms the hash and the names, and nothing else
If the hash differsno match is one outcome; no hash to compare is a different one, and is said rather than hidden.
Read from a frozen snapshot · a later rename cannot rewrite it
04How it works
From an approved draft to a copy you can prove.
Four steps, each leaving something behind.
01Choose a railOne per envelope. QES is decided by document type and jurisdiction from your workspace list — never by contract value. Value decides risk, not legal form.
02Send in orderEach signer has an auth method. The send sheet says when the rail cannot reach the level a signer needs, while changing it is still free.
03Complete onceThe executed PDF is written a single time with its own hash. A second completion is a no-op, so a completed amendment cannot overwrite the contract it amends.
04Keep, then disposeRetention computes eligibility; a person disposes. What went is provable afterwards because the certificate carries the hashes.
05Before · after
What “we have the signed copy” used to mean.
Four years later, under a question.
The way it wasWith ClauseMinds
The executed PDF is an email attachment, and a second one is in someone’s downloads.One executed copy, written once, with its own sha256 and its own register row.
A completed amendment saves over the contract it amends. Nobody notices until the original is wanted.Completion never overwrites. A second completion is a no-op, by construction.
“Which version governs §5.3?” is answered by whoever has been here longest.A copy declares the sections it takes, so supersession is computed from the family.
Retention is a policy document, and deletion is whatever somebody did in a clearout.A certificate of destruction carrying the hashes of what went — and a hold nothing can delete around.
06When this happens
The ones that decide whether the record holds.
WhenA counterparty needs a qualified signature and you are on the in-app rail.ThenThe send sheet says so before you send, and offers the eID rail. It does not quietly downgrade the signer, and it does not mix rails inside one envelope — a mixed-provider envelope cannot produce one sealed document.one rail per envelope
WhenThe same envelope completes twice.ThenThe second completion does nothing. The executed copy already exists under its own key with its own hash, and the contract’s storage key is only ever set when the contract had no file of its own.completion is idempotent
WhenA document under litigation hold reaches the end of its retention period.ThenIt is refused with 423 locked — a refusal a person can act on, not an internal error. The hold recorded what it caught when it was placed, so editing a saved search cannot quietly change its shape.a hold beats every rule here
07Principle
A signed document is a claim about the past. Everything here exists so the claim can be checked.
01Written once, hashed, and never overwritten.The executed copy is its own row with its own sha256. Overwriting is not guarded against; it is not possible.
02The certificate says only what it knows.Completed, not sealed. A frozen snapshot, so a rename cannot rewrite history. Verification has three outcomes, and “no hash to compare” is one of them.
03Destruction is provable, and it is a person’s act.Nothing is destroyed on a schedule. What went is recorded with its hashes, and the record outlives the file.
08Said plainly
What it does not do.
Especially here, where the temptation to overclaim is strongest.
A simple electronic signature is not a qualified one.The certificate says which was used. Where your document type and jurisdiction require QES, the workspace list says so and the send sheet enforces it — but nothing in this product converts one into the other.
It does not tell you whether a signature is enforceable.That is a question about your jurisdiction, your counterparty and your document. The product records what happened with enough fidelity for somebody qualified to answer it.
Verification compares hashes, not meaning.The public verify page confirms the hash and the names. It does not attest that the content is what anybody intended, and it says plainly when there is no hash to compare against.
QES rails need vendor accounts.eID rails are Enterprise and depend on a provider configured for your deployment. Where none is, the card says which environment variables are missing and offers no button.
Everything after the yes
What ships with signature & retention
Ordered signersPer-signer auth method: email link, email plus SMS code, or eID. Human-readable envelope ids (ENV-2026-0917) beside the UUID.
One rail per envelopeThe send sheet warns when a signer’s required level is not available on the chosen rail, before the envelope goes out.
QES by type and jurisdictionFrom a workspace list, never by contract value — value decides risk, not legal form. A value threshold is a second-approver rule, which is a different question.
Completion never overwritesThe executed PDF is written once under its own key, as its own row with its own sha256. A second completion is a no-op.
A copy declares what it takesSections governed are recorded, so “Amendment 3 governs §5.3” is a fact and supersession is computable across the family.
Verification with three outcomesMatch, no match, and no hash to compare — plus nearest-copy page overlap when nothing matches.
A certificate that cannot driftRead from a frozen snapshot, so a later rename cannot rewrite it. Public at /verify, confirming the hash and the names and nothing else.
Import from DocuSign and Adobe SignExecuted agreements signed elsewhere file themselves into the register, with Connect webhooks where you use them.
Retention schedulesEligibility computed thirty days ahead. The job destroys nothing; disposal takes a reason and a typed word and offers no undo. Families dispose together.
Legal holdsOverride every rule including your own, record what they caught when placed, pause share links rather than revoking them, and need a second admin to release.
Questions people ask
It produces a simple electronic signature by default, and a qualified one only on an eID rail with a provider configured for your deployment. The certificate states which was used, and says “completed” rather than “sealed” — seal is a term of art under eIDAS Articles 35–40 and this is not one. Whether a given signature is enforceable depends on your jurisdiction, your counterparty and your document; the product records what happened precisely enough for somebody qualified to answer that.
Yes. DocuSign and Adobe Sign are two of the rails, and executed agreements signed through them file themselves into the register — with Connect webhooks where you use them, so there is no download-and-reupload hop. What changed is that sending is no longer only theirs: ClauseMinds issues its own envelopes too, and an envelope uses one rail either way.
The executed PDF is written once under its own key as its own row, and the contract’s storage key is only set when the contract had no file of its own. A second completion is a no-op. This is not a check that could be skipped — it is how the write is shaped.
Nobody on a schedule. A retention policy computes eligibility thirty days ahead and destroys nothing; a person disposes, with a reason and a typed confirmation and no undo, and the resulting certificate carries the hashes of everything that went. A legal hold refuses disposal outright, and releasing one needs a reason and a second admin — the person who asks cannot be the person who agrees.
That a hash matches and that the names are what the certificate recorded. It has three outcomes, and “there is no hash to compare” is stated as its own result rather than folded into a failure. It does not attest that the content means anything in particular.
Send one envelope. Keep the copy forever.
Three signers, one rail, and a file you can still prove in four years.
14 days free · no card