Quickstart: Digitize Your Ceremonies

Navigate to Admin → Esign → Documents → New Document and upload your PDF (contract, offer letter, consent form — whatever you need signed). Give it a title and description; Aeion creates the document record and you're ready to add signers in Step 3.

For reusable documents, open Admin → Esign → Templates and use the visual drag-and-drop field-placement builder: upload a source PDF, then drag to place and resize fields (text, date, checkbox, dropdown, signature) with normalized per-page coordinates. Each field can carry a crmMapping merge-field path for CRM auto-fill and a conditionalRule for show/hide logic, and a live preview resolves both as authored. Signers can also sign a plain document exactly as uploaded, using the capture methods below (browser canvas, or Witness Photo / ID scan / signature pad when a signer's config requires them).

When the workflow requires hardware (signature pad, ID scan), the in-person signing flow activates:

ID scan step:

1. The system prompts "Please scan the back of your ID"
2. Plug in (or use already-connected) 2D barcode scanner
3. Scan the PDF417 barcode on a driver's license
4. System parses ANSI/AAMVA spec → extracts Name, DOB, Address, License Number, Expiration
5. Matches against the signer's pre-entered name (if pre-filled from CRM)
6. Stores encrypted scan + verification result in the audit trail

Identity match scenarios:

• Exact match — proceed to signature step
• Close match (typo, hyphen difference) — admin override option
• No match — abort with audit trail of the attempted ID

Anti-fraud features:

• ID expiration check
• Liveness check (optional — webcam-based, prevents photo-of-photo)
• Backside-match verification (PDF417 + OCR of front)
• AAMVA validity check (some states have specific format requirements)

After identity verification, the signature pad activates:

On the device:

• Wacom STU-540: shows "Please sign below" with brand logo
• Topaz T-L755: shows the document preview + signature field
• Pressure-sensitive devices capture up to 1024 pressure levels per sample point
• Tilt-sensitive devices (Topaz pro models) capture stylus angle

Real-time render in browser:

• Stroke renders into the PDF as the user signs
• Biometric data (pressure curve, timing, velocity) captured separately
• Customer sees their signature appearing on screen as they draw
• Submit button only activates after minimum stroke length

Cryptographic seal on completion:

1. A Certificate of Completion PDF is rendered (source document + a page listing every signer, timestamp, IP, and auth/capture method)
2. A SHA-256 content hash of the complete sealed PDF is computed and stored — re-verifying the stored bytes at any time detects any post-seal change
3. The per-document tamper-evident SHA-256 audit chain is verified and its integrity proof embedded in the certificate
4. All artifacts are stored in the tenant's object storage; GET /esign/documents/:id/verify re-checks both the content seal and the audit chain on demand

> Cert-based signing is available for organizations that need it beyond the default content-seal path: configure a per-tenant X.509 signing certificate and Aeion embeds a PAdES / PKCS#7-detached signature into the sealed PDF. The SHA-256 content seal stays the default; PAdES is opt-in per tenant.

Audit trail contents:

• Every action (open, view, scroll, field-fill, sign, decline) with timestamp + IP
• Identity verification result + ID scan
• Hardware device info (Vendor ID, model, firmware)
• Biometric data (separate encrypted blob)
• Document hash + signature chain
• Witness photo (if required)
• All recipient communications (emails, SMS) with delivery receipts

For remote signing (no hardware), send the workflow link via email or SMS:

Remote signer experience:

1. Receives branded email with secure link
2. Optional pre-sign authentication (SMS-OTP, email confirmation)
3. Opens link → views document on any device
4. Fills required fields + signs (mouse / touch / typed name)
5. Submits → cryptographic seal applied
6. Receives signed copy via email automatically

Anti-fraud for remote:

• IP + device fingerprint logged on every action
• Suspicious-IP alerts (signing from country different than known IP history)
• Multi-factor required for high-value contracts (>$10K, etc.)
• Webcam liveness check optional for sensitive contracts

CRM auto-sync:

• Completed contracts auto-link to the CRM contact + deal record
• Contract metadata (counterparty, amount, expiration date, renewal date) populates CRM fields
• Renewal-window alerts auto-create CRM tasks ("Renew NDA with ACME — 30 days out")

Bulk send: for repetitive contracts (1099s, NDAs, T&Cs), bulk-send to a CSV list of recipients. Each gets their own unique signing link with personalized prefilled fields.