Electronic Signature & Document Integrity

Overview

CommunityPay's electronic signature system (SimpleSign) provides legally binding signature workflows for HOA governance documents -- board resolutions, vendor contracts, compliance notices, and financial documents. Every document is protected by SHA-256 content hashing, and every action in the signing lifecycle is recorded in an immutable audit trail.

Document Integrity

SHA-256 File Hashing

Every document uploaded to the system receives a SHA-256 hash computed from the raw file content. This hash is stored on the Document record and serves two purposes:

1. Tamper detection: Any modification to the document after upload will produce a different hash
2. Chain of custody: The hash links the signed version to the exact content that was presented to signers

Document Types

The system supports 11 document types specific to HOA governance:

Signature Request Workflow

Document Lifecycle

Draft -> Pending Signatures -> Partially Signed -> Completed
                                                -> Declined
                                                -> Expired
                                                -> Voided

Role-Based Signing

Each signature request specifies a signer role from 11 HOA-specific roles:

• Board President, Board Member, Board Secretary, Board Treasurer
• Property Manager, Homeowner, Vendor, Contractor
• Witness, Notary, Other

Signing Order Enforcement

When enforce_signing_order is enabled on a document, the system prevents out-of-sequence signing:

• Each SignatureRequest has a signing_order integer
• The can_sign property checks that all previous signers (lower order numbers) have status signed
• If any predecessor has not signed, the current signer cannot proceed

This is essential for governance documents where the board president must sign before the secretary certifies, or where a vendor must countersign after the board approves.

Signer Authentication

Five authentication methods are available, configurable per signer:

Authentication method is set per SignatureRequest, allowing different levels of verification for different signers on the same document.

Signature Capture

The Signature model captures comprehensive metadata for each signature:

Signature Types

• Hand Drawn (canvas capture)
• Typed (typed name as signature)
• Uploaded Image (signature image upload)
• Digital Certificate (PKI-based)
• Official Stamp (organizational stamp)

Forensic Metadata

Every signature records: - IP address: Network origin of the signing event - User agent: Browser/device identification - Location data: Geographic coordinates (when available) - Biometric data: Signature pressure and velocity (for drawn signatures) - Consent: Explicit consent acknowledgment - Intent to sign: Affirmative intent declaration - Timestamp: Server-side timestamp - Timestamp authority: External TSA if used

Audit Trail

The AuditLog model records 17 distinct action types across the document lifecycle:

Every audit entry records the user, signature request (if applicable), action details (JSON), IP address, user agent, and server timestamp.

Certificate of Completion

When all signatures are collected, the system generates a CertificateOfCompletion:

• Certificate number: Unique identifier for the certified document
• Summary: Human-readable summary of the signing events
• Signatures data: JSON snapshot of all signature metadata
• Audit trail hash: SHA-256 hash of the complete audit trail, ensuring the trail itself cannot be modified after certification
• Certificate PDF: Generated document stored alongside the original

Document Templates

The DocumentTemplate system provides reusable templates across 8 categories (Board, Vendor, Homeowner, Compliance, Financial, Maintenance, Legal, Other) with:

• Pre-defined signature field placements
• Merge field mappings for dynamic content
• Per-community or public availability
• Usage tracking for template analytics