REFRACT Audit
REFRACT Audit is the audit layer of REFRACT Platform. Lifecycle events across REFRACT PDF, REFRACT eSign, REFRACT Delivery, REFRACT Workflow, and Data Redaction are recorded to append-only logs that answer compliance and governance questions in a single view.
REFRACT Audit is the audit layer that runs beneath every REFRACT Platform product. As documents move through generation, signing, delivery, and archival, REFRACT Audit captures each meaningful lifecycle event and writes it to a JSONL log. eSign and Workflow events are written to a cryptographically chained log per document; other product events are written to an unchained, append-only operational log. The result is a timeline that compliance officers, auditors, and security teams can read without needing access to individual product APIs.
Cross-product by design
REFRACT Audit is not a standalone product - it is the shared audit layer for the REFRACT Platform family. REFRACT PDF, REFRACT eSign, REFRACT Delivery, REFRACT Workflow, and Data Redaction all emit events that REFRACT Audit stores and surfaces in the Lifecycle Workspace timeline.
What REFRACT Audit Does
Append-Only Audit Timeline
eSign and Workflow events are written to a cryptographically chained JSONL log per document - each entry carries the hash of the one before it, so removing or altering an entry is detectable. Other product events are written to an unchained, append-only operational log.
Severity-Based Filtering
Events are classified as information, compliance, security, governance, or failure. The Lifecycle Workspace surfaces Executive, Compliance, Security, and Full timeline views from this classification without any schema changes.
Level 2 Sub-Event Trails
Operational detail events - signer invitation, OTP challenge, delivery link opened - are grouped as sub-events beneath their Level 1 parent, keeping the compliance timeline clean while preserving full auditability.
Integrity Verification
On-demand SHA-256 hash verification detects whether a document has changed since generation. The result is appended to the audit log and surfaced in the timeline.
Verify & Reproduce
Documents can be reproduced from the .raudit archive and their output hash compared to the original, showing whether the archive reproduces the recorded output.
Certificate of Verification
A downloadable evidence certificate summarising the document's audit trail, integrity status, signer identities, and archival record - for external auditors and for attachment to submissions; counsel decides evidentiary use.
Business Questions REFRACT Audit Answers
REFRACT Audit is built around the questions compliance officers, auditors, and security teams actually ask - not around technical operations. Every Level 1 event maps to at least one answerable question.
| Business Question | REFRACT Audit Event | Severity |
|---|---|---|
| Was this document generated by our controlled system, and when? | Document Generated | information |
| Was the document's integrity verified at the point of creation? | Integrity Verified | compliance |
| Did the document go through an approval workflow before it was signed? | Document Sealed | compliance |
| Who approved it, and were any changes requested before approval? | Workflow Approved / Changes Requested | governance |
| Was the signer's identity verified before they applied their signature? | Identity Verified | security |
| Did all required parties sign the document? | Document Signed (per signer) | compliance |
| Was the signed document delivered to the intended recipient? | Document Delivered | information |
| Has the archived document been altered since it was generated? | Integrity Re-verified | compliance |
| Can we reproduce the document byte-for-byte from the archive? | Document Reproduced | compliance |
| Has a complete evidence bundle been exported for legal or regulatory use? | Evidence Exported | compliance |
| Is the document safely archived, in storage that can be write-locked? | Archived to Write-Once Storage | compliance |
The Complete Document Timeline
For a fully signed, delivered, and archived document, the REFRACT Audit timeline reads as a chronological story of governance - not a log of system operations. The example below shows a vendor contract that passed through a REFRACT Workflow approval, was countersigned by two parties in sequence, delivered to the recipient, and archived.
Illustrative Example
The following scenario is fictional and intended to demonstrate how lifecycle events and evidence trails may appear in a production deployment.
Document: Vendor Contract - ACME Supplier Agreement
CorrelationId: vc-2026-0601-acme
Level 1 Timeline - what compliance officers and auditors see:
[08:12:33] Document Generated REFRACT PDF information
[08:12:34] Integrity Verified REFRACT Audit compliance
[08:14:01] Submitted for Review REFRACT Workflow governance
[08:14:02] Sent for Approval REFRACT Workflow governance
[08:45:18] Workflow Approved REFRACT Workflow governance
[08:45:19] Document Sealed REFRACT Workflow compliance
[09:02:44] Sent for Signature REFRACT eSign information
[09:10:12] Identity Verified - J. Smith REFRACT eSign security
[09:14:22] Document Signed - J. Smith REFRACT eSign compliance
[09:15:08] Identity Verified - M. Johnson REFRACT eSign security
[09:16:44] Document Signed - M. Johnson REFRACT eSign compliance
[09:17:01] Document Delivered REFRACT Delivery information
[09:17:02] Archived to Write-Once Storage REFRACT Audit compliance
Level 2 Sub-Event Trails - visible in the Full view and expanded on demand:
Document Signed - J. Smith (Slot 0, vendor, sequential)
├─ 09:02:44 Session Created REFRACT eSign session initialised
├─ 09:02:45 Invitation Sent Signing invitation dispatched to j.smith@acme.com
├─ 09:09:33 Signer Opened Portal J. Smith accessed the signing portal via unique link
├─ 09:09:34 OTP Challenge Issued One-time passcode generated and dispatched
├─ 09:10:12 OTP Verified J. Smith passed identity verification (email OTP)
├─ 09:14:22 Document Signed All manifest fields completed; signature submitted
├─ 09:14:23 Evidence Package Generated Tamper-evident evidence assembled and stored
└─ 09:14:24 Session Closed Slot 0 sealed; slot 1 invitation queued
Document Signed - M. Johnson (Slot 1, manager, sequential)
├─ 09:14:25 Invitation Sent Next-signer invitation dispatched (sequential activation)
├─ 09:14:55 Signer Opened Portal M. Johnson accessed the signing portal
├─ 09:14:56 OTP Challenge Issued One-time passcode generated and dispatched
├─ 09:15:08 OTP Verified M. Johnson passed identity verification (email OTP)
├─ 09:16:44 Document Signed Signature submitted; final seal queued
├─ 09:16:45 Evidence Package Generated
└─ 09:16:46 Session Closed All required slots complete; PDF sealed
Document Delivered (recipient: procurement@contoso.com)
├─ 09:17:01 Session Created Delivery session initialised
├─ 09:17:02 Notification Sent Delivery notification dispatched to recipient
├─ 09:32:14 Delivery Link Opened Recipient accessed the secure delivery portal
├─ 09:32:15 Identity Verified Recipient passed the delivery access challenge
├─ 09:33:01 Document Downloaded Recipient retrieved the document
└─ 09:33:02 Session Completed Delivery session closedSeal before signature - what the audit chain shows
The Document Sealed timestamp [08:45:19] precedes the first signing session [09:02:44] by 17 minutes. The audit chain records the seal timestamp before the first signing session, showing that the document was reviewed, approved, and sealed before any signer ever saw it. The compliance timeline answers this question without any query into the workflow system.
Event Levels
REFRACT Audit uses a two-level structure to balance readability with completeness.
Level 1 - Timeline Events
Level 1 events represent meaningful business or compliance milestones. They are always written to the audit log and shown in the Lifecycle Workspace timeline. These are the events that regulators, compliance officers, and managers read.
Examples: Document Generated, Integrity Verified, Document Signed, Archived to Write-Once Storage.
Level 2 - Sub-Event Trails
Level 2 sub-events are the operational steps that make up a Level 1 milestone. They are grouped beneath their parent and expanded on demand. They are always written to the audit log but do not appear in filtered compliance views.
eSign trail (sub-events of Document Signed):
- Session Created
- Invitation Sent
- Signer Opened Portal
- OTP Challenge Issued
- OTP Verified
- Document Signed
- Evidence Package Generated
- Session Closed
When they occur, the eSign trail also includes Signing Invitation Re-sent, Signer Locked Out of Codes, Signing Code Lock Cleared, Device Transfer Link Created, Signing Moved to Another Device, and Signing Attempt Refused.
Delivery trail (sub-events of Document Delivered):
- Session Created
- Notification Sent
- Delivery Link Opened
- Identity Verified
- Document Downloaded
- Session Completed
Workflow detail (sub-events of workflow milestones):
Step Submitted, Step Advanced, Approver Opened Task, and Seal Initiated appear as sub-events of the preceding workflow timeline milestone rather than standalone Level 1 entries.
Severity Classification
Every Level 1 event carries a severity that controls which timeline view it appears in.
| Severity | Description | Representative Events |
|---|---|---|
information | High-level lifecycle progress | Document Generated, Sent for Signature, Document Delivered, Submitted for Review |
compliance | Events regulators and auditors must see | Integrity Verified, Accessibility Checked, Document Signed, Document Sealed, Document Protected, Archived to Write-Once Storage, Evidence Exported, Integrity Re-verified, Document Reproduced |
security | Identity and access events | Identity Verified (OTP), Access Revoked |
governance | Workflow state transitions | Sent for Approval, Changes Requested, Resubmitted, Workflow Approved, Workflow Cancelled |
failure | Error and rejection events | Render Failed, Workflow Rejected |
Timeline Views
| View | Severities Shown | Audience |
|---|---|---|
| Executive | information, compliance | Senior leadership, document owners |
| Compliance | compliance, security | Compliance officers, auditors |
| Security | security, failure | Security teams, risk reviewers |
| Full | All severities | Administrators, support |
Append-Only Storage
REFRACT Audit writes to two kinds of log, both in your Azure Blob Storage:
- The eSign and Workflow chains. One JSONL file per document, at
esign/{tenantId}/{correlationId}.jsonlandworkflow/{tenantId}/{correlationId}.jsonl. Each line carries_chain: {seq, prevHash, hmac, chain, kid, algorithm}- the HMAC and the previous entry's hash, so removing, reordering, or altering an entry breaks the chain from that point forward and is detectable on verification. - The general render audit log. A monthly-rolling, unchained JSONL stream covering render events (
PDFGenerated, etc.) across all documents, written either to your SharePointAuditLogslibrary or an Azure Blob container, depending on your audit tier configuration. It has no_chainfield.
Neither log is modified in place - both are append-only. Whether entries also become undeletable depends on your storage account's write-once (WORM) immutability policy, which is deployed unlocked by default; it protects against modification and accidental deletion until it is explicitly locked at your account. See Retention Policy for the locking model.
Verify & Reproduce
REFRACT Audit provides two flagship verification operations accessible from the REFRACT Lifecycle workspace.
Verify Integrity
Triggers an on-demand SHA-256 re-verification of the stored document against the hash recorded at generation time. The result is one of PASS, FAIL, INDETERMINATE, or NOT_VERIFIABLE (or an HTTP 404 when no audit record exists for the document at all) and is shown in the timeline under Integrity Re-verified. See Event Reference for what each result means.
Reproduce
Re-renders the document from the .raudit archive using the original template and original payload, then compares the output hash to the generation-time hash. A matching hash shows the archive is complete and the render engine reproduces the same output from the same inputs.
The reproduction result is appended to the audit log as a reproduced event and shown in the timeline as Document Reproduced, with the comparison outcome and any hash delta.
Certificate of Verification
After a successful Verify or Reproduce operation, a Certificate of Verification can be generated from the REFRACT Lifecycle workspace. The certificate includes:
- Document identity (CorrelationId, DocumentId, DocType)
- Generation timestamp and engine version
- Template and payload paths
- Original SHA-256 hash and verification result
- Signer identities and OTP verification status (if signed)
- Archival status and audit log reference
- Verification timestamp and operator identity
The certificate is a signed PDF for attachment to regulatory submissions or contract archives; counsel decides evidentiary use.
Scenarios
Scenario 1 - Annual Audit: Prove the Governance Chain for a Vendor Contract
Illustrative Example
The following scenario is fictional and intended to demonstrate how lifecycle events and evidence trails may appear in a production deployment.
Business context: Finance controller needs to demonstrate proper controls to external
auditors. A vendor contract went through REFRACT Workflow for approval, REFRACT eSign for
counter-signature (2 signers), and REFRACT Delivery for recipient delivery.
Document: Vendor Contract VC-2026-0601 (Acme Corp)
Executive view (information + compliance severities):
2026-06-01 08:00 UTC [information] REFRACT PDF Document Generated
2026-06-01 08:00 UTC [compliance] REFRACT Audit Integrity Verified
2026-06-01 10:22 UTC [compliance] REFRACT Workflow Document Sealed
2026-06-01 11:05 UTC [compliance] REFRACT eSign Document Signed - slot 0: vendor@acme.com
2026-06-01 11:29 UTC [compliance] REFRACT eSign Document Signed - slot 1: director@contoso.com
2026-06-01 11:30 UTC [information] REFRACT Delivery Document Delivered
2026-06-01 11:30 UTC [compliance] REFRACT Audit Archived to Write-Once Storage
Auditor questions this trail answers:
✓ Was the document generated by our controlled system? → Document Generated (08:00 UTC)
✓ Was document integrity verified at generation time? → Integrity Verified (08:00 UTC)
✓ Did it go through a governed approval workflow? → Document Sealed (10:22 UTC)
✓ Was each signer's identity verified before signing? → Security view: Identity Verified × 2
✓ Did both required parties sign? → Document Signed × 2
✓ Was the signed document delivered to the counterparty? → Document Delivered (11:30 UTC)
✓ Is the document archived in storage that can be write-locked? → Archived to Write-Once Storage (11:30 UTC)
For deeper investigation (Full view, Level 2 expanded):
Each Document Signed event's chain entry can be traced back through
the eSign session's hash chain to the invitation and signing
timestamps recorded for that signer slot.Scenario 2 - Legal Dispute: Export Evidence for a Contract Under Challenge
Illustrative Example
The following scenario is fictional and intended to demonstrate how lifecycle events and evidence trails may appear in a production deployment.
Business context: A service agreement is under dispute. Legal counsel needs to
produce a complete evidence package showing the document's chain of custody -
who created it, who signed it under verified identity, and that it has not
been altered since signing.
Actions taken in REFRACT Lifecycle Workspace:
1. Run Verify Integrity → SHA-256 re-verification against generation-time hash
2. Download Certificate of Verification (signed PDF)
3. Export Evidence Bundle (full JSONL audit log + certificate)
Audit trail after these actions:
[compliance] 2026-06-10 14:33 UTC REFRACT Audit Integrity Re-verified - result: PASS
[compliance] 2026-06-10 15:00 UTC REFRACT Audit Evidence Exported - format: JSONL + certificate
Questions the evidence package answers for legal or arbitration proceedings:
✓ When was the document created, and by which system? → generated (timestamp + engine version)
✓ Was it modified before the parties signed? → integrity-validated hash matches document-signed hash
✓ Was each signer's identity verified? → Identity Verified (OTP method + slot index)
✓ Did each signer give informed consent to e-signing? → evidence certificate: verbatim consent text + timestamp
✓ Has the document been altered since sealing? → Integrity Re-verified: PASS
✓ Who ran the verification and exported the evidence? → actorName + actorEmail on Integrity Re-verified and Evidence Exported eventsScenario 3 - Security Review: Spot-Check Archived Financial Documents
Illustrative Example
The following scenario is fictional and intended to demonstrate how lifecycle events and evidence trails may appear in a production deployment.
Business context: CISO requests annual verification that archived AP invoices match
their original generation-time hashes. REFRACT Audit's Reproduce operation re-renders
each document from the .raudit archive and compares the output hash to the original,
proving the archive is complete and the render is deterministic.
Action: Reproduce operation run on AP Invoice INV-2026-8821
Archive retrieved: audit/Invoice/2026/06/3f9c2a1e-7b4d-4e8a-9c51-2d6f0a8b7e13.raudit
Re-render output hash: sha256:b3d4e5f6a1b2c3d4...
Generation-time hash: sha256:b3d4e5f6a1b2c3d4...
Result: MATCHED - document reproduced byte-for-byte from the archive
Audit trail appended:
[compliance] 2026-06-12 09:15 UTC REFRACT Audit Document Reproduced - result: matched
Security questions this answers:
✓ Is the archive complete and uncorrupted? → reproduced: matched
✓ Is the render engine still deterministic? → same inputs produce the same SHA-256 output
✓ Could an adversary have replaced the stored PDF? → hash mismatch produces reproduced: mismatch
✓ Is there a permanent record that this check was run? → Document Reproduced event appended to audit JSONLREFRACT Audit Event Reference
Full reference for every Level 1 audit event - type, severity, product source, display title, and the Level 2 sub-event trails each carries.
Append-Only Archive - Retention Policy
Retention period, write-lock behaviour, applicable compliance standards (SOX, IRS, EU Directive 2013/34), and GDPR Article 17 considerations for archived documents.
Reports & System Status
The REFRACT Lifecycle Reports page provides operational health reports for your REFRACT Platform deployment, including the System Status Check PDF and platform update checks.
Event Reference
Complete reference for every REFRACT Audit Level 1 timeline event - event type, severity, product source, and display title.