Trust Center

Consent Policies

The REFRACT system consent policies, with the full text, SHA-256, and file of every version the products can present, and how to publish and select your own policy.

Last updated: 2026-10-21.

Before a participant outside your organization signs a document, completes a request, or receives a document, REFRACT can show them a consent policy and ask them to accept it. The record of that step names exactly which text they accepted: the policy's id, its version, and the SHA-256 of the policy file's bytes.

Unless a template names its own policy, each product shows its own REFRACT system policy. This page is the published registry of those policies. When a signature certificate or a sealed workflow's evidence appendix says a policy was verified against the published registry, it refers to the entries on this page. Every version the products can present is listed, including a version that is no longer the default, because a record created with it keeps citing it for as long as the record is kept. A new version is added here in the release that makes it the default.

Awaiting counsel review

refract-standard-consent-request 2026.1 and refract-standard-consent-delivery 2026.1 are conservative starter text awaiting counsel review. Reviewed wording ships as a new version with a new SHA-256. A version on this page is never edited, so a record created with it can always be checked against the text here.


The System Policies

PolicyProductDefault versionWorded for
refract-standard-consentREFRACT eSign2026.2Signing a document electronically
refract-standard-consent-requestREFRACT Workflow2026.1Completing and submitting a request, or reviewing it
refract-standard-consent-deliveryREFRACT Delivery2026.1Receiving documents electronically

The policy is chosen when the session, workflow, or delivery is created, and its bytes are stored with that record. A later version, or a change to the template, never changes what an existing record shows or cites.


Registry

PolicyVersionStatusSHA-256File
refract-standard-consent2026.2Default4232fee5e058c0e607774dd73874cbad09b528f5bc1ac89c9ec8691b9784ce57refract-standard-consent-2026.2.yaml
refract-standard-consent2026.1Superseded by 2026.2a9a3a70611689577333a1502fb3f566a4b8ce8eeaa645a777effc276bf860949refract-standard-consent-2026.1.yaml
refract-standard-consent-request2026.1Awaiting counsel review7174fddc6c4f33052d6bb841f74e2ac61d2688e83d79120581a9761636b60769refract-standard-consent-request-2026.1.yaml
refract-standard-consent-delivery2026.1Awaiting counsel review1f1ea5631d62b094e90f183fb60f92fd5cd4deca7c54f99b46ec0acca6128f3crefract-standard-consent-delivery-2026.1.yaml

Checking a File

The SHA-256 is computed over the file's exact bytes. The files use LF line endings, so a copy saved with CRLF line endings, or edited in any way, has a different hash.

macOS or Linux
sha256sum refract-standard-consent-2026.2.yaml
Windows PowerShell
(Get-FileHash .\refract-standard-consent-2026.2.yaml -Algorithm SHA256).Hash.ToLower()

A system policy is recorded with provenance system only when the bytes it was loaded from hash to the registry entry for its version. A policy you publish yourself is recorded with provenance tenant, with its own SHA-256.


Full Text

Each file below is shown exactly as published. The comment at the top of each file is part of its bytes, and so part of its SHA-256. Text in double braces, such as {{organizationName}}, is a token, filled in when the policy is shown (see Tokens).

Shown by REFRACT eSign to every signer, before the document. Worded for signing a document electronically.

The default for REFRACT eSign.

refract-standard-consent-2026.2.yaml
# REFRACT standard consent policy, version 2026.2.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q13). It is
# deliberately conservative and is not a draft: it ships and is shown to signers as written.
# It says what 2026.1 says, section by section, set out as paragraphs and lists, and names the
# sender and the document through tokens filled in when the policy is shown (consent spec 3.5).
# Counsel's edits ship as a new version (a new file version and a new registry entry); this
# version is never edited, because envelopes created with it keep its text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
  schemaVersion: 2
  id: refract-standard-consent
  version: "2026.2"
  title: Consent to use electronic records and signatures
  sections:
    - heading: What this consent covers
      blocks:
        - paragraph: You have been asked by {{organizationName}} to review and sign {{documentName}} electronically.
        - paragraph: "This consent covers:"
        - bullets:
            - "{{documentName}} itself"
            - the records about it that are provided to you
            - your electronic signature on it
        - paragraph: If you consent, you agree to use an **electronic signature in place of a handwritten signature** on {{documentName}}.
    - heading: Paper copies
      blocks:
        - paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}}. Contact them directly to ask, and to find out whether a fee applies.
    - heading: Withdrawing your consent
      blocks:
        - paragraph: You may **decline to sign** instead of giving consent.
        - paragraph: "You may also withdraw your consent before you sign, by:"
        - bullets:
            - declining to sign, or
            - contacting {{organizationName}}.
        - paragraph: Withdrawing your consent does not affect records already provided to you electronically, or the effect of a signature you have already given.
    - heading: What you need
      blocks:
        - paragraph: "To review and sign electronically you need:"
        - bullets:
            - a device with a current web browser
            - access to the email address this document was sent to
            - software that can open PDF files
        - paragraph: To keep a copy, you need to be able to save or print a PDF file.
    - heading: Keeping your contact details up to date
      blocks:
        - paragraph: If your email address changes, tell {{organizationName}}.
  acknowledgements:
    - key: electronic-records
      label: I consent to receive and sign this document and its records electronically.
    - key: can-access
      label: I can open and keep PDF files on the device I am using.
  action:
    label: Agree and continue

Superseded by 2026.2. Schema 1: plain paragraphs, no tokens. A record created with it keeps citing it.

refract-standard-consent-2026.1.yaml
# REFRACT standard consent policy, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q13). It is
# deliberately conservative and is not a draft: it ships and is shown to signers as written.
# Counsel's edits ship as a new version (a new file version and a new registry entry); this
# version is never edited, because envelopes created with it keep its text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
  schemaVersion: 1
  id: refract-standard-consent
  version: "2026.1"
  title: Consent to use electronic records and signatures
  sections:
    - heading: What this consent covers
      paragraphs:
        - The organization that sent you this document is asking you to review and sign it electronically. This consent covers this document, the records about it that are provided to you, and your electronic signature on it.
        - If you consent, you agree to use an electronic signature on this document in place of a handwritten signature.
    - heading: Paper copies
      paragraphs:
        - You may ask the organization that sent you this document for a paper copy of it. Contact them directly to ask, and to find out whether a fee applies.
    - heading: Withdrawing your consent
      paragraphs:
        - You may decline to sign this document instead of giving consent. You may also withdraw your consent before you sign by declining to sign, or by contacting the organization that sent you this document.
        - Withdrawing your consent does not affect records already provided to you electronically, or the effect of a signature you have already given.
    - heading: What you need
      paragraphs:
        - "To review and sign electronically you need: a device with a current web browser, access to the email address this document was sent to, and software that can open PDF files. To keep a copy, you need to be able to save or print a PDF file."
    - heading: Keeping your contact details up to date
      paragraphs:
        - If your email address changes, tell the organization that sent you this document.
  acknowledgements:
    - key: electronic-records
      label: I consent to receive and sign this document and its records electronically.
    - key: can-access
      label: I can open and keep PDF files on the device I am using.
  action:
    label: Continue to document

Shown by REFRACT Workflow to each participant outside your organization (the person asked to complete the request, and an approver who reviews it on a link), before the form loads. Worded for completing and submitting a request, or reviewing it.

The default for REFRACT Workflow. Awaiting counsel review.

refract-standard-consent-request-2026.1.yaml
# REFRACT standard consent policy for requests, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q14). It is
# deliberately conservative and is not a draft: it ships and is shown as written. It is the
# system policy for workflow: the external participants of a request see it before the form
# loads, the person asked to complete and submit it and an approver asked to review it. It
# follows refract-standard-consent 2026.2 section by section, worded for completing and
# submitting a request instead of signing, and uses the same tokens, filled in when the policy
# is shown (consent spec 3.5). Counsel's edits ship as a new version (a new file version and a
# new registry entry); this version is never edited, because requests created with it keep its
# text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
  schemaVersion: 2
  id: refract-standard-consent-request
  version: "2026.1"
  title: Consent to use electronic records for this request
  sections:
    - heading: What this consent covers
      blocks:
        - paragraph: You have been asked by {{organizationName}} to take part in {{documentName}} electronically, by completing and submitting it or by reviewing it.
        - paragraph: "This consent covers:"
        - bullets:
            - "{{documentName}} itself"
            - the information you enter and submit in it
            - any decision you give on it
            - the records about it that are provided to you
        - paragraph: If you consent, you agree to **complete, submit and review this request electronically, instead of on paper**, and that what you submit and any decision you give are recorded electronically.
    - heading: Paper copies
      blocks:
        - paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}} and of the records about it. Contact them directly to ask, and to find out whether a fee applies.
        - paragraph: You may also ask {{organizationName}} whether you can complete {{documentName}} on paper instead.
    - heading: Withdrawing your consent
      blocks:
        - paragraph: You may **decline** instead of giving consent.
        - paragraph: "You may also withdraw your consent before you submit {{documentName}} or give a decision on it, by:"
        - bullets:
            - declining, or
            - contacting {{organizationName}}.
        - paragraph: If you decline, you cannot continue with {{documentName}} electronically, and {{organizationName}} is told that you declined.
        - paragraph: Withdrawing your consent does not affect records already provided to you electronically, information you have already submitted, or a decision you have already given.
    - heading: What you need
      blocks:
        - paragraph: "To take part electronically you need:"
        - bullets:
            - a device with a current web browser
            - access to the email address this request was sent to
            - software that can open PDF files
        - paragraph: To keep a copy, you need to be able to save or print a PDF file.
    - heading: Keeping your contact details up to date
      blocks:
        - paragraph: If your email address changes, tell {{organizationName}}.
  acknowledgements:
    - key: electronic-records
      label: I consent to take part in this request and to receive its records electronically.
    - key: can-access
      label: I can open and keep PDF files on the device I am using.
  action:
    label: Agree and continue

Shown by REFRACT Delivery to a recipient, before the document is provided, when the template requires consent. Worded for receiving documents electronically.

The default for REFRACT Delivery. Awaiting counsel review.

refract-standard-consent-delivery-2026.1.yaml
# REFRACT standard consent policy for document delivery, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q14). It is
# deliberately conservative and is not a draft: it ships and is shown as written. It is the
# system policy for Delivery: a recipient sees it before the document is provided. It follows
# refract-standard-consent 2026.2 section by section, worded for receiving documents
# electronically instead of signing, and uses the same tokens, filled in when the policy is
# shown (consent spec 3.5). Counsel's edits ship as a new version (a new file version and a new
# registry entry); this version is never edited, because deliveries created with it keep its
# text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
  schemaVersion: 2
  id: refract-standard-consent-delivery
  version: "2026.1"
  title: Consent to receive documents electronically
  sections:
    - heading: What this consent covers
      blocks:
        - paragraph: "{{organizationName}} would like to provide {{documentName}} to you electronically."
        - paragraph: "This consent covers:"
        - bullets:
            - "{{documentName}} itself"
            - the records about it that are provided to you
        - paragraph: If you consent, you agree to **receive this document and its records electronically, instead of on paper**.
    - heading: Paper copies
      blocks:
        - paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}}. Contact them directly to ask, and to find out whether a fee applies.
    - heading: Withdrawing your consent
      blocks:
        - paragraph: You may **decline** instead of giving consent.
        - paragraph: If you decline, {{documentName}} is not provided to you through this link, and {{organizationName}} is told that you declined. Contact them to receive it another way.
        - paragraph: You may also withdraw your consent later, by contacting {{organizationName}}.
        - paragraph: Withdrawing your consent does not affect documents and records already provided to you electronically.
    - heading: What you need
      blocks:
        - paragraph: "To receive documents electronically you need:"
        - bullets:
            - a device with a current web browser
            - access to the email address this document was sent to
            - software that can open PDF files
        - paragraph: To keep a copy, you need to be able to save or print a PDF file.
    - heading: Keeping your contact details up to date
      blocks:
        - paragraph: If your email address changes, tell {{organizationName}}.
  acknowledgements:
    - key: electronic-records
      label: I consent to receive this document and its records electronically.
    - key: can-access
      label: I can open and keep PDF files on the device I am using.
  action:
    label: Agree and continue

Publishing Your Own Policy

Any system policy can be the starting point for your own. Your policy is shown in place of the system policy for every template that names it.

  1. Download a starting file. Use the download link of the system policy closest to what you need, from the Registry.
  2. Give it your own id. The id is 3 to 64 characters of lowercase letters, digits, and hyphens, starting with a letter or a digit. It cannot start with refract-, which is reserved for the system policies. For example, acme-consumer-records.
  3. Set a version. Up to 32 characters of letters, digits, ., _, and -, for example 2026.1. Change it whenever you change the text, so two texts never share a version.
  4. Write the text. Replace the comment at the top with your own, or remove it, and edit the title, sections, statements, and button label. The rules are in Policy File Format.
  5. Publish it in SharePoint. Upload the file to your SharePoint assets library as consent-policies/{id}.yaml, where {id} is the file's own id. For example, consent-policies/acme-consumer-records.yaml.
  6. Select it in the template. Set consent.policyId to the same id in the template's settings for each product that should show it (below).

The policy is read and checked when each session, workflow, or delivery is created, and the exact bytes are stored with that record. Changing the file later applies to records created after the change, never to existing ones.

Selecting a Policy With consent.policyId

Each product has its own consent block, inside that product's template settings:

Template settings
{
  "templateSettings": {
    "esign":    { "consent": { "mode": "required", "policyId": "acme-consumer-records" } },
    "workflow": { "consent": { "mode": "required", "policyId": "acme-consumer-records" } },
    "delivery": { "mode": "SECURE_LINK", "consent": { "mode": "required", "policyId": "acme-consumer-records" } }
  }
}
SettingValuesNotes
moderequired or noneeSign is always required; none is refused. Workflow defaults to required. Delivery defaults to none, and required needs delivery mode SECURE_LINK, because the step is shown on the portal link.
policyIdThe id of your policyOptional. Leave it out to show the product's system policy. The file consent-policies/{policyId}.yaml must declare the same id.
contacts{ "withdrawal": "...", "paperCopy": "..." }Optional. Text, such as an email address or a short instruction, for the {{withdrawalContact}} and {{paperCopyContact}} tokens.

The consent block is read from the template only. A request that sets it is refused with consent_not_request_settable.

A template with no consent block gets the product's default mode and its system policy.

Policy File Format

A policy file is UTF-8 YAML, without a byte order mark, at most 32 KB.

consent-policies/acme-consumer-records.yaml
consentPolicy:
  schemaVersion: 2
  id: acme-consumer-records
  version: "2026.1"
  title: Consent to receive records electronically
  sections:
    - heading: What this consent covers
      blocks:
        - paragraph: "{{organizationName}} would like to provide {{documentName}} to you electronically."
        - bullets:
            - "{{documentName}} itself"
            - the records about it that are provided to you
  acknowledgements:
    - key: electronic-records
      label: I consent to receive this document and its records electronically.
  action:
    label: Agree and continue
FieldRules
schemaVersion2.
id, versionAs in steps 2 and 3 above.
titleUp to 200 characters.
sections1 to 20. Each has a heading (up to 200 characters) and blocks, 1 to 50 of them: a paragraph (up to 4,000 characters) or bullets (1 to 20 items, up to 1,000 characters each). Paragraphs and bullets may use **bold**.
acknowledgements1 to 10 statements the participant ticks, each a key (lowercase letters, digits, and hyphens) and a label (up to 500 characters). Each one starts unticked, and all must be ticked to continue. Labels take no tokens: the record holds each label word for word.
actionThe button's label, up to 60 characters.
contactOptional. One link, a label and an href that is a mailto: address or an https:// URL.

YAML anchors, merge keys, HTML, and markdown links are refused. Quote a value that starts with a token, as in the example, because YAML reads an unquoted { as the start of a mapping.

Tokens

TokenFilled withWhen there is no value
{{organizationName}}The sender's organization"the organization that sent you this document"
{{documentName}}The document's name, or the request's title"this document"
{{senderName}}The sender's name"the person who sent you this document"
{{contactEmail}}The template's contact email"the organization that sent you this document"
{{withdrawalContact}}consent.contacts.withdrawal, else the contact email"the organization that sent you this document"
{{paperCopyContact}}consent.contacts.paperCopy, else the contact email"the organization that sent you this document"

Token values are captured when the record is created and stored with it, so a later edit to the template does not change the text a participant was shown.

When a Policy Cannot Be Used

The session, workflow, or delivery is not created, and the answer names the problem. Nothing falls back to another policy.

CodeCause
consent_policy_unreadableconsent-policies/{policyId}.yaml could not be read from the assets library.
consent_policy_invalidThe file does not follow the format above, or its id is not the policyId that named it.
consent_setting_invalidThe template's consent block is malformed: a mode other than required or none, a key it does not have, a contact that is not 1 to 200 characters of text, or a policyId that is not 1 to 80 characters of letters, digits, ., _, and -, contains .., or starts with the reserved refract- prefix.
consent_mode_not_allowedThe eSign block sets mode to none.
consent_requires_portal_linkThe Delivery block requires consent with delivery mode SHAREPOINT or BOTH.

See Error Responses and Codes for every consent code.

On this page