Consent Policies
The REFRACT system consent policies, with the full text, SHA-256, and file of every version the products can present, and how to publish and select your own policy.
Last updated: 2026-10-21.
Before a participant outside your organization signs a document, completes a request, or receives a document, REFRACT can show them a consent policy and ask them to accept it. The record of that step names exactly which text they accepted: the policy's id, its version, and the SHA-256 of the policy file's bytes.
Unless a template names its own policy, each product shows its own REFRACT system policy. This page is the published registry of those policies. When a signature certificate or a sealed workflow's evidence appendix says a policy was verified against the published registry, it refers to the entries on this page. Every version the products can present is listed, including a version that is no longer the default, because a record created with it keeps citing it for as long as the record is kept. A new version is added here in the release that makes it the default.
Awaiting counsel review
refract-standard-consent-request 2026.1 and refract-standard-consent-delivery 2026.1 are conservative starter text awaiting counsel review. Reviewed wording ships as a new version with a new SHA-256. A version on this page is never edited, so a record created with it can always be checked against the text here.
The System Policies
| Policy | Product | Default version | Worded for |
|---|---|---|---|
refract-standard-consent | REFRACT eSign | 2026.2 | Signing a document electronically |
refract-standard-consent-request | REFRACT Workflow | 2026.1 | Completing and submitting a request, or reviewing it |
refract-standard-consent-delivery | REFRACT Delivery | 2026.1 | Receiving documents electronically |
The policy is chosen when the session, workflow, or delivery is created, and its bytes are stored with that record. A later version, or a change to the template, never changes what an existing record shows or cites.
Registry
| Policy | Version | Status | SHA-256 | File |
|---|---|---|---|---|
refract-standard-consent | 2026.2 | Default | 4232fee5e058c0e607774dd73874cbad09b528f5bc1ac89c9ec8691b9784ce57 | refract-standard-consent-2026.2.yaml |
refract-standard-consent | 2026.1 | Superseded by 2026.2 | a9a3a70611689577333a1502fb3f566a4b8ce8eeaa645a777effc276bf860949 | refract-standard-consent-2026.1.yaml |
refract-standard-consent-request | 2026.1 | Awaiting counsel review | 7174fddc6c4f33052d6bb841f74e2ac61d2688e83d79120581a9761636b60769 | refract-standard-consent-request-2026.1.yaml |
refract-standard-consent-delivery | 2026.1 | Awaiting counsel review | 1f1ea5631d62b094e90f183fb60f92fd5cd4deca7c54f99b46ec0acca6128f3c | refract-standard-consent-delivery-2026.1.yaml |
Checking a File
The SHA-256 is computed over the file's exact bytes. The files use LF line endings, so a copy saved with CRLF line endings, or edited in any way, has a different hash.
sha256sum refract-standard-consent-2026.2.yaml(Get-FileHash .\refract-standard-consent-2026.2.yaml -Algorithm SHA256).Hash.ToLower()A system policy is recorded with provenance system only when the bytes it was loaded from hash to the registry entry for its version. A policy you publish yourself is recorded with provenance tenant, with its own SHA-256.
Full Text
Each file below is shown exactly as published. The comment at the top of each file is part of its bytes, and so part of its SHA-256. Text in double braces, such as {{organizationName}}, is a token, filled in when the policy is shown (see Tokens).
refract-standard-consent
Shown by REFRACT eSign to every signer, before the document. Worded for signing a document electronically.
refract-standard-consent 2026.2
The default for REFRACT eSign.
- SHA-256:
4232fee5e058c0e607774dd73874cbad09b528f5bc1ac89c9ec8691b9784ce57 - File: refract-standard-consent-2026.2.yaml
# REFRACT standard consent policy, version 2026.2.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q13). It is
# deliberately conservative and is not a draft: it ships and is shown to signers as written.
# It says what 2026.1 says, section by section, set out as paragraphs and lists, and names the
# sender and the document through tokens filled in when the policy is shown (consent spec 3.5).
# Counsel's edits ship as a new version (a new file version and a new registry entry); this
# version is never edited, because envelopes created with it keep its text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
schemaVersion: 2
id: refract-standard-consent
version: "2026.2"
title: Consent to use electronic records and signatures
sections:
- heading: What this consent covers
blocks:
- paragraph: You have been asked by {{organizationName}} to review and sign {{documentName}} electronically.
- paragraph: "This consent covers:"
- bullets:
- "{{documentName}} itself"
- the records about it that are provided to you
- your electronic signature on it
- paragraph: If you consent, you agree to use an **electronic signature in place of a handwritten signature** on {{documentName}}.
- heading: Paper copies
blocks:
- paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}}. Contact them directly to ask, and to find out whether a fee applies.
- heading: Withdrawing your consent
blocks:
- paragraph: You may **decline to sign** instead of giving consent.
- paragraph: "You may also withdraw your consent before you sign, by:"
- bullets:
- declining to sign, or
- contacting {{organizationName}}.
- paragraph: Withdrawing your consent does not affect records already provided to you electronically, or the effect of a signature you have already given.
- heading: What you need
blocks:
- paragraph: "To review and sign electronically you need:"
- bullets:
- a device with a current web browser
- access to the email address this document was sent to
- software that can open PDF files
- paragraph: To keep a copy, you need to be able to save or print a PDF file.
- heading: Keeping your contact details up to date
blocks:
- paragraph: If your email address changes, tell {{organizationName}}.
acknowledgements:
- key: electronic-records
label: I consent to receive and sign this document and its records electronically.
- key: can-access
label: I can open and keep PDF files on the device I am using.
action:
label: Agree and continuerefract-standard-consent 2026.1
Superseded by 2026.2. Schema 1: plain paragraphs, no tokens. A record created with it keeps citing it.
- SHA-256:
a9a3a70611689577333a1502fb3f566a4b8ce8eeaa645a777effc276bf860949 - File: refract-standard-consent-2026.1.yaml
# REFRACT standard consent policy, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q13). It is
# deliberately conservative and is not a draft: it ships and is shown to signers as written.
# Counsel's edits ship as a new version (a new file version and a new registry entry); this
# version is never edited, because envelopes created with it keep its text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
schemaVersion: 1
id: refract-standard-consent
version: "2026.1"
title: Consent to use electronic records and signatures
sections:
- heading: What this consent covers
paragraphs:
- The organization that sent you this document is asking you to review and sign it electronically. This consent covers this document, the records about it that are provided to you, and your electronic signature on it.
- If you consent, you agree to use an electronic signature on this document in place of a handwritten signature.
- heading: Paper copies
paragraphs:
- You may ask the organization that sent you this document for a paper copy of it. Contact them directly to ask, and to find out whether a fee applies.
- heading: Withdrawing your consent
paragraphs:
- You may decline to sign this document instead of giving consent. You may also withdraw your consent before you sign by declining to sign, or by contacting the organization that sent you this document.
- Withdrawing your consent does not affect records already provided to you electronically, or the effect of a signature you have already given.
- heading: What you need
paragraphs:
- "To review and sign electronically you need: a device with a current web browser, access to the email address this document was sent to, and software that can open PDF files. To keep a copy, you need to be able to save or print a PDF file."
- heading: Keeping your contact details up to date
paragraphs:
- If your email address changes, tell the organization that sent you this document.
acknowledgements:
- key: electronic-records
label: I consent to receive and sign this document and its records electronically.
- key: can-access
label: I can open and keep PDF files on the device I am using.
action:
label: Continue to documentrefract-standard-consent-request
Shown by REFRACT Workflow to each participant outside your organization (the person asked to complete the request, and an approver who reviews it on a link), before the form loads. Worded for completing and submitting a request, or reviewing it.
refract-standard-consent-request 2026.1
The default for REFRACT Workflow. Awaiting counsel review.
- SHA-256:
7174fddc6c4f33052d6bb841f74e2ac61d2688e83d79120581a9761636b60769 - File: refract-standard-consent-request-2026.1.yaml
# REFRACT standard consent policy for requests, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q14). It is
# deliberately conservative and is not a draft: it ships and is shown as written. It is the
# system policy for workflow: the external participants of a request see it before the form
# loads, the person asked to complete and submit it and an approver asked to review it. It
# follows refract-standard-consent 2026.2 section by section, worded for completing and
# submitting a request instead of signing, and uses the same tokens, filled in when the policy
# is shown (consent spec 3.5). Counsel's edits ship as a new version (a new file version and a
# new registry entry); this version is never edited, because requests created with it keep its
# text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
schemaVersion: 2
id: refract-standard-consent-request
version: "2026.1"
title: Consent to use electronic records for this request
sections:
- heading: What this consent covers
blocks:
- paragraph: You have been asked by {{organizationName}} to take part in {{documentName}} electronically, by completing and submitting it or by reviewing it.
- paragraph: "This consent covers:"
- bullets:
- "{{documentName}} itself"
- the information you enter and submit in it
- any decision you give on it
- the records about it that are provided to you
- paragraph: If you consent, you agree to **complete, submit and review this request electronically, instead of on paper**, and that what you submit and any decision you give are recorded electronically.
- heading: Paper copies
blocks:
- paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}} and of the records about it. Contact them directly to ask, and to find out whether a fee applies.
- paragraph: You may also ask {{organizationName}} whether you can complete {{documentName}} on paper instead.
- heading: Withdrawing your consent
blocks:
- paragraph: You may **decline** instead of giving consent.
- paragraph: "You may also withdraw your consent before you submit {{documentName}} or give a decision on it, by:"
- bullets:
- declining, or
- contacting {{organizationName}}.
- paragraph: If you decline, you cannot continue with {{documentName}} electronically, and {{organizationName}} is told that you declined.
- paragraph: Withdrawing your consent does not affect records already provided to you electronically, information you have already submitted, or a decision you have already given.
- heading: What you need
blocks:
- paragraph: "To take part electronically you need:"
- bullets:
- a device with a current web browser
- access to the email address this request was sent to
- software that can open PDF files
- paragraph: To keep a copy, you need to be able to save or print a PDF file.
- heading: Keeping your contact details up to date
blocks:
- paragraph: If your email address changes, tell {{organizationName}}.
acknowledgements:
- key: electronic-records
label: I consent to take part in this request and to receive its records electronically.
- key: can-access
label: I can open and keep PDF files on the device I am using.
action:
label: Agree and continuerefract-standard-consent-delivery
Shown by REFRACT Delivery to a recipient, before the document is provided, when the template requires consent. Worded for receiving documents electronically.
refract-standard-consent-delivery 2026.1
The default for REFRACT Delivery. Awaiting counsel review.
- SHA-256:
1f1ea5631d62b094e90f183fb60f92fd5cd4deca7c54f99b46ec0acca6128f3c - File: refract-standard-consent-delivery-2026.1.yaml
# REFRACT standard consent policy for document delivery, version 2026.1.
#
# Starter text awaiting counsel's review (docs/decisions/esign-counsel-review.md, Q14). It is
# deliberately conservative and is not a draft: it ships and is shown as written. It is the
# system policy for Delivery: a recipient sees it before the document is provided. It follows
# refract-standard-consent 2026.2 section by section, worded for receiving documents
# electronically instead of signing, and uses the same tokens, filled in when the policy is
# shown (consent spec 3.5). Counsel's edits ship as a new version (a new file version and a new
# registry entry); this version is never edited, because deliveries created with it keep its
# text.
#
# This comment is part of the file's bytes and so is covered by its registered hash
# (systemConsentRegistry.ts). Changing anything in this file, including this comment, needs a
# new version.
consentPolicy:
schemaVersion: 2
id: refract-standard-consent-delivery
version: "2026.1"
title: Consent to receive documents electronically
sections:
- heading: What this consent covers
blocks:
- paragraph: "{{organizationName}} would like to provide {{documentName}} to you electronically."
- paragraph: "This consent covers:"
- bullets:
- "{{documentName}} itself"
- the records about it that are provided to you
- paragraph: If you consent, you agree to **receive this document and its records electronically, instead of on paper**.
- heading: Paper copies
blocks:
- paragraph: You may ask {{organizationName}} for a paper copy of {{documentName}}. Contact them directly to ask, and to find out whether a fee applies.
- heading: Withdrawing your consent
blocks:
- paragraph: You may **decline** instead of giving consent.
- paragraph: If you decline, {{documentName}} is not provided to you through this link, and {{organizationName}} is told that you declined. Contact them to receive it another way.
- paragraph: You may also withdraw your consent later, by contacting {{organizationName}}.
- paragraph: Withdrawing your consent does not affect documents and records already provided to you electronically.
- heading: What you need
blocks:
- paragraph: "To receive documents electronically you need:"
- bullets:
- a device with a current web browser
- access to the email address this document was sent to
- software that can open PDF files
- paragraph: To keep a copy, you need to be able to save or print a PDF file.
- heading: Keeping your contact details up to date
blocks:
- paragraph: If your email address changes, tell {{organizationName}}.
acknowledgements:
- key: electronic-records
label: I consent to receive this document and its records electronically.
- key: can-access
label: I can open and keep PDF files on the device I am using.
action:
label: Agree and continuePublishing Your Own Policy
Any system policy can be the starting point for your own. Your policy is shown in place of the system policy for every template that names it.
- Download a starting file. Use the download link of the system policy closest to what you need, from the Registry.
- Give it your own
id. Theidis 3 to 64 characters of lowercase letters, digits, and hyphens, starting with a letter or a digit. It cannot start withrefract-, which is reserved for the system policies. For example,acme-consumer-records. - Set a
version. Up to 32 characters of letters, digits,.,_, and-, for example2026.1. Change it whenever you change the text, so two texts never share a version. - Write the text. Replace the comment at the top with your own, or remove it, and edit the title, sections, statements, and button label. The rules are in Policy File Format.
- Publish it in SharePoint. Upload the file to your SharePoint assets library as
consent-policies/{id}.yaml, where{id}is the file's ownid. For example,consent-policies/acme-consumer-records.yaml. - Select it in the template. Set
consent.policyIdto the sameidin the template's settings for each product that should show it (below).
The policy is read and checked when each session, workflow, or delivery is created, and the exact bytes are stored with that record. Changing the file later applies to records created after the change, never to existing ones.
Selecting a Policy With consent.policyId
Each product has its own consent block, inside that product's template settings:
{
"templateSettings": {
"esign": { "consent": { "mode": "required", "policyId": "acme-consumer-records" } },
"workflow": { "consent": { "mode": "required", "policyId": "acme-consumer-records" } },
"delivery": { "mode": "SECURE_LINK", "consent": { "mode": "required", "policyId": "acme-consumer-records" } }
}
}| Setting | Values | Notes |
|---|---|---|
mode | required or none | eSign is always required; none is refused. Workflow defaults to required. Delivery defaults to none, and required needs delivery mode SECURE_LINK, because the step is shown on the portal link. |
policyId | The id of your policy | Optional. Leave it out to show the product's system policy. The file consent-policies/{policyId}.yaml must declare the same id. |
contacts | { "withdrawal": "...", "paperCopy": "..." } | Optional. Text, such as an email address or a short instruction, for the {{withdrawalContact}} and {{paperCopyContact}} tokens. |
The consent block is read from the template only. A request that sets it is refused with consent_not_request_settable.
A template with no consent block gets the product's default mode and its system policy.
Policy File Format
A policy file is UTF-8 YAML, without a byte order mark, at most 32 KB.
consentPolicy:
schemaVersion: 2
id: acme-consumer-records
version: "2026.1"
title: Consent to receive records electronically
sections:
- heading: What this consent covers
blocks:
- paragraph: "{{organizationName}} would like to provide {{documentName}} to you electronically."
- bullets:
- "{{documentName}} itself"
- the records about it that are provided to you
acknowledgements:
- key: electronic-records
label: I consent to receive this document and its records electronically.
action:
label: Agree and continue| Field | Rules |
|---|---|
schemaVersion | 2. |
id, version | As in steps 2 and 3 above. |
title | Up to 200 characters. |
sections | 1 to 20. Each has a heading (up to 200 characters) and blocks, 1 to 50 of them: a paragraph (up to 4,000 characters) or bullets (1 to 20 items, up to 1,000 characters each). Paragraphs and bullets may use **bold**. |
acknowledgements | 1 to 10 statements the participant ticks, each a key (lowercase letters, digits, and hyphens) and a label (up to 500 characters). Each one starts unticked, and all must be ticked to continue. Labels take no tokens: the record holds each label word for word. |
action | The button's label, up to 60 characters. |
contact | Optional. One link, a label and an href that is a mailto: address or an https:// URL. |
YAML anchors, merge keys, HTML, and markdown links are refused. Quote a value that starts with a token, as in the example, because YAML reads an unquoted { as the start of a mapping.
Tokens
| Token | Filled with | When there is no value |
|---|---|---|
{{organizationName}} | The sender's organization | "the organization that sent you this document" |
{{documentName}} | The document's name, or the request's title | "this document" |
{{senderName}} | The sender's name | "the person who sent you this document" |
{{contactEmail}} | The template's contact email | "the organization that sent you this document" |
{{withdrawalContact}} | consent.contacts.withdrawal, else the contact email | "the organization that sent you this document" |
{{paperCopyContact}} | consent.contacts.paperCopy, else the contact email | "the organization that sent you this document" |
Token values are captured when the record is created and stored with it, so a later edit to the template does not change the text a participant was shown.
When a Policy Cannot Be Used
The session, workflow, or delivery is not created, and the answer names the problem. Nothing falls back to another policy.
| Code | Cause |
|---|---|
consent_policy_unreadable | consent-policies/{policyId}.yaml could not be read from the assets library. |
consent_policy_invalid | The file does not follow the format above, or its id is not the policyId that named it. |
consent_setting_invalid | The template's consent block is malformed: a mode other than required or none, a key it does not have, a contact that is not 1 to 200 characters of text, or a policyId that is not 1 to 80 characters of letters, digits, ., _, and -, contains .., or starts with the reserved refract- prefix. |
consent_mode_not_allowed | The eSign block sets mode to none. |
consent_requires_portal_link | The Delivery block requires consent with delivery mode SHAREPOINT or BOTH. |
See Error Responses and Codes for every consent code.
Incident Response
Refract Logic incident response procedures, severity levels, and customer notification timelines for CISO and operations teams.
Free Tools
A suite of free online PDF and image utilities powered by the REFRACT PDF engine. No sign-up required for basic use. Upload a PDF and get results instantly.