AcceleratorsProof of Concept – Cryptographic Signing
Every signature leaves a verifiable token
Organizations can’t just say a document was signed — they need to prove it. SignaToken generates a cryptographic token for every signing event, creating immutable, independently verifiable evidence of who signed, what they signed, and exactly when.
See the Use CaseBook a Demo
The Problem
Proving a signature isn’t the same as capturing one.
Regulated industries healthcare, clinical research, financial services, legal demand more than a captured signature. They need independent, tamper-evident proof that stands up to audits, investigations, and disputes.
- Difficulty proving exactly who signed a document
- Limited visibility into signing history and user activities
- No centralized audit trail across the organization
- Managing secure user onboarding and authentication
- Verifying authenticity of signing records post-event
- Meeting regulatory and compliance requirements
- Preventing unauthorized access to signing workflows
The SignaToken Approach
When a user signs a document, SignaToken generates a unique cryptographic token using HMAC-SHA256. That token embeds the signer’s identity, the document reference, and a precise UTC timestamp creating verifiable, immutable proof of the signing event.
Any authorized party can paste the token and instantly confirm its validity against the server audit registry. No ambiguity. No he-said-she-said.
HMAC-SHA256 · Cryptographic Token Generation
Applicable Industries
HealthcareClinical ResearchLife SciencesPharmaceuticalsInsuranceBanking & Financial ServicesLegal ServicesGovernmentHuman ResourcesEnterprise Document Management
Everything needed for compliant, verifiable signing
Invitation-Based Onboarding
Users are registered via secure email invitations with configurable expiration (TTL). No self-signup. Every account is provisioned by an admin.
OTP Authentication
Every login requires a one-time password delivered by email two-factor authentication baked into the core flow, not bolted on.
Role-Based Access Control
Three distinct roles Super Admin, Admin, and Practitioner each with controlled permissions scoped to their business responsibilities.
Document Signing
Practitioners sign documents by supplying a Document ID, Project Name, and Study/Visit context. Each event produces a unique cryptographic token.
Token Verification
Any authorized user can paste a token to instantly verify the signer, document, timestamp, algorithm, and current validity status.
Token Decoder
Decode any generated token to retrieve its embedded document metadata and signing context without needing server access.
Immutable Audit Trail
Every platform event logins, signings, verifications, admin actions is permanently logged with timestamps, severity, and entity context.
Admin Dashboard
Real-time KPIs across clients, tokens, invites, and audit events give administrators complete operational visibility at a glance.
Configurable Settings
Admins can configure invitation TTL, user information, password policies, and platform-level settings without engineering involvement.
User Roles
Three roles. Controlled access at every level.
Super Admin
- Manage administrators
- Platform-level administration
- User governance
Admin
- Create & manage users
- Send / resend invitations
- View & verify all tokens
- Review audit events
- Configure system settings
Practitioner
- Register via invitation link
- Authenticate with OTP
- Sign documents & generate tokens
- View signing history
- Decode & verify tokens
Product Screens
Built, live, and demo-ready.
Every screen shown is the live product — not a mockup.
- Dashboard
- Sign a Document
- Token Generated
- Token Management
- Verify Token
- Invites
- Practitioner View
- Token History
- Token Decoder
Admin Console
Complete operational visibility
The admin dashboard surfaces real-time KPIs total clients, signature tokens issued, pending invites, and audit events logged alongside a live activity feed of every platform event.
- 174 signature tokens issued
- 3,667 audit events logged
- 48 pending invites tracked
- Live event stream with severity tagging
Document Signing
Enter the record. Sign. Get a token.
Practitioners enter the Document ID, optional project name, and study/visit context. The Document ID is embedded into the token and cannot be altered after signing creating a permanent, tamper-evident link.
- Document ID embedded immutably in token
- Project and study context for audit trail
- Guided step-by-step signing flow
Token Output
Signing complete. Token in hand.
After signing, the practitioner receives their unique cryptographic token along with a full signature record document ID, meaning, date, time, and signer identity. The token can be copied and submitted to any admin for verification.
- HMAC-SHA256 token generated instantly
- Full signing metadata displayed
- One-tap copy for submission
Token Management
Every token issued. Every one traceable.
dmins see the complete token log across all users nonce, signer, meaning badge, and UTC timestamp. A slide-out detail panel shows the full token anatomy and signature provenance for any selected token.
- 174 tokens tracked across the trial
- Search by token string
- Token anatomy breakdown in detail panel
- Synced verification status per token
Token Verification
Paste a token. Get cryptographic proof.
Admins paste any token string and the verifier checks it against the server audit registry, confirming or rejecting its cryptographic validity in real time. The full signature record signer, document, timestamp, algorithm is displayed on confirmation.
- Auto-verify on paste
- Displays signer, document, IP, device
- HMAC-SHA256 algorithm confirmed
- Verification history retained per session
Invitation Management
Secure, controlled user onboarding.
Every user is onboarded via a one-time enrollment link that provisions a private signing key on their device. Admins track invite status consumed, pending, expired and can resend with a single click.
- 124 total invites, 76 enrolled
- Consumed vs. pending status per invite
- Resend expired invitations instantly
- Enrollment and re-enrollment supported
Practitioner Portal
Sign a record. Decode a token.
The practitioner’s home screen gives immediate access to the two core actions starting a new signing session or decoding an existing token alongside a running count of tokens issued from their device and a recent token feed.
- Clean, task-focused interface
- Recent tokens with meaning badges
- Direct access to token decoder
Signing History
A practitioner’s personal audit log.
Every token ever generated on a practitioner’s device is listed in their History view, with the full token string and meaning badge visible at a glance creating a personal record that mirrors the admin’s central log.
- Device-local token history
- Token string and meaning badge per entry
- Date-stamped signing events
Token Decoder
Decode any token. Retrieve its metadata.
Practitioners can decode any token string to extract its embedded document information and signing metadata useful for confirming what was signed before submitting a token to an administrator for formal verification.
- Decodes token structure instantly
- Retrieves document ID and signing context
- Available to all authenticated users
Live Demo
See the full signing
workflow in action.
From invitation to signing to verification watch the complete end-to-end flow of the SignaToken platform.
Security Architecture
Built for regulated environments from the ground up.
SignaToken was designed with compliance-first requirements: every layer of the platform adds to a defensible, auditable chain of evidence.
HMAC-SHA256
Token Generation
Email OTP
2FA Authentication
Role-Based
Access Control
Invitation-Only
Onboarding
Immutable
Audit Trail
Cryptographic
Verification
Next Steps
Ready to see it live?
SignaToken is a fully functional proof of concept available to walk through with your team today. Every screen shown is real, working software.
Let’s go from 0 to 1+
Tell us how you dream it. We’ll show you how to ship it.
A 30-minute discovery call with a senior engineer, not a sales rep. Walk away with a build plan, a timeline, and a clear next step.
✓Reply within 1 business day
✓NDA on request, no obligation
✓Talk to engineers who’ve shipped in your industry
✓HIPAA and SOC 2-aware engineering
Prefer to talk now? +1 858 683 3692
Start the conversation
Takes about 30 seconds.
