# Electronic Signature general implementation guide

{{<tags >}}

> **In simple terms:** This guide takes your team from account setup to the daily operation of ZapSign. It covers the decisions, settings, integrations, and support you need to go live. Follow the phases in order the first time, then come back to each one as a reference.

## Implementation path

The implementation has six phases:

1. **Set up the account:** users and access levels, groups, folders, 2FA, and SSO.
2. **Choose the channel:** web platform, no-code tools, Truora flows, or API.
3. **Design the signing process:** templates, sending options, and authentication.
4. **Integrate (only if you connect your systems):** Make, Zapier, HubSpot, Truora flows, or API.
5. **Test and go live:** a checklist of 13 tasks and a real test send.
6. **Operate and support:** corrections, reports, and troubleshooting.

Phase 4 applies only if you connect ZapSign to your systems. If you only use the web platform, go from phase 3 to phase 5.

## Phase 1: Set up the account

Before the first send, define who enters ZapSign, what each person sees, and how access is protected. A user creates and sends documents. A signer doesn't need an account, and signers are unlimited.

### 1.1 Invite your team

1. Go to **Settings → Organization** and open the **Users** tab.
2. Click **Add user** and type the email.
3. The person receives an invitation, creates a password, and joins the organization.
4. Assign the access level next to the email.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Level | Documents they see | Settings | Trash |
| ----- | ------------------ | -------- | ----- |
| **Owner** | All | Yes | Yes |
| **Administrator** | All | Yes | No |
| **Member** | All documents in the organization | No | No |
| **Limited** | Only the ones they created | No | No |
{{</table>}}

{{<img src="/images/illustrations/zapsign_implementation/org_users.png" alt="Users tab in Organization settings" width="90%" class="rounded-md">}}

{{<img src="/images/illustrations/zapsign_implementation/org_user_roles.png" alt="Access levels for a user" width="90%" class="rounded-md">}}

### 1.2 Separate areas and sensitive documents

- **User groups:** create one group per area (for example, Sales and Human Resources) when an area must not see another area's documents. For each group, define which tools it can use.
- **Secret folders:** click the pencil icon on a folder and turn on **Secret**. Only you and the users you choose can see it. The owner always has access.
- **Contacts:** ZapSign saves each signer's data. When you create a document, use **Contacts** so you don't type it again.

{{<img src="/images/illustrations/zapsign_implementation/org_user_groups.png" alt="User groups tab in Organization settings" width="90%" class="rounded-md">}}

### 1.3 Protect access

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Feature | What it does | How to turn it on |
| ------- | ------------ | ----------------- |
| **2FA** | Asks for a verification code at sign-in | Your email (top right) → **My profile** → **Security**. To require it for all users, turn on **2FA** in **Settings → Organization**. |
| **SSO (SAML 2.0)** | Sign-in with the company identity provider: Azure AD, Okta, OneLogin, AD FS | **Settings → Organization → Users → Configure SSO**. ZapSign turns it on within 7 business days. |
| **Signature delegation** | A coworker signs on your behalf for a period. The document shows both signatures. | An administrator turns on **Delegated signature** in **Settings → Organization → Preferences**. Then: **My profile → Personal info → Add delegate**, with start and end dates. |
{{</table>}}

{{<img src="/images/illustrations/zapsign_implementation/org_2fa_sso.png" alt="2FA and SSO settings in Organization" width="90%" class="rounded-md">}}

> **Important:** With SSO on, users can no longer sign in with another method. To delegate, the person who delegates needs a name, a mobile number, a saved signature, and 2FA on. The delegate must be a user of the account.

### 1.4 Common cases

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| I need to... | How |
| ------------ | --- |
| **Change the owner** | **Settings → Organization → Users → Change owner**. The previous owner becomes an administrator. |
| **Change a user's sign-in email** | Not possible. Invite the new email as a user and, if needed, transfer ownership to it. |
| **Remove someone** | Remove their access in **Settings → Organization**. Their documents stay in the organization. |
{{</table>}}

> **Tip:** Turn on 2FA for all administrators and for whoever keeps the API token.

## Phase 2: Choose the channel

The channel defines how documents are created and who does the technical work. Decide it before you design templates: changing it later means redoing settings.

Two questions lead to five options:

- **Will you connect ZapSign to your systems?**
  - **No:** use the **web platform**, manually or with bulk sending by CSV.
  - **Yes:** answer the next question.
- **Will you validate identity inside the flow?**
  - **Yes (signature plus identity validation):** use **Truora Web or WhatsApp flows** without code, or the **Truora Validations API** with your own development.
  - **No (electronic signature only):** use a **no-code integration** (Make, Zapier, or HubSpot), or the **ZapSign API** with your own development.

Within each group, the difference is whether you have a development team. Without one, use the first option. With one, the API gives you full control.

### 2.1 Options

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Channel | Where you set it up | Use it when... |
| ------- | ------------------- | -------------- |
| **Web platform** | [app.zapsign.co](https://app.zapsign.co) | You handle the volume manually or with bulk sending by CSV. |
| **No-code integration** | Make, Zapier, or HubSpot + your ZapSign token | You want to save signed files to your cloud, or create documents from a CRM without coding (see [4.2](#42-no-code-integrations)). |
| **Truora Web or WhatsApp flows** | Truora dashboard → **Digital Identity** → **Electronic Signature** block | You want to combine signature with document and face validation without coding. |
| **Truora Validations API** | `api.validations.truora.com/v1/validations`, `type=electronic-signature` | Your system already uses Truora and you want to attach identity validations to the signature. |
| **ZapSign API** | `api.zapsign.com.br/api/v1/` | You only need signatures and full control of documents, signers, and templates. |
{{</table>}}

This guide only covers the web platform in detail.

## Phase 3: Design the signing process

Here you decide which document is signed, how it reaches the signer, and with what level of verification. This phase has the biggest impact on the signing rate.

### 3.1 Templates

Most template errors come from the .docx file, not from ZapSign. These rules prevent empty fields and misplaced signatures.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Element | Recommendation |
| ------- | -------------- |
| **Page** | A4, 2 cm margins, and at least 2 cm free at the bottom: ZapSign prints the security hash there. |
| **Text** | 11 to 12 pt, 1.5 line spacing. Arial, Calibri, Roboto, Open Sans, or Times New Roman. |
| **Variables** | Between double braces, with no periods or hyphens, always written the same way. One extra space creates a different variable. |
| **Graphics** | Logo in the header. No shapes, background images, or watermarks. |
| **Tables** | No signatures or complex variables inside tables. |
| **Breaks** | Use a page break, not several Enter keys. |
| **Source** | Save directly as .docx. Don't use PDF-to-Word converters. |
{{</table>}}

#### Fields and signers

- **Field types:** Date (adds the slashes automatically), Email (validates the format), Short answer, Multiple choice, and Checkbox. Separate the choices with semicolons.
- **Place fields:** in .docx templates you can only place **Signature** and **Initials**. **Text** and **Checkbox** are only for PDF templates.
- **Signers:** the first signer is always dynamic (it changes in each document). From the second on, signers are fixed, such as the legal representative. Add them with **+Signer** in **Manage → Edit template**.
- **Automatic name:** put the name variable in the template title so each document carries the signer's name.
- **Position signatures by API:** use an anchor text in the document, for example `<<signer1>>`. It can be left blank.
- **Supplementary documents:** they are signed in the same link. They can't have more dynamic fields than the main document.
- **Update a .docx template:** go to **Manage → Edit template** and upload the new file. You don't need to create the template again.

{{<img src="/images/illustrations/zapsign_manage/signers_settings.gif" alt="Signers settings in a template" width="90%" class="rounded-md">}}

For the full template setup, see {{< newtab href="/guides/dynamic_template_and_zapsign_id/" >}}**Create a dynamic template at ZapSign**{{< /newtab >}} and {{< newtab href="/guides/electronic_signature_manage_docs/" >}}**Manage electronic signature templates**{{< /newtab >}}.

#### Bulk sending by CSV

1. In **Templates**, click **Send document** next to the template.
2. Choose **Fill and send in bulk**.
{{<img src="/images/illustrations/zapsign_implementation/template_send_options.png" alt="Ways to send a document from a template" width="70%" class="rounded-md">}}
3. Click **Download base template** and fill in one row per document. Each file accepts up to 50 rows.
4. Save it as .csv, upload it, and click **Send document**.
{{<img src="/images/illustrations/zapsign_implementation/template_bulk_csv.png" alt="Bulk sending with a CSV file" width="60%" class="rounded-md">}}
5. Check the documents in **Documents**.

> **Tip:** Test each new template by sending it to yourself before you share it with the team.

### 3.2 Sending options

Set these options when you create the document, in step 2 (**Add signers**) and step 4 (**Send document**). Used well, they reduce forgotten documents and signatures from the wrong person.

#### In step 4

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Option | How to turn it on | What happens |
| ------ | ----------------- | ------------ |
| **Automatic sending** | Enable automatic sending of links and customize the message | ZapSign sends the email and shows whether it was delivered and opened. |
| **Signing order** | **Order signatures**, drag the names, and click **Finish order** | Each signer gets the email after the previous one signs. |
| **Reminders** | Turn on automatic reminders every... and choose the days | Pending signers get email reminders. |
| **Deadline** | Set a deadline to sign the document | Signers get a notice 24 hours before. After it expires, the link stops working. You can change or remove it without sending again. |
| **Allow refusal** | Allow the signer to refuse the document | The signer sees a **Refuse** button and writes the reason. |
{{</table>}}

#### In step 2

With **Advanced authentication** on, three icons appear in the email and mobile fields.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Icon | Effect | Use it when... |
| ---- | ------ | -------------- |
| **Lock** | The verification code only goes to the data you typed | Whenever you ask for a code by email, SMS, or WhatsApp. |
| **Eye** | Asks for the data but hides it from the signature report | You want to protect personal data in the final document. |
| **Envelope or phone** | Doesn't ask the signer for that data | The signer has no email or mobile number. At least one is required. |
{{</table>}}

#### Other options

- **Observers:** in step 2, click **Observers**. Up to 20 emails get a copy of the signed document without signing. In templates: **Advanced options → External notifications**.

{{<img src="/images/illustrations/zapsign_manage/advanced_options.gif" alt="Advanced options in a template" width="70%" class="rounded-md">}}

- **Several documents in one link:** upload another file after the first one. The signer signs once for all of them. All signers sign all documents.
- **Link expiration:** **Settings → Organization → Preferences → Signer experience → Expire signing link automatically**, and choose the days. It applies to the whole organization.
- **Separate signature report:** in **Preferences → Signature report information**, you can deliver the report as a separate file.

{{<img src="/images/illustrations/zapsign_implementation/org_signer_experience.png" alt="Signer experience preferences" width="90%" class="rounded-md">}}

{{<img src="/images/illustrations/zapsign_implementation/org_signature_report.png" alt="Signature report preferences" width="90%" class="rounded-md">}}

- **Save your signature:** **My profile → My signature**. It's required for batch signing and delegation.

{{<img src="/images/illustrations/zapsign_manage_docs/setting_sign_zapsign.png" alt="My signature in My profile" width="80%" class="rounded-md">}}

- **Signers who can't read or write:** use a code by SMS or email, add two witnesses who also sign and, if you want, a selfie.

> **Tip:** Combine a deadline with reminders every 2 or 3 days. The signer has a clear date and gets notices without being overwhelmed.

### 3.3 Authentication methods

Each signer needs at least one standard method. Advanced methods are added on top. Choose according to the risk of the process: more verification gives better evidence, but adds steps for the signer.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Method | What it checks | Keep in mind |
| ------ | -------------- | ------------ |
| **On-screen signature** | That the signer drew, typed, or uploaded their signature | The most used. |
| **Email code** | That the signer controls that email | 6 digits. Expires in 2 hours. |
| **SMS code** | That the signer controls that mobile number | Expires in 2 hours. |
| **WhatsApp code** | That the signer controls that number | Expires in 2 hours. Delivery is better than SMS. |
| **Selfie** | A photo of the face when signing | Not compared with any document. |
| **Document photo** | Front and back of the ID document | Doesn't verify that the document is authentic. |
| **Facial biometrics (liveness)** | That a real person is present | Takes a photo from the video for the report. |
| **Facial recognition** | Liveness + face matches the document | Doesn't verify that the document is authentic. |
| **Identity validation** | All of the above + document authenticity with AI + name with more than 75% similarity + document number (optional) | The strongest. Detects photocopies, cutouts, screens, and altered text. |
{{</table>}}

#### What to choose by risk

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Risk | Examples | Suggested combination |
| ---- | -------- | --------------------- |
| **Low** | Minutes, internal approvals | On-screen signature + email code |
| **Medium** | Commercial and employment contracts | WhatsApp or SMS code with locked data + selfie |
| **High** | Loans, promissory notes, financial onboarding | Identity validation + background check |
{{</table>}}

> **Important:** Advanced validators (document, selfie, facial recognition) are enabled on request to Truora. Documents with biometrics can't be signed in batch.

To add face and document validation to a signature, see {{< newtab href="/guides/electronic_signature_face_and_document/" >}}**Add document and face to electronic signature validation**{{< /newtab >}}.

## Phase 4: Integrate

If you chose a channel other than the web platform, this phase connects ZapSign to your systems. This guide focuses on the web platform, so the technical integration is out of scope. To use Truora flows, see {{< newtab href="/guides/electronic_signature_web_flow/" >}}**Integrate Electronic Signature in Web flows**{{< /newtab >}} and {{< newtab href="/guides/electronic_signature_wa_flow/" >}}**Integrate Electronic Signature in WhatsApp flows**{{< /newtab >}}.

### 4.2 No-code integrations

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Tool | What it allows | How to start |
| ---- | -------------- | ------------ |
| **Make** | Save signed files to Google Drive, OneDrive, or Dropbox. Create documents from Google Forms or Pipedrive. | Import a ZapSign blueprint and connect the token. |
| **Zapier** | Triggers: document created, signed, or deleted. Actions: create a document by upload or from a template with Google Sheets data. | Install the app with the invitation link from the help center. |
| **HubSpot** | Create and send documents from a deal, use variables such as `{{Contact.email}}`, and see the status on the deal card. | Install ZapSign from the HubSpot Marketplace. |
{{</table>}}

You can find these tools in **Settings → Integrations**.

{{<img src="/images/illustrations/zapsign_implementation/integrations.png" alt="Integrations page in ZapSign" width="90%" class="rounded-md">}}

## Phase 5: Test and go live

Before you send real documents, review this list with your team and update the status of each task.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Task | Owner | Status |
| ---- | ----- | ------ |
| Users invited with their access level, and groups by area ([1.1](#11-invite-your-team), [1.2](#12-separate-areas-and-sensitive-documents)) | Administrator | Pending |
| 2FA on for administrators. SSO configured, if it applies ([1.3](#13-protect-access)) | Administrator / IT | Pending |
| Logo, colors, sender name, language, and time zone configured | Administrator | Pending |
| Channel chosen and token saved in a secrets manager ([Phase 2](#phase-2-choose-the-channel)) | Project lead / IT | Pending |
| Templates created with the rules in [3.1](#31-templates) and reviewed by Legal | Administrator / Legal | Pending |
| Authentication method defined per process, according to risk ([3.3](#33-authentication-methods)) | Project lead | Pending |
| Advanced validators requested to Truora, if used | Project lead | Pending |
| Deadline, reminders, and link expiration agreed ([3.2](#32-sending-options)) | Team | Pending |
| Data authorization text reviewed for each country | Legal | Pending |
| Full flow tested in sandbox, if you integrate | Technical team | Pending |
| Webhooks tested (`doc_signed`, `doc_refused`, `email_bounce`) and IPs allowed, if you integrate | Technical team | Pending |
| Real test send: send, sign from a mobile phone, and download the signature report | Lead user | Pending |
| Support team trained with section [6.3](#63-support-and-troubleshooting) | Support team | Pending |
{{</table>}}

To set the logo and colors, see {{< newtab href="/guides/electronic_signature_brand/" >}}**Electronic Signature branding**{{< /newtab >}}.

> **Tip:** Send the first real document to yourself and sign it from your phone. It's the fastest way to see what your customers will experience.

## Phase 6: Operate and support

Once you're live, the daily work is fixing sends, following up, and answering signers' questions.

### 6.1 Manage documents after sending

While nobody has signed, you can fix almost anything without sending a new document. After the first signature, the content is locked.

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| I need to... | How | Condition |
| ------------ | --- | --------- |
| **Change the file** | Gear icon → **Edit envelope** → remove the file → **Upload another file** → position signatures | Nobody has signed. The link doesn't change. |
| **Move a misplaced signature** | Gear icon → **Reposition fields** → **Save** | If the document is in progress, it applies when the next person signs. |
| **Remove a signer** | From the document detail | The signer sees "document not found" if they open the link. |
| **Change or remove the deadline** | From the document detail | Works even after it expires. |
| **Stop the document** | Delete it with the trash icon | The link shows that it's no longer available. |
| **Recover a deleted document** | **Documents → Trash → Recover** | Only the owner, or someone the owner authorizes. |
| **Send again after a refusal** | Fix it and use **Duplicate document** | A refused document can't be signed anymore. |
{{</table>}}

{{<img src="/images/illustrations/zapsign_implementation/document_detail.png" alt="Document detail with the action icons" width="90%" class="rounded-md">}}

> **Important:** A signed document can't be voided from ZapSign. If the parties want to undo the agreement, they must sign a termination document.

**Activity history:** each document has a tab with up to 25 event types in real time: sending, email opening, codes sent or failed, identity validations, signatures, and signer changes. You can download it as a PDF.

{{<img src="/images/illustrations/zapsign_implementation/document_history.png" alt="Activity history of a document" width="90%" class="rounded-md">}}

> **Tip:** Before you call a signer who hasn't signed, check the history. It tells you whether the email failed, whether they opened it, or whether the validation failed.

### 6.2 Reports and downloads

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Tool | Where | What you get |
| ---- | ----- | ------------ |
| **Reports** | Left menu → **Reports** | Monitoring by creator user, period, and signing time |
| **Export list** | **Documents** (or inside a folder) → **Export list** | A spreadsheet with documents, signers, and links |
| **Bulk download** | **Export list** + a download manager | All signed PDFs in a folder, in minutes |
| **Sustainability panel** | **Settings → Organization → Branding → Environmental Impact Report** | Environmental impact saved by not printing |
{{</table>}}

{{<img src="/images/illustrations/zapsign_implementation/reports.png" alt="Reports page in ZapSign" width="90%" class="rounded-md">}}

{{<img src="/images/illustrations/zapsign_implementation/documents_status_export.png" alt="Document statuses and Export button" width="90%" class="rounded-md">}}

> **Tip:** A **Limited** user only sees the documents they created. For organization-wide reports, use a **Member** user or higher.

### 6.3 Support and troubleshooting

Share this section with your support team. It covers the most common questions from signers and users.

#### Signer issues

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Issue | Likely cause | What to do |
| ----- | ------------ | ---------- |
| **Can't take the selfie or photo** | The browser blocks the camera by default | Accept the prompt with **Allow**. If it was blocked, enable the camera in the site settings. In an iframe, `allow="camera"` is missing. |
| **The browser asks for location** | ZapSign records it as evidence | It's optional. Accepting it adds support to the signature report. |
| **The email didn't arrive** | Misspelled email, bounce, or spam | Check the history or the `email_bounce` event. Share the link by WhatsApp. |
| **The code doesn't arrive** | Wrong data or expired code (2 hours) | Check the data and ask for another code. Lock the field with the lock icon in future sends. |
| **Identity validation fails** | Blurry photo, glare, photocopy, or a name different from the document | Try again with good light and the original document. |
| **"Document not available"** | Deleted, refused, expired, or signer removed | Check the status. Duplicate the document or change the deadline. |
| **Can't sign in batch** | Document with biometrics, or data different from their profile | Sign that document individually. |
| **Adobe says the signature isn't valid** | Adobe doesn't recognize the certificates ZapSign uses by default | The document is still intact. Documents signed after 07/20/2023 need no action. |
{{</table>}}

#### User or integration issues

{{<table "table w-auto small m-auto text-left table-striped table-bordered" >}}
| Issue | Likely cause | What to do |
| ----- | ------------ | ---------- |
| **The signature appeared in the wrong place** | It wasn't positioned before saving | Gear icon → **Reposition fields** → **Save**. |
| **The platform doesn't load** | Outdated DNS cache | Windows: `ipconfig /flushdns`. Mac: `sudo killall -HUP mDNSResponder`. Mobile: airplane mode for a few seconds. |
| **Template field empty or duplicated** | Variable written differently | Check that it's identical across the whole .docx ([3.1](#31-templates)). |
| **The API returns 429** | More than 500 requests per minute | Retry with increasing wait times. |
| **The webhook doesn't arrive** | Firewall, URL down, or a response other than 200 | Check the webhook log, allow the IPs, and reprocess. |
| **The download link doesn't open** | File URLs expire after 60 minutes | Download again from the platform or the API. |
| **The flow test link doesn't open** | Truora flow test links last 15 minutes | Generate a new one. Send customers the production link. |
| **Error `missing_required_attached_validations`** | Validations weren't completed before the signature | Place the validation blocks before the signature block. |
{{</table>}}

> **Tip:** When you escalate a case, include the document name, the signer's email, and a screenshot of the error.

For training videos, help center articles, and support channels, see {{< newtab href="/guides/electronic_signature_resources/" >}}**Electronic Signature training and support resources**{{< /newtab >}}.