Why identity checks matter
When someone signs a document, two questions matter later: did the right person sign, and can you show it? An identity check is the step that ties a signer to something you can point to, such as an email inbox, a phone number, a code you shared by phone, or a government ID.
No single check is right for everything. A stronger check gives you better evidence, but every step you add is one more place a signer can get stuck. The goal is to pick the lightest check that still gives you the evidence the document needs.
The five checks in eSora Sign
Email code. This is the default on every plan. When the signer opens the link, we send a 6-digit code to their email address. The code works for 10 minutes. It proves the signer had access to that inbox at the time of signing. Most signers finish it in a few seconds.
SMS code. Available on Premium and above. We send a code to the phone number you enter for the signer. It proves access to that phone at the time of signing. Because email and phone are separate channels, using SMS means someone who got into a signer's email still could not sign.
Access code. Available on Premium and above. You choose a code and give it to the signer yourself, by phone, in person or in a separate message. The signer must enter it to open the document. This works well when you already know the person and can share the code through a channel you trust.
Photo ID and selfie. Available on Enterprise, or as an add-on for Teams. The signer takes a photo of a government ID and a selfie. We check that the ID looks genuine and that the face matches. This is the strongest check and the one with the most friction, so save it for documents that need it.
Company sign-in. For signers inside your own organization. If your workspace uses single sign-on, internal signers sign in with their company account before signing. This ties the signature to your identity provider and its own security controls.
A simple way to decide
Ask three questions about the document.
First, what happens if the wrong person signs? If the answer is a minor inconvenience, an email code is fine. If it means money moves, a property changes hands, or someone gives up a right, use something stronger.
Second, how well do you know the signer? If they are an existing customer or employee and you have a verified phone number, SMS or an access code is easy. If they are new to you and the stakes are high, photo ID may be worth it.
Third, does anyone else set the rule? Some lenders, insurers, regulators or counterparties ask for a specific check. If they do, follow it.
Suggested checks by document type
NDAs, sales terms, supplier onboarding forms, internal policy acknowledgements: email code.
Employment offers and HR forms: email code for most, SMS code if the role is senior or the document includes payroll or banking details.
Leases and lease renewals: SMS code, since tenants often share email accounts with family.
Client engagement letters for accountants and lawyers: SMS code or an access code shared on a call.
Loan documents, guarantees, large purchase agreements: SMS code plus an access code, or photo ID and selfie.
Board resolutions and internal approvals: company sign-in for directors who are staff, and SMS for outside directors.
Volunteer waivers and event sign-ups on a public signing link: email code. You usually do not know the signer in advance, and a light check keeps the line moving.
Combining checks
You can use more than one check for the same signer. A common pairing is an email code plus an access code. The email code proves the inbox, and the access code proves the person is the one you spoke to. Another is SMS plus photo ID for documents where you need to know the person is who they say they are, not just that they hold a phone.
You can also set different checks for different signers on the same document. A customer might use an SMS code while your own team member signs with company sign-in.
Common mistakes to avoid
Using a phone number you have not confirmed. An SMS code is only as good as the number. If you copy a number from an old email signature, you may be sending the code to someone else.
Sending the access code in the same email as the signing link. That defeats the point. Share it by phone, in person, or in a separate channel.
Asking for photo ID by default. It adds time and collects sensitive personal data. Many signers will abandon a simple form if they are asked for a passport photo. Use it when the document calls for it.
Forgetting about people who share devices or inboxes. Families often share an email account. If two people in the same household both need to sign, give each one a separate check, such as SMS to their own phones.
What the certificate records
Whatever you choose, the Certificate of Completion lists every check each signer passed, when they passed it, and from which device and IP address. If you used SMS, it shows the last digits of the phone number. If you used photo ID, the evidence pack includes the result of the check. This is what you would show if anyone ever asked how you knew who signed.
Set a sensible default
Workspace admins can set a default check in Settings, so everyone in the team starts from the same place. Many teams set email code as the default and turn on SMS for specific templates, such as leases or financial forms. That way people do not have to remember to raise the bar when it matters, and simple documents stay simple.
This article is general information, not legal advice.