Founders sign a lot of paper in the first eighteen months with little due diligence. Co-founder agreements, IP assignments, advisor grants, the first three customer contracts, a lease, a contractor agreement with the developer who built the prototype.
Most of it gets signed fast, because the alternative is slower, and speed is the whole point at that stage. Someone types their name into a PDF, or drops in a picture of their signature, or prints and scans. The file goes into a folder called Legal and nobody opens it again.
Then, three or four years later, somebody does open it. Usually a lawyer working for whoever is buying the company, or leading the round, or defending a claim. And the questions they ask about those files are not the questions anyone was thinking about at the time.
Key Takeaways
- Founders often rush through paperwork, but this can lead to issues when documents get reviewed years later.
- Due diligence includes content questions and questions about the document’s authenticity and signing process.
- Most documents fall into weak categories, often lacking real digital signatures that prove authenticity.
- An audit can reveal that many documents aren’t properly signed, especially older ones that establish ownership.
- For future documents, implement a process to ensure records are properly signed, distinguishing between visual marks and actual authentication.
Table of contents
What due diligence actually asks about your documents
Diligence questions about documents split into two kinds, and only one of them is about content.
The content questions are the familiar ones. Does the IP assignment cover everything the developer built? Does the advisor agreement vest on the schedule the cap table assumes? These are read by humans and argued about by lawyers, and they’re what founders expect.
The other kind is about the document as an object. Is this the version that was signed? Can anyone show that the person named actually signed it, on the date claimed? If the counterparty says they never agreed to clause 9, what exists beyond the PDF itself?
That second set is where early-stage paperwork tends to be thin, because the tooling used to produce it was chosen for speed.
The three tiers founders actually have
Sort your document folder into three piles and the exposure becomes obvious.
Documents with a real digital signature. These carry evidence inside the file: a certificate identifying the signer, a hash proving the content has not changed, often a timestamp. They can be checked years later, by anyone, in about a minute. Anything signed through a proper e-signature service usually lands here.
Documents with a signature image. A PDF with a picture of handwriting on the last page. The image proves nothing on its own. It can be lifted from one document and placed on another, and the result is indistinguishable. Nothing in the file records who applied it, when, or to which version of the text.
Scans of wet ink. A photograph of a signed page. Weaker than paper, because the original is often gone and the scan itself is trivially editable.
Most seed-stage companies have almost everything in the second and third piles and assume they’re in the first.
The due diligence check nobody runs on their own paperwork
Here’s the part worth doing this quarter, and it takes an afternoon.
Open the folder. For each document that matters, look at whether there’s a signature object in the file at all, or just an image sitting on the page. Most PDF readers will tell you: a real signature produces a panel, a picture does not.
For the ones that do carry a signature, check the signature inside the PDF rather than trusting whatever your reader says. Chaindoc runs signed PDFs through the EU Digital Signature Service library against the EU Trusted List and reports the results as separate lines: whether the content changed after signing, whether the signing certificate traces to a trusted authority, whether it was revoked, whether a timestamp exists, and which assurance level the signature reaches. Files up to 50 MB. The first check in a session asks for an email address and a one-time code, and the file is not kept afterwards.
The reason to check somewhere other than your own reader is the same reason you don’t audit your own books. And the reason to want the breakdown rather than a verdict: a document can fail the trust check simply because your validator does not recognise a legitimate foreign authority, which is a configuration issue, while failing the integrity check means the file was edited after signing, which isn’t.
What the due diligence document audit usually turns up
Two findings recur.
The first is that fewer documents are properly signed than founders think. The number is usually somewhere between a fifth and a third of what people guess, because the e-signature product used early on was often the free tier of something that produced a decorated PDF rather than a signed one.
The second is that the oldest documents are the weakest. That’s the uncomfortable part, because the oldest documents are also the ones establishing who owns what. IP assignment from the first contractor. The agreement that says the co-founder who left in month seven has no claim. Those are exactly the documents a buyer’s counsel reads first.
None of it is fatal. Documents can be re-executed, and often the cleanest fix is a short confirmatory agreement signed properly now, referencing the original. That conversation is a lot easier to have during a quiet quarter than during a diligence process with a deadline attached.
What to do on the way in
For new documents, the fix is procedural rather than technical, and it costs nothing once decided.
Split your paperwork by consequence. Internal forms, delivery notes, NDAs with people you will never dispute anything with: a legible mark is fine, and adding weight to those just slows everyone down. Anything establishing ownership, equity, employment terms or money: sign it through a process that produces a record.
The visual and the record are separate things, and that distinction is worth making explicit inside your team. A signature image made in Chaindoc or anywhere else is a rendering. It goes on the page and looks right. What makes the document defensible is the layer underneath: authentication of who signed, a timestamp, and proof the content has not shifted since. Tools that do both will tell you which one a given flow produced. Tools that only do the first tend to let you assume otherwise.
Founders are rarely wrong about which documents matter. They’re frequently wrong about which ones they can actually prove.
