If you sign contracts electronically, you still need a plan for keeping them. Document retention requirements for electronic signatures in Canada come from a mix of federal privacy law, provincial record-keeping rules, and plain business sense. There is no single national statute that tells every company exactly how long to keep every signed file, so the practical answer depends on the type of document and who regulates your industry.
This post walks through the legal context, what actually needs to be retained, and how to set up a retention habit that holds up if a document is ever questioned years later.
What Canadian law actually says
The Uniform Electronic Commerce Act (UECA), adopted in various forms across provinces, and Ontario's Electronic Commerce Act, 2000 (ESA 2000) both confirm that an electronic record can satisfy a legal requirement to retain a document, provided the record is accessible, readable, and kept in the format in which it was originally generated or in a format that accurately represents it. PIPEDA adds a privacy layer: personal information collected for a purpose should not be kept longer than necessary to fulfill that purpose, but you are also expected to keep records long enough to respond to a complaint or legal request.
None of this is legal advice, retention obligations vary by industry (financial services, healthcare, real estate, and employment records each have their own rules) and by province. A lawyer or compliance officer should confirm the specific period for your sector. What the law does make clear is that electronic originals are acceptable, and that accessibility over time matters as much as the signature itself.
What you actually need to retain
A signed PDF by itself is not enough. If a contract is ever disputed, you want to be able to show not just what was signed, but that it was signed by the right person, at a specific time, without alteration afterward.
- The final signed PDF, with signatures and any fields filled in by each party.
- An audit trail: who received the envelope, when each party viewed and signed it, and from what IP address.
- A way to prove the PDF has not been altered since signing.
- Any identity verification step used (email confirmation, SMS code, etc.).
- The retention period itself: a defined schedule, not an indefinite "keep everything forever" default.
How proof of integrity works with VG·Sign
VG·Sign generates a SHA-256 hash of the final signed PDF and keeps it alongside an append-only audit log of every action taken on the envelope: sent, viewed, signed, completed. If you need to confirm a document hasn't been changed since signing, you compare the current file's hash against the one recorded at completion. That is the actual mechanism, a cryptographic hash plus an audit trail, not a marketing claim about unbreakable security.
On data location: envelope content, meaning the documents, fields, and signatures, is stored and processed in Canada. The database, file storage, and application servers run in the Montreal region (Supabase on AWS ca-central-1, Vercel's yul1 region). That said, the completion email that delivers your signed PDF is sent through a US-based email provider, and SMS verification and payment processing also run through US-based providers. So while your signed documents live on Canadian infrastructure, that one notification step is a cross-border hop. We say this plainly because a lot of e-signature vendors blur the line, and retention decisions should be made with accurate facts, not assumptions.
Setting a retention schedule that works
Rather than guessing, build a simple schedule based on document type.
- List the categories of documents you sign: contracts, NDAs, employment forms, consent forms, vendor agreements.
- Check if your industry regulator or province sets a minimum period for each category (tax records, for example, commonly need 6 to 7 years in Canada, but confirm with an accountant).
- Set a default retention period for everything else, often 7 years is used as a practical baseline even where no law requires it.
- Decide where the signed PDFs and audit logs live after completion, and who has access.
- Review and purge on a schedule rather than never deleting anything.
Keeping documents forever isn't a safer default. Under PIPEDA, holding personal information longer than needed for its original purpose can itself create exposure. A defined schedule protects you both ways.
Where this fits into choosing an e-signature tool
If you're comparing providers, retention and proof of integrity should be part of the evaluation, not an afterthought. Our
DocuSign alternative comparison breaks down how VG·Sign handles storage, pricing, and audit trails side by side with larger incumbents.
For teams just getting started, it helps to see actual costs before committing to a retention and signing workflow. Our
pricing page lays out plans without hidden per-envelope fees.
For more on how envelopes, audit trails, and signing status work day to day, the
VG·Sign blog has practical walkthroughs beyond this one.
Frequently asked questions
- How long should I keep electronically signed documents in Canada?
- It depends on the document type and your industry regulator. There is no single national rule for all documents. A common practical baseline many businesses use is 7 years, but financial, healthcare, and employment records can have different minimums, so confirm with a lawyer or accountant for your sector.
- Does PIPEDA require a specific retention period?
- No. PIPEDA requires that personal information not be kept longer than necessary for the purpose it was collected, and that you retain it long enough to respond to access requests or complaints. It sets a principle, not a fixed number of years.
- Is a signed PDF enough to prove a document is valid later?
- A signed PDF alone proves less than a PDF paired with an audit trail. VG·Sign keeps a SHA-256 hash of the final signed PDF and an append-only audit log showing who viewed and signed the envelope and when, which together let you verify the document hasn't changed since completion.
- Where is my signed document data stored with VG·Sign?
- Envelope content, including documents, fields, and signatures, is stored and processed in Canada: the database, file storage, and app servers run in the Montreal region. The completion email that attaches your signed PDF goes through a US-based email provider, and SMS and payment processing also use US-based providers, so that step crosses the border.
This article is for general information only and is not legal advice. For advice on your specific situation, consult a qualified professional.