Palm verification for electronic signatures

A stronger record of the signing action

An electronic agreement contains several kinds of evidence. The visible signature shows the mark a signer adopted. The audit trail records the actions around signing. The digital seal and timestamp make the completed file’s integrity and timing independently checkable. VerySecure adds a required verification of the person participating in that signing session.

That distinction matters because handwriting naturally varies: a person’s genuine signatures can differ between occasions. NIST’s definition of natural variation recognizes those ordinary differences. A copied image, meanwhile, can reproduce the appearance of an earlier signature exactly. Recording a fresh verification gives a reviewer another, separate piece of evidence to examine alongside the mark.

The need is practical. The FBI describes how generative AI makes impersonation more persuasive and scalable, including through cloned voices and fabricated executive video calls. VerySecure lets a sender build an explicit verification step into the agreement itself, so the signing process asks for more than a convincing presentation.

Personhood, authentication and continuity

Personhood verification asks whether a participant passes the provider’s check for a real, unique person. Identity continuity asks whether a returning participant matches the identity established earlier. VerySecure uses both concepts: each selected signer completes Very’s palm flow, and an already-linked recipient address must return the same Very identity.

Very’s technical litepaper describes palm-print recognition through a standard phone camera, with gesture-based liveness checks. It distinguishes multi-scan enrollment from subsequent palm verification. Those stages establish and then recognize the provider identity used by SignThis.

NIST’s authentication guidance provides a useful vocabulary: biometric comparison evaluates a measured characteristic, while possession-based authentication establishes control of an authenticator. Its framework combines biometrics with a physical authenticator and evaluates matching, presentation attacks and device trust separately. For a signing workflow, this encourages an evidence model that describes each control precisely: the verification result, the session it belongs to, and the action that follows.

The sender sets a required signing step

VerySecure is selected before the document goes out. The sender selects the people who need a palm scan, reviews the envelope cost and sends the request. SignThis saves each selected signer’s requirement with the sent document. A default in Account settings can start new documents with every signer selected; Secure starts with that default on.

1. Open and review. The recipient follows their personal signing link, reviews the document and reads the palm-verification notice.
2. Agree and verify. The signer agrees to the check and uses the Very app on their phone. On a computer, the flow presents a QR code to continue on the phone.
3. Connect the result. Very returns an authorization result. SignThis exchanges it on the server and associates the verified identity with this recipient’s signing session.
4. Complete the signature. A successful pass must be used in that same session within 30 minutes. SignThis checks the requirement again when accepting the signing action.
5. Keep the evidence. The signing event references the palm check. The audit certificate records verification, and the completed document is sealed and timestamped.

The integration follows Very’s OAuth flow, which returns an app-scoped identifier for account linking. SignThis uses PKCE and checks the response’s audience, nonce and expiration to connect it to the request. The recipient and session binding carries that connection through to signing.

The evidence model

These controls work together. A reviewer can follow the sequence from the sender’s requirement to the signer’s verification and the finished file.

Build continuity with established counterparties

Use trusted counterparty onboarding to establish the relationship between a person, their legal name and their authority in your business. At the first successful palm confirmation, SignThis associates the returned Very identity with that recipient address in your workspace. Later VerySecure documents from that workspace to the address must match it. This makes the established relationship useful across repeated agreements.

The association is scoped to the sender’s workspace. SignThis protects the stored provider identifier and uses workspace-scoped fingerprints in the audit evidence. It receives the verification result and identifier; palm images and biometric models are handled by Very. Very’s privacy policy explains its processing of models and enrollment audit images, service providers, retention and deletion controls.

Put palm verification into your next agreement

VerySecure is available on eligible paid plans for adult signers under Very’s age requirements. Recipients use the Very app and need no SignThis account. Signing remains free for recipients; the sender’s plan covers the verification. There are no free palm checks.

On Secure, each palm-verified signer uses 1 envelope from the shared allowance. The plan costs $49/month and includes 400 envelopes/year. Other eligible finite paid plans use 2 envelopes per signer. Review the exact cost before sending.

Start with an agreement where the participating people matter: a supplier contract, an authorization or an agreement with an established partner. Choose VerySecure, send it, and keep the completed PDF and audit certificate together. Compare plans and choose your signing workflow.

For the broader business case, read our article on AI impersonation, signature evidence and palm verification.