Should I put an IRD number in the covering message?

No. Ask for it in a field inside the document, where the signer completes it.

What does the audit trail record about a signer?

Their name and email address, the time of each view and signature, and the IP address.

How do I limit who sees completed documents?

Use workspace roles managed by your admins, and only copy in people who need the finished copy.

Guides · By team

Handling signers' personal information with care.

The documents you send for signature often carry personal details: home addresses, IRD numbers, bank accounts, dates of birth, copies of passports. The people signing trust you with them. This guide sets out practical habits for treating that information well across your document workflow. For questions about your organisation's obligations, talk to your adviser or privacy officer.

Ask only for what you will use

Every field on a form is a piece of information you then have to look after. Before turning a document into a template, go through it and remove anything you don't actually use. If you never post anything to a new client, you may not need their home address on the engagement letter.

Make only the essential fields required, and leave the rest optional or take them out.

Keep sensitive details out of the email

The message that goes with an envelope is sent by email, so it is the wrong place for an IRD number, a bank account or medical details. Keep those inside the document as fields the signer completes. Ask signers to attach ID through an upload field rather than replying with a photo.

Put identifiers in document fields, not in the message.
Use upload fields for copies of ID and certificates.
Avoid forwarding completed documents around by email.

Decide who in the team can see what

In a shared workspace, admins manage who can do what. Think about who needs access to envelopes holding personal details, and set roles to suit. Copy people in only when they genuinely need the finished document: payroll needs the IR330, the whole office does not.

Turn on two-step sign-in for accounts, so a stolen password alone isn't enough to get in.

Tell signers what is recorded

Each envelope's audit trail records views and signatures with names, email addresses, times and IP addresses. That record is what lets you show who signed and when, and people are usually comfortable with it once they know. A line in your covering message or your privacy statement saying so avoids surprises.

If you switch on AI document summaries for signers, mention that too.

Think about the whole life of a document

Personal information doesn't stop needing care once the document is signed. Know where finished copies end up, for example in Xero if you file them there automatically, and who can reach them. Agree with your adviser how long your business keeps each kind of document, and stick to it.

Common questions

Should I put an IRD number in the covering message?: No. Ask for it in a field inside the document, where the signer completes it.
What does the audit trail record about a signer?: Their name and email address, the time of each view and signature, and the IP address.
How do I limit who sees completed documents?: Use workspace roles managed by your admins, and only copy in people who need the finished copy.