My name is Alex M. and I work in API Support at HelloSign.com. Regarding the legality of HelloSign signatures, there's an explanation on why we believe our esignatures are legal on our website.
HelloSign authenticates document signers so you know who is signing your documents. Any person signing a document via HelloSign must either have login information for HelloSign, or have received in their email account a request for signature.
To protect HelloSign user accounts, all user information transferred is 256-bit SSL encrypted, including usernames and passwords. We also seek to prevent others from accessing or using your account by imposing automated session time-outs, and emailing you every time a contract is sent to, received by, or signed under your account.
You’re right though, one would need access to the email to get the link, and by default there’s no second step - it’s typical SSO. There is also an audit trail provided that lists more details on the signer, like time and date signed as well as IP address used to sign.
Also, API customers could use a kind of two factor authentication by way of a signer pin. This is an alpha-numeric pin that should be sent to the signer in some other fashion (via text or over a phone call or in person - something other than being sent to the same email address as the signature request email).
The usage is in our documentation, and how you include the signer pin depends on a number of factors. For instance though, in the name of answering as much as possible here instead of just including links, in cURL when hitting POST
/signature_request/send, you’d include a parameter like this:
Then when signers clicks the link in their email, they first see a page asking for the PIN to access the document.
If anyone has any additional questions, please reach out to us at firstname.lastname@example.org.