Report sign-off
A finished assessment is a record. Sign-off is what turns it into an attested record: a named person stating, on a date, that they reviewed the assessment and that its responses are accurate to the best of their knowledge.
Who signs, and what they are saying
Your organization signs. The signer confirms they are authorized to act for the organization, that they reviewed the assessment in full, and that its responses and supporting information are accurate and complete to the best of their knowledge on the date of signing. The statement names no law and is shown in full before signing. A signature is your organization's own statement about its program. It is not a certification of compliance by Backsplice or anyone else. On a guided review, our team countersigns too, and the report is final only once both have signed.
The customer statement is deliberately not a sworn or perjury declaration — we are not a law firm, and an attestation should not pretend to be a legal oath.
Signing inside the app
Open the completed report and use the sign-off panel. Signing is for org admins (not delegated admins) and asks for your password and a second factor at the moment you sign. You must tick the agreement box explicitly; the button alone is not consent. Signing records your name, title, IP address, and the timestamp.
Sending it to someone without an account
The person who should sign is often an owner, principal, or compliance officer who does not use Backsplice day to day. You do not need to create an account for them.
From the completed report, choose Send for signature and enter their name, email, and title, plus an optional note explaining what you are asking for. They receive a private link that:
- signs once; after that the link, and the report it opens, stop working;
- expires after 14 days;
- shows them the report summary and the exact statement they are agreeing to;
- opens a read-only copy of the full report (the score, the answers and the findings) that they can read as often as they need before signing. Reading it does not use the link up, and it offers no download;
- grants nothing else — no dashboard, no other assessment, no ability to change any answer.
The link is shown to you once when you send it, so you can pass it along another way if email is unreliable. Treat it like a password: anyone holding it can read and sign that one report.
Sending to an outside signer and signing inside the app both work on Premium and Enterprise, and on the Free plan.
If you need to cancel
Withdraw an outstanding request from the same panel. That kills the link immediately. You can then send a fresh one — only one request can be outstanding per report at a time, so withdraw before re-sending.
What gets stored, and why it matters at audit time
The exact wording the signer agreed to is copied into the record, together with a version stamp. It is never reconstructed from today's text.
This matters: if the attestation wording is ever revised, a report signed last year still shows the wording that was actually agreed to last year. An auditor asking "what did they attest to, and when?" gets a straight answer. For the same reason, a signature is permanent — it is never removed by ordinary housekeeping, even if the original request record is cleaned up later.
The signature block appears on the report in the app and in the exported PDF, which is what an auditor usually receives. PDF export comes with a paid plan; it is not on the Free plan.
Revoking a signature, and your public badge
A public badge asserts a signed, final report, with the report's own score (shown unless you hide it; the share of its answered, applicable questions answered Yes, as on the report and its certificate) and the assessment date as they stood when the badge was issued. So revoking a signature on the report revokes every badge issued for it at once (as does reopening an assessment that has not been finalized, or deleting it), and its verification page then says it was revoked. Signing the report again does not bring an old badge back: issue a new one from the certificate of that assessment's kind (AI governance or HIPAA), which takes its score as it is now; a badge needs every question the assessment asks answered.
Showing or hiding the score on your badges
Your badges show their score, and their verification pages the score and grade, unless you turn this off. An admin changes it on the certificate page, in the badge panel (Show the score on your badges). With it off, neither the badge nor its verification page shows a score or grade: the badge still shows that the assessment was completed, and its date. A change reaches every badge your organization has published within five minutes. The score is still recorded with each badge, so turning the setting back on shows it again. The public transparency page has its own setting and is not changed by this one.