Is an electronic CoD legally binding?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally enforceable provided intent, consent, attribution, and reliable record retention are demonstrable.

Do I need notarization for a CoD?

Not usually. Notarization may be required by specific contracts or internal policy; consult counsel if a higher evidentiary standard is needed or if a state statute mandates it.

Can I use remote online notarization (RON)?

Many states permit RON with identity proofing and recording; verify your state notary rules and retention requirements before relying on a RON for proof of destruction.

How long must the CoD be kept?

Retention depends on the underlying record type: IRS rules (3+ years), HIPAA (6 years) and company policy. Keep the CoD at least as long as the longest applicable requirement.

Who should sign the CoD?

An authorized records owner or a designated certifier should sign. For vendor-performed destruction, a vendor representative should also sign and provide a chain-of-custody record.

What authentication level is sufficient?

Email-only may be acceptable for internal processes; use stronger authentication (SMS, SSO, or multi-factor) for sensitive records or where contract or regulation requires higher assurance.

Electronic Signature
Templates
Miscellaneous
Business Services CoD Template

Business Services CoD Template

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

BUSINESS SERVICES CoD TEMPLATE

Parties

Service Provider:

Service Provider Address

Client:

Client Address

Effective Date:

Recitals

WHEREAS, Service Provider is duly organized and qualified to provide the business services described herein and has the professional capability, personnel and resources required to perform such services; and

WHEREAS, Client desires to engage Service Provider to perform services on the terms and conditions set forth in this Agreement and Service Provider is willing to provide such services pursuant to this Agreement.

Scope of Work

The Service Provider shall perform the services described below. The description below constitutes the complete scope of deliverables, milestones and performance requirements to be provided to Client.

Describe services, deliverables, milestones and acceptance criteria

Payment Terms

Total Fee:

Payment Schedule and Invoicing

Invoices due within days of invoice date. Late payments shall incur interest at % per month or the maximum permitted by law, whichever is less. Client shall also be responsible for reasonable collection costs, including attorneys' fees, incurred in collecting overdue amounts.

Term and Termination

Term Commencement Date: . Term End Date: .

Either party may terminate this Agreement for convenience upon written notice to the other party delivered at least days prior to the intended termination date. Either party may terminate immediately for material breach by the other party if such breach remains uncured for 15 days after written notice specifying the breach. Termination does not relieve Client of payment obligations for services rendered and expenses incurred through the effective date of termination.

Confidentiality

Each party acknowledges that it may receive Confidential Information of the other party. "Confidential Information" means non-public business, technical or financial information marked confidential or that reasonably should be understood to be confidential. The receiving party shall (a) limit disclosure to its employees and subcontractors who need access for performance; (b) use at least the same degree of care to protect Confidential Information as it uses to protect its own confidential information but no less than reasonable care; and (c) not use Confidential Information for any purpose other than performance under this Agreement. Confidentiality obligations shall survive for years following termination.

Insurance; Independent Contractor

Service Provider shall perform services as an independent contractor and shall be responsible for all taxes and withholdings. Service Provider shall maintain commercial general liability and professional liability insurance in amounts customary for the industry and shall provide certificates of insurance upon Client's request.

Limitation of Liability

Except for willful misconduct or gross negligence, neither party shall be liable to the other for consequential, incidental, special or punitive damages. The aggregate liability of either party for any claim arising under or relating to this Agreement shall not exceed the total amount of fees paid by Client to Service Provider under this Agreement during the twelve (12) months preceding the claim.

Notices

All notices required or permitted hereunder shall be in writing and delivered to the addresses set forth above or such other address as a party may designate by notice. Notices are effective upon receipt.

Governing Law

This Agreement shall be governed by and construed in accordance with the laws of the State of without regard to its conflicts of law principles. The parties submit to the exclusive jurisdiction of the courts located in that state for disputes arising under this Agreement.

Entire Agreement

This Agreement, including any exhibits and schedules attached hereto, constitutes the entire agreement between the parties and supersedes all prior and contemporaneous agreements, proposals and communications, whether oral or written, relating to the subject matter. Any modifications must be in writing and signed by authorized representatives of both parties.

Severability; Waiver

If any provision of this Agreement is held invalid or unenforceable, the remainder shall remain in full force. Failure or delay by either party to enforce any right shall not constitute a waiver of that right.

Service Provider:

By:

Date:

Client:

By:

Date:

What the Business Services Certificate of Destruction documents

A Business Services Certificate of Destruction (CoD) documents that specified physical or electronic business records, media, or equipment were destroyed according to an organized process. The CoD records who authorized the destruction, what items were destroyed, the method used (for example, shredding, degaussing, or secure wiping), the date and location of destruction, and chain-of-custody details. Many organizations use a CoD to meet regulatory obligations, support compliance audits, and demonstrate due care after disposal of sensitive customer, employee, or financial data.

Why a clear CoD matters for risk and compliance

A completed CoD reduces legal and privacy risk by documenting proper disposal, supporting audits, and showing compliance with federal rules like HIPAA and IRS recordkeeping where applicable.

Organizations and roles that typically complete a CoD

Teams that commonly prepare or sign CoDs include records managers, IT asset disposition vendors, compliance officers, and business owners responsible for data lifecycle controls.

Records managers and compliance officers — prepare and retain destruction records for audits and legal holds.
IT asset disposition vendors — document chain of custody and method for hardware and media disposal.
Finance and HR teams — confirm secure disposal of payroll, tax, and personnel records per retention policies.

The final signed CoD should be retained according to your retention schedule and made available for internal or external review when required.

Step-by-step: completing the CoD

Follow these sequential steps to prepare, validate, and archive a legally robust Certificate of Destruction.

01

Inventory: Compile a detailed list of records and media to be destroyed.
02

Authorize: Obtain written approval from the records owner or compliance officer.
03

Destroy: Perform destruction using an approved method and capture evidence.
04

Sign and Store: Collect signatures, note dates, and retain the CoD in secure records.

Configure an online CoD workflow

Typical configuration settings ensure accurate routing, signer authentication, and secure storage for the completed CoD.

Field	Configuration
Routing Order	Set signer sequence: preparer → approver → certifier
Authentication	Email + SMS code or organization SSO for higher assurance
Audit Trail	Enable IP, timestamp, and action logging
Archive Location	Save PDF/A copy to secure records repository

Online signing flow for a CoD

A standard e-sign workflow captures intent, attribution, and an auditable trail for each signer.

Upload Document: Sender uploads CoD and attaches inventory list.
Assign Fields: Place signature, date, and text fields for required parties.
Signers Authenticate: Recipients verify identity via configured method.
Complete & Archive: Signed CoD and audit record are stored securely.

Technical and integration requirements for eSigning CoDs

Ensure the signing platform supports secure file formats, an auditable completion certificate, and integration with your records system.

File Formats: PDF, Word DOCX supported
Integrations: Salesforce, NetSuite, Box, Google Workspace
Authentication: Email, SMS, SSO options

Choose settings that produce a tamper-evident signed file with metadata export and searchable archive entries to meet audit and legal requirements.

Essential components of a professional CoD

A well-structured CoD combines identification, method, authorization, chain-of-custody, signatures, and retention instructions.

Identification

Unique CoD number, preparer name, and organization details so each destruction event can be traced unambiguously.

Itemization

Detailed descriptions, serial numbers, and quantities for all destroyed items to avoid disputes in later audits or legal reviews.

Methodology

Specify the destruction method used (shredding, degauss, wipe) and any standards followed, such as NIST SP 800-88 for media sanitization.

Authorization

Signed approval from the records owner or compliance officer showing permission to destroy items and confirming no legal holds exist.

Certifying Signature

Signature block for the person certifying destruction with date and role, optionally authenticated or notarized if required by policy.

Retention Note

Instructions on how long the CoD itself must be kept, including references to internal policy or external regulatory requirements.

Required information to include on the CoD

CoD ID: Unique reference

Preparer: Name and contact

Destruction Date: MM/DD/YYYY

Method: Shred/wipe/degauss

Items: Detailed list

Signer: Authorized signer

Common mistakes to avoid when preparing a CoD

Using vague item descriptions without serial numbers or inventory links, which complicates audits and increases dispute risk.
Failing to confirm there are no legal holds or litigation holds before destruction, exposing the organization to spoliation allegations.
Not capturing an auditable trail (timestamps, IP, signer identity), weakening evidentiary value of the CoD in regulatory reviews.
Retaining only a paper copy in an unsecured location rather than a tamper-evident digital archive with restricted access controls.

Risks and penalties from incorrect or premature destruction

Regulatory Penalties: Fines and enforcement actions for violating statutes such as HIPAA.

Litigation Risk: Spoliation claims and sanctions if records were improperly destroyed.

Contract Breach: Liability for failing to meet contractual recordkeeping obligations.

Data Exposure: Incomplete destruction may permit data recovery and breach

Audit Failure: Noncompliant disposal can result in failed audits

Reputational Harm: Loss of customer trust after improper disposal

Key dates and processing expectations for CoDs

Define dates clearly on the CoD to avoid compliance gaps and to coordinate retention and audit readiness.

Destruction Date Entry:

Record actual destruction date in MM/DD/YYYY format; this starts retention for the CoD record.

Authorization Date:

Note when the records owner approved destruction to show proper permission was obtained.

Notification Window:

Notify stakeholders within the timeframe set by internal policy or state privacy law where applicable.

Retention Start:

Retention of the CoD typically begins on the destruction date unless law provides otherwise.

Audit Availability:

Make the CoD available for internal or external audit within the period required by governing policy.

Real-world examples showing CoD use in practice

Organizations use CoDs to streamline disposal and demonstrate compliance in audits and customer inquiries.

Optica Ventures LLC

Optica standardized destruction records across subsidiaries to reduce disputes.

Implemented inventory-linked CoDs for all media.
The change simplified audits and provided a single trusted record for regulators and partners, reducing administrative follow-ups.

Martin Properties

A property manager began issuing CoDs after tenant file disposal.

Tracked disposals by lease term and unit.
That practice produced timely evidence for tax audits and helped the firm defend against post-closure document requests.

Practical tips for accurate and efficient CoD management

Apply consistent procedures and technology to limit manual errors and improve evidentiary value.

Link to Inventory

Always attach or reference the inventory manifest and serial numbers so each CoD maps to physical assets and cannot be misinterpreted.

Use Strong Authentication

Require SMS codes or SSO for certifying signers to strengthen attribution and admissibility in disputes.

Keep Tamper-Evident Records

Store signed CoDs as PDF/A with an immutable audit trail and limited access controls to prevent unauthorized changes.

Check Legal Holds

Always verify litigation or regulatory holds before destruction; document the check on the CoD itself.

eSignature pricing comparison for executing CoDs

Platform pricing and features affect cost and compliance capabilities; the table compares common vendor metrics for CoD workflows.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

Frequently asked questions about CoD execution and eSigning

Answers to common questions about validity, authentication, retention, and using electronic signatures for Certificates of Destruction.

Need help? Contact support

Is an electronic CoD legally binding?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and state UETA laws, electronic signatures are legally enforceable provided intent, consent, attribution, and reliable record retention are demonstrable.
Do I need notarization for a CoD?
Not usually. Notarization may be required by specific contracts or internal policy; consult counsel if a higher evidentiary standard is needed or if a state statute mandates it.
Can I use remote online notarization (RON)?
Many states permit RON with identity proofing and recording; verify your state notary rules and retention requirements before relying on a RON for proof of destruction.
How long must the CoD be kept?
Retention depends on the underlying record type: IRS rules (3+ years), HIPAA (6 years) and company policy. Keep the CoD at least as long as the longest applicable requirement.
Who should sign the CoD?
An authorized records owner or a designated certifier should sign. For vendor-performed destruction, a vendor representative should also sign and provide a chain-of-custody record.
What authentication level is sufficient?
Email-only may be acceptable for internal processes; use stronger authentication (SMS, SSO, or multi-factor) for sensitive records or where contract or regulation requires higher assurance.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now