Make sure the right person opens and signs, with knowledge-based authentication
BoldSign asks each US signer a few questions drawn from public records before the document opens. Signers upload no ID and take no selfie.
- Choose KBA signer by signer
- Reset a locked signer without resending
When do teams add KBA to a signing request?
Teams add BoldSign’s KBA where a signer must be who they say they are, but a photo ID check is more than the document needs. KBA works for signers in the US.
Tax forms signed remotely
IRS guidance names knowledge-based questions for Forms 8878 and 8879 signed remotely. After three failed attempts, a handwritten signature is needed (IRS FAQ). BoldSign lets you allow 1 to 3 attempts.
Loan and account documents
Loan agreements, account opening forms, and disclosures, where an impostor could cause financial loss.
Insurance and patient forms
Consent and claims forms for signers who would rather not upload a government ID.
Real estate paperwork signed remotely
Purchase agreements and disclosures signed by buyers and sellers who may never meet in person. BoldSign does not notarize documents.
What does a signer do to pass KBA?
A BoldSign signer passes KBA in 3 steps in the browser, before the document opens.
Agree and enter legal details
The signer opens the signing link, agrees to the check, and enters their legal name, address, and the last four digits of their SSN.
Answer questions from public records
BoldSign generates questions from public records linked to those details. The signer answers every question on the screen.
Open and sign the document
Correct answers open the document for signing. A failed check can be tried again while attempts remain.
BoldSign does not store the address or SSN digits a signer enters. It keeps only the check’s status, a provider reference, and the time of each attempt.
KBA settings you control for each signer
BoldSign lets the sender set how often a signer repeats KBA, how many tries they get, and how closely their name must match. Admins set the defaults for the whole account.
-
How often the signer verifies
Every access, every access until signed, or once per document. A stricter option suits a document that stays open for days.
-
How many tries a signer gets
Choose how many retries a signer gets before they are locked out of the document.
-
How closely the name must match
None, Lenient, Moderate, or Strict. Moderate allows a middle name or initials; Strict needs a close match.
-
A different check for each signer
Turn on KBA for one signer and choose another check, or none, for the others on the same document.
Should you use KBA or ID verification?
Use BoldSign’s KBA when your signers are in the US and you do not need a photo ID on record. Use ID verification when you need a government ID matched to a live selfie.
| What differs | Knowledge-based authentication | ID verification |
|---|---|---|
| What the signer provides | Legal name, address, and last four SSN digits, then answers to questions | A photo of a passport or driver’s license, and a live selfie |
| Who it works for | Signers in the US | Signers with a supported photo ID |
| What the sender can review | The result of each attempt | The uploaded ID, to approve or reject |
| Price on the Business plan | $1.50 per attempt | $2 per completed attempt, pass or fail |
| Attempts you can allow | 1 to 3 | 1 to 10 |
Prices are in USD.
How are documents signed with KBA kept secure?
BoldSign encrypts every signed document twice with AES-256. Its security controls are independently audited for SOC 2 Type 2, and each standard is listed in your account’s Compliance page, shown below.
Compliance
BoldSign meets global security and compliance standards to protect your documents and data. Manage the settings below to align with your organization’s requirements.
Data Residency
Active (US - Global)Your documents and signer data are securely stored in your selected region to meet data sovereignty and local regulatory requirements.
HIPAA Compliance
EnabledEnable HIPAA mode to protect PHI using administrative, technical, and physical safeguards aligned with HIPAA regulations.
PCI DSS
CompliantPayments are securely processed through Stripe, a PCI DSS Level 1-certified provider, ensuring the safe handling and encryption of all payment data.
CCPA & CPRA
CompliantEnsures compliance with California privacy laws, giving residents transparency and control over their personal data, including rights to access, delete, and opt out.
SOC 2 Type II
CompliantBoldSign has successfully completed a SOC 2 Type II audit, validating our controls for security, availability, confidentiality, and data integrity.
UETA & ESIGN
CompliantBoldSign ensures that all e-signatures are legally binding and compliant with the U.S. ESIGN Act and the Uniform Electronic Transactions Act (UETA).
eIDAS (SES)
CompliantBoldSign complies with the EU eIDAS Regulation (910/2014) and supports Simple Electronic Signatures (SES) by default.
eIDAS (QES)
EnabledEnable Qualified Electronic Signatures (QES) for contracts requiring the highest legal assurance under eIDAS.
Security and procurement documents for eSignature
IT and procurement teams can read BoldSign’s security policy, data processing agreement, and subprocessor list online, and request the SOC 2 Type 2 report.
- Sign-in
Single sign-on and user provisioning
Single sign-on and user provisioning with Microsoft Entra ID are on the Business and Premium plans.
See features by plan - Audit report
SOC 2 Type 2 report
Available on request from BoldSign.
Request the SOC 2 report - Data protection
Data processing agreement
Includes the EU standard contractual clauses and the UK Addendum by reference.
Read the data processing agreement - Data protection
Subprocessor list
Every third party BoldSign uses to process data.
See the subprocessor list - Service
Service level agreement
Uptime, support response times, and service commitments.
Find it in the Legal Center
Why choose BoldSign for knowledge-based authentication
BoldSign gives your US signers an identity check with no ID upload, and gives your team control over each signer’s check and its cost.
-
Failed checks don't cancel the document
A failed KBA does not cancel the document. You reset the signer’s verification, and they carry on from the same signing link, with no resending.
-
No cost until the check starts
Adding KBA costs nothing until the signer starts the check, so documents nobody opens add no KBA cost.
-
KBA usage shown separately
KBA usage is listed apart from ID verification on your subscription and transaction pages.
-
Free help on every plan
Help by chat, email, or support ticket, free on every plan.
Which eSignature tools offer knowledge-based authentication?
BoldSign, Docusign, Adobe Acrobat Sign, and PandaDoc all publish a knowledge-based authentication option, each on a different plan. Each KBA attempt costs $1.50 on the BoldSign Business plan and $2 on the PandaDoc Business plan. Docusign lists KBA on its Enhanced plans and Adobe on its enterprise plans, and neither publishes a KBA rate.
| Capability | BoldSign | Docusign | Adobe Acrobat Sign | PandaDoc | Dropbox Sign |
|---|---|---|---|---|---|
| Plan that includes KBA | Business plan$15 per user a month | Enhanced plansContact sales. Not on Personal, Standard, or Business Pro | Enterprise plansNot published | Business and Enterprise plansBusiness is $49 per seat a month | Not publishedHelp pages list only SMS and access codes |
| Price per KBA attempt | $1.50 per attemptPass or fail, pay as you go | Not publishedThe identity add-on starts at $2.40 per ID verification attempt | Not publishedTransactions bought through a sales rep, one per recipient, not per attempt | $2 per attemptEvery attempt is deducted from a prepaid balance | Not published |
| KBA for several signers on one request | Yes, set per recipient | Yes, set per recipient | Yes, set per recipient | Yes, set per recipient | Not published |
| After a signer’s last failed attempt | Document is not canceledYou reset KBA and the signer uses the same link | Envelope is locked by defaultThe signer contacts the sender to unlock it | Agreement is cancelled by defaultA new agreement is needed | Signer contacts the sender | Not published |
Swipe sideways to see all five vendors.
Not published means the vendor’s own pricing and help pages do not state it.
Spotted something outdated? Tell us through the contact page.
Limits and costs to know before you add KBA with BoldSign
BoldSign’s KBA checks who opens a document. It does not check a government ID; that is what ID verification does.
- $1.50 per KBA attempt Charged when the questions are generated, pass or fail. Each retry is a new attempt.
- $15 Business plan, per user a month Billed yearly. KBA cannot be added to the Essential or Growth plans (pricing).
- 3 attempts at most After the last one, the document locks for that signer until you reset KBA.
- US signers only KBA works only for recipients based in the US.
Before your first KBA send
- KBA cannot be combined with an access code, email OTP, SMS OTP, or ID verification for the same signer.
- KBA cannot be used for signing groups or in-person signers.
- Trial plans include no KBA credits.
Can developers add KBA with an API?
Yes, the BoldSign API turns on KBA when you set a signer’s authenticationType to KBA, with kbaSettings for frequency, attempts, and name matching. The same settings can be added to a signer after a document is sent.
These samples come from the developer guide How to send a document with KBA using BoldSign API.
curl -X 'POST' \
'https://api.boldsign.com/v1/document/send' \
-H 'accept: application/json' \
-H 'X-API-KEY: {Your API Key}' \
-H 'Content-Type: multipart/form-data' \
-F 'Files=@{Your file path};type=application/pdf' \
-F 'Title=Agreement' \
-F 'Signers={
"name": "Alex Gayle",
"emailAddress": "alexgayle@cubeflakes.com",
"authenticationType": "KBA",
"kbaSettings": {
"type": "EveryAccess",
"maximumRetryCount": 3,
"nameMatcher": "Strict"
},
"signerType": "Signer",
"formFields": [
{
"id": "signature1",
"name": "signature1",
"fieldType": "Signature",
"pageNumber": 1,
"bounds": {
"x": 100,
"y": 100,
"width": 100,
"height": 50
},
"isRequired": true
}
]
}' using BoldSign.Api;
using BoldSign.Api.Model;
using BoldSign.Api.Model.Kba;
using BoldSign.Model;
var apiClient = new ApiClient("https://api.boldsign.com", "{Your API Key}");
var documentClient = new DocumentClient(apiClient);
var documentFilePath = new DocumentFilePath
{
ContentType = "application/pdf",
FilePath = "{Your File Path}",
};
var filesToUpload = new List<IDocumentFile>
{
documentFilePath,
};
var signatureField = new FormField(
id: "signature1",
isRequired: true,
type: FieldType.Signature,
pageNumber: 1,
bounds: new Rectangle(x: 100, y: 100, width: 100, height: 50));
var kbaSettings = new KbaSettings
{
Type = AuthenticationFrequency.EveryAccess,
MaximumRetryCount = 3,
NameMatcher = KbaNameMatchLevel.Strict,
};
var signer = new DocumentSigner(
signerName: "Alex Gayle",
signerType: SignerType.Signer,
signerEmail: "alexgayle@cubeflakes.com",
authenticationType: AuthenticationType.KBA,
formFields: new List<FormField> { signatureField },
locale: Locales.EN)
{
KbaSettings = kbaSettings,
};
var sendForSign = new SendForSign
{
Title = "Agreement",
Signers = new List<DocumentSigner> { signer },
Files = filesToUpload,
};
var documentCreated = documentClient.SendDocument(sendForSign);
Console.WriteLine(documentCreated.DocumentId); import boldsign
configuration = boldsign.Configuration(host = "https://api.boldsign.com", api_key="YOUR_API_KEY")
with boldsign.ApiClient(configuration) as api_client:
document_api = boldsign.DocumentApi(api_client)
send_for_sign = boldsign.SendForSign(
title="Agreement",
files=["YOUR_FILE_PATH"],
signers=[
boldsign.DocumentSigner(
name="Alex Gayle",
emailAddress="alexgayle@cubeflakes.com",
signerType="Signer",
authenticationType="KBA",
kbaSettings=boldsign.KbaSettings(
type="EveryAccess",
maximumRetryCount=3,
nameMatcher="Strict"
),
formFields=[
boldsign.FormField(
name="signature1",
fieldType="Signature",
pageNumber=1,
isRequired=True,
bounds=boldsign.Rectangle(x=100, y=100, width=100, height=50)
)
],
locale="EN"
)
]
)
document_created = document_api.send_document(send_for_sign)
print(document_created.document_id) <?php require_once "vendor/autoload.php";
use BoldSign\Configuration;
use BoldSign\Api\DocumentApi;
use BoldSign\Model\FormField;
use BoldSign\Model\Rectangle;
use BoldSign\Model\DocumentSigner;
use BoldSign\Model\KbaSettings;
use BoldSign\Model\SendForSign;
$config = new Configuration();
$config->setHost('https://api.boldsign.com');
$config->setApiKey('YOUR_API_KEY');
$document_api = new DocumentApi($config);
$form_field = new FormField();
$form_field->setName('signature1');
$form_field->setFieldType('Signature');
$form_field->setPageNumber(1);
$form_field->setIsRequired(true);
$bounds = new Rectangle([100, 100, 100, 50]);
$form_field->setBounds($bounds);
$kba_settings = new KbaSettings();
$kba_settings->setType('EveryAccess');
$kba_settings->setMaximumRetryCount(3);
$kba_settings->setNameMatcher('Strict');
$document_signer = new DocumentSigner();
$document_signer->setName('Alex Gayle');
$document_signer->setEmailAddress('alexgayle@cubeflakes.com');
$document_signer->setSignerType('Signer');
$document_signer->setAuthenticationType('KBA');
$document_signer->setLocale('EN');
$document_signer->setFormFields([$form_field]);
$document_signer->setKbaSettings($kba_settings);
$send_for_sign = new SendForSign();
$send_for_sign->setTitle('Agreement');
$send_for_sign->setFiles(['YOUR_FILE_PATH']);
$send_for_sign->setSigners([$document_signer]);
$document_created = $document_api->sendDocument($send_for_sign); import com.boldsign.ApiClient;
import com.boldsign.Configuration;
import com.boldsign.api.DocumentApi;
import com.boldsign.model.DocumentCreated;
import com.boldsign.model.DocumentSigner;
import com.boldsign.model.FormField;
import com.boldsign.model.KbaSettings;
import com.boldsign.model.Rectangle;
import com.boldsign.model.SendForSign;
import java.io.File;
import java.util.Arrays;
ApiClient client = Configuration.getDefaultApiClient();
client.setBasePath("https://api.boldsign.com");
client.setApiKey("YOUR_API_KEY");
DocumentApi documentApi = new DocumentApi(client);
FormField formField = new FormField();
formField.setName("signature1");
formField.setFieldType(FormField.FieldTypeEnum.SIGNATURE);
formField.setPageNumber(1);
formField.setIsRequired(true);
Rectangle bounds = new Rectangle().x(100f).y(100f).width(100f).height(50f);
formField.setBounds(bounds);
KbaSettings kbaSettings = new KbaSettings();
kbaSettings.setType(KbaSettings.TypeEnum.EVERY_ACCESS);
kbaSettings.setMaximumRetryCount(3);
kbaSettings.setNameMatcher(KbaSettings.NameMatcherEnum.STRICT);
DocumentSigner signer = new DocumentSigner();
signer.setName("Alex Gayle");
signer.setEmailAddress("alexgayle@cubeflakes.com");
signer.setSignerType(DocumentSigner.SignerTypeEnum.SIGNER);
signer.setAuthenticationType(DocumentSigner.AuthenticationTypeEnum.KBA);
signer.setLocale(DocumentSigner.LocaleEnum.EN);
signer.setFormFields(Arrays.asList(formField));
signer.setKbaSettings(kbaSettings);
SendForSign sendForSign = new SendForSign();
File file = new File("YOUR_FILE_PATH");
sendForSign.setFiles(Arrays.asList(file));
sendForSign.setSigners(Arrays.asList(signer));
sendForSign.setTitle("Agreement");
DocumentCreated documentCreated = documentApi.sendDocument(sendForSign); import { DocumentApi, DocumentSigner, FormField, Rectangle, SendForSign, KbaSettings } from "boldsign";
import * as fs from 'fs';
const baseUrl:string = "https://api.boldsign.com";
const documentApi = new DocumentApi(baseUrl);
documentApi.setApiKey("YOUR_API_KEY");
const bounds = new Rectangle();
bounds.x = 100;
bounds.y = 100;
bounds.width = 100;
bounds.height = 50;
const formField = new FormField();
formField.name = "signature1";
formField.fieldType = FormField.FieldTypeEnum.Signature;
formField.pageNumber = 1;
formField.isRequired = true;
formField.bounds = bounds;
const kbaSettings = new KbaSettings();
kbaSettings.type = KbaSettings.TypeEnum.EveryAccess;
kbaSettings.maximumRetryCount = 3;
kbaSettings.nameMatcher = KbaSettings.NameMatcherEnum.Strict;
const documentSigner = new DocumentSigner();
documentSigner.name = "Alex Gayle";
documentSigner.emailAddress = "alexgayle@cubeflakes.com";
documentSigner.signerType = DocumentSigner.SignerTypeEnum.Signer;
documentSigner.authenticationType = DocumentSigner.AuthenticationTypeEnum.Kba;
documentSigner.locale = DocumentSigner.LocaleEnum.En;
documentSigner.formFields = [formField];
documentSigner.kbaSettings = kbaSettings;
const files = fs.createReadStream("YOUR_FILE_PATH");
const sendForSign = new SendForSign();
sendForSign.title = "Agreement";
sendForSign.signers = [documentSigner];
sendForSign.files = [files];
const documentCreated = await documentApi.sendDocument(sendForSign); More guides on knowledge-based authentication
BoldSign guides explain what KBA is, how it sits beside the other signer checks, and how to set it up step by step.
- Guide
What KBA is and when to use it
The signer’s view, failed checks, and KBA beside ID verification.
Read the guide - Page
Signer authentication methods
All five ways BoldSign confirms who is signing.
See the page - Help
KBA in the help centre
Sending, signing, settings, failed checks, and billing.
Read the articles
Switching from another eSignature tool
Docusign templates import into BoldSign at no charge with BoldSign’s import tool, and BoldSign support helps teams make the switch.
- Guide
Import your Docusign templates
Step-by-step help for moving Docusign templates into BoldSign.
Read the import guide - Comparison
BoldSign compared with Docusign
Features and prices side by side, for teams moving from Docusign.
See the Docusign comparison - Comparison
BoldSign compared with Dropbox Sign
For teams moving from Dropbox Sign, formerly HelloSign.
See the Dropbox Sign comparison - Comparison
BoldSign compared with Adobe Acrobat Sign
For teams moving from Adobe Acrobat Sign.
See the Adobe comparison - Comparison
BoldSign compared with PandaDoc
For teams moving from PandaDoc.
See the PandaDoc comparison - Comparison
SignNow and other tools
Every eSignature tool BoldSign is compared with.
See all comparisons
Questions about knowledge-based authentication
Is a document signed after KBA legally binding?
Yes. BoldSign complies with the ESIGN Act, UETA, and eIDAS, so its signatures are secure and legally binding. KBA adds an identity check before the signer opens the document.
What happens if a signer fails KBA?
A failed KBA does not cancel the document. The signer can try again while attempts remain. After the last attempt, the document locks for them until the sender resets KBA or removes it. After a reset, the signer uses the same link, and their next attempt is charged like any other.
Can KBA be added to a document that was already sent?
Yes. BoldSign lets the sender add KBA to a signer from the document’s overview page. The signer uses the same link and completes KBA the next time they open the document.
Is KBA charged if the signer never opens the document?
No. BoldSign records KBA usage only when the signer starts the check and the questions are generated. Adding KBA, or resetting it, creates no charge on its own.
Do signers need a BoldSign account to complete KBA?
No. BoldSign signers open the signing link and complete KBA in their browser, without an account.
Confirm who is signing before your next agreement opens
Start a free trial of BoldSign, or book a walkthrough using your own documents.
Last updated: October 15, 2026. Disclaimer: This page contains product comparisons based on publicly available information as of October 2026 and may change.