Everything Baton does, written down

Getting started

Go to the sign-in page and enter your work email. Baton emails a six-digit code, valid for ten minutes; there is no password to invent. On first sign-in you are asked to name your organization, and then you land on the board.

Everything after that happens inside one organization. If you belong to two, they are entirely separate: separate documents, separate people, separate settings.

Uploading a document

Open Send and drop in a PDF, up to 25 MB. Baton checks that the file is a real, readable PDF and refuses it with a specific reason if it is not (encrypted, corrupt, or not a PDF at all). It also extracts the text as the file arrives, which is what makes the document searchable by its contents later.

The title defaults to the filename and can be changed at any time, including after the document has been sent. Tags are optional, comma-separated, and searchable.

Scanned documents. A scan with no text layer uploads and sends normally, but there is nothing to extract, so it is findable by title and tags and not by its contents. Reading scanned text is planned work, not current behaviour.

Routing: who signs, and when

Each recipient gets an email address, a role, and a number. The number is the whole routing model:

• The same number means at the same time. Everybody on that number is emailed together and can act in any order.
• A higher number means afterwards. Nobody on a later number hears anything until every recipient on the earlier numbers has acted.

Mixing the two is normal and needs no extra concept: finance and the programme lead both on 1, the director on 2, means “those two in any order, then the director”.

Roles

• Signer must sign for the document to progress.
• Approver must act, but signs nothing. Their approval is recorded in the trail and on the certificate as an approval.
• Copied in is never asked to do anything and is never blocking. They receive the outcome.

Due dates and expiry

A document can carry a due date. Past it the row turns red on the board and appears under the overdue filter. An expiry is different: at expiry the document stops being signable, and the organization’s default expiry can be set once in settings and overridden per send.

What a signer sees

An email with a link. Opening it shows the document and a signing panel, with no account, no password, no download, no app. They can draw a signature with a finger or a mouse, or type their name and have it rendered. Both are recorded with the time, the IP address and the browser they used.

The link is a single-use capability. It works for one recipient, it stops working once used, and it stops working when the document completes or expires. Opening it is itself recorded, so “they have not even looked at it” is a question with an answer.

A signer can decline, with a reason. Declining halts the workflow immediately: nobody downstream is emailed, and the reason is recorded in the trail.

Reminders and nudges

A reminder is automatic. Set an interval and a maximum count. The default is every 48 hours, three times, and Baton chases whoever is currently holding the document, then stops and leaves it to you. Reminders can be turned off entirely for the whole organization, which is a real preference and not an empty setting: some organizations consider an automated chase rude.

A nudge is you, deliberately, from the board. One click emails the current holder. Nudges are recorded, so the trail shows that you asked.

Reminders only ever go to the person who is currently blocking. Somebody on a later step is not chased for a document they have not been given yet.

Reading the board

The board is the home screen and it answers three questions: where is it, who has it, what happens next. Documents are ordered by urgency: overdue first, then what needs you, then what is waiting on somebody else.

Above the list are counts for needs-you, waiting, overdue and completed, each linking to that filtered view, plus the median time from send to signed and whether it is improving. The six most recent documents sit on the board; the rest are in the library.

A document whose notification bounced is flagged rather than counted as delivered, because a document nobody received is not a document that is waiting on somebody. This covers both kinds of failure: an address rejected at the moment of sending, and a genuine bounce where the provider accepts the message and the recipient’s mail server rejects it minutes later.

A bounce also clears the recipient’s “asked to act” timestamp. That matters more than the badge: without it the board would keep counting up the time somebody has been holding a document they never received.

Finding a document again

There are no folders. Search covers titles, tags and the text inside every document, is weighted so a title match ranks above a body match, and is typo-tolerant.

Filters (status, sender, team, date range, sent-by-me, overdue) all live in the URL, which is why a search is a link you can send to a colleague and why a saved view is nothing more exotic than a stored query string with a name. Results paginate at 10, 20, 50 or 100 a page.

Templates

A template saves a workflow you trust: the recipients, their roles, the routing order, the reminder cadence, and the covering message. Starting from one still lets you change anything before sending, because a template is a starting point, never a rail.

Templates belong to the organization rather than to the person who created one, so a process survives its author going on leave.

People and roles

Invite somebody by email from Settings → People. The invitation expires after 14 days, and re-inviting replaces the pending invitation rather than stacking a second one, so the most recent link is always the only working link.

There are four roles and there is no fifth:

• Owner can do everything, including billing and other owners. An organization always has at least one, and the last one cannot be demoted or removed.
• Admin manages people and organization settings.
• Member sends documents and manages their own.
• Viewer reads, and cannot send.

Each person can be given a department, which becomes a filter on the library: “everything Finance sent last quarter”.

The audit trail and certificate

Every document has a trail written in sentences: who did what, when, from where. Each entry is hashed together with the entry before it, so the history forms a chain: altering one entry breaks the chain at that exact point.

When a document completes, Baton flattens the signatures into the PDF and appends a certificate page listing every participant, what they did, when, the address they did it from, and the SHA-256 hash of the exact file they saw. The certificate is part of the PDF, so it keeps working after you stop being a customer.

Deleting, restoring, and retention

Deleting a document moves it to Trash, reachable from the library. It stays restorable for a window your organization sets in settings: thirty days by default, minimum one day, maximum a year. The trash page leads with the days remaining, in red inside the last three.

After the window, the file is permanently destroyed and a tombstone remains: the events, the hashes and the certificate survive. So “what happened to that document?” still has an answer after the document itself is gone.

Shortening the window applies to documents already in the trash. Due-ness is derived from when a document was deleted, not from a deadline stored when it was deleted, so cutting thirty days to seven can destroy something tomorrow that was previously safe for three more weeks. That is the correct behaviour for a policy, and it is worth knowing before you type a smaller number.

Limits

Every limit is set so that no honest user reaches it. The full table is on the pricing page; the ones you are most likely to notice are 25 MB per file, 200 recipients on one document, and 200 documents sent per hour.

Programmatic access is covered on the developers page, which is also honest about what does not exist yet.