Somewhere behind most reception desks there is a folder with an NDA in it. Somebody printed it, somebody else revised the third paragraph two years ago, and the version in the folder may or may not be that one. It gets signed when the desk is staffed and the person behind it remembers. A visitor NDA at check-in solves a narrower problem than "legal compliance" — it makes the signature a step the visitor cannot walk past, and it keeps a copy that points at exactly the words they agreed to.

Why the folder version quietly fails

The paper flow has four failure modes, and none of them announce themselves.

• Nobody knows which version is current. When the wording changes, the old printouts stay in the folder and in the filing cabinet. Two visitors on the same day can sign two different agreements, and a year later nothing in the file says which.
• The visitor doesn't get a copy. They sign something, hand it back, and leave with nothing. If they ever ask what they agreed to, you're photocopying.
• It's skipped exactly when it matters. The contractor who arrives at 7 a.m. before anyone is at the desk is the visit you'd most want a signature on, and it's the one the folder can't cover.
• The record and the log are the same piece of paper. That sounds tidy until you need to delete old visitor data. A signed agreement is a legal record with its own reason to exist; a line saying "Marc from Groupe Delta was here on the 14th" is not. Bundling them means you either keep everything too long or destroy something you shouldn't have.

What "signed at check-in" should actually mean

If you're evaluating a system that promises documents at the door, these are the properties that make it worth having.

• It's attached to a visitor type, not to somebody's memory. Contractors sign the safety briefing; candidates sign the confidentiality notice; a delivery signs nothing. The rule lives in the configuration, so it applies at 7 a.m. as reliably as at 2 p.m.
• It blocks the check-in. If a visitor of that type can complete check-in without signing, it isn't a requirement — it's a suggestion with better formatting. Declining should be allowed, and should simply end the check-in with nothing stored.
• Editing publishes a new version instead of overwriting. Every signature has to keep pointing at the exact text it agreed to. A system that lets you edit a document in place has just changed the terms of every signature ever collected on it, retroactively and invisibly.
• The visitor gets their own copy. A signed PDF, sent to them, without anyone having to remember to do it.
• It's in a language they can read. A signature on text somebody couldn't read is worth less than the paper it isn't printed on. And switching the tablet's language must not be a way around the document.
• Re-signing has a policy. Nobody wants a weekly contractor signing the same NDA every Tuesday. Nobody wants a signature from 2019 to still count either. There should be a window, and you should be the one who sets it.

The Québec angle, carefully

A note before this section: what follows is general orientation, not legal advice. WeDisplay is not a law firm and nothing here is a compliance ruling for your organization. Privacy obligations depend on what you collect, why, who you are, and where your people are — questions worth putting to counsel or to the Commission d'accès à l'information du Québec rather than to a blog post. Our own legal pages carry the same caution for the same reason.

With that said, there are themes in Québec's Law 25 (and in Canadian privacy practice generally) that a reception desk touches directly, and that are worth having thought about before an auditor or a visitor asks.

• Collect what you need, for as long as you need it. A visitor log is personal information. Keeping names, employers and email addresses indefinitely because nobody chose a retention period is the default most paper systems land on, and it is the opposite of data minimization.
• A signed agreement and a visit record are different things. The agreement may reasonably need to outlive the visit by years; the log entry usually doesn't. Systems that treat them as one object force you into the wrong answer on one of them.
• People should be able to see what they signed. Handing the visitor their own copy at the time is the least effortful version of this, and it also removes an entire category of later dispute.
• Be able to answer "what do you hold about me, and for how long." Not because it happens often, but because the answer should be a setting you can point at rather than an investigation.

None of that is exotic, and none of it requires a compliance program. It mostly requires the system to have opinions about retention instead of leaving the field blank.

Doing it with WeDisplay

Documents and e-signature are part of the visitor kiosk, on plans that include them. The shape of it:

• Per visitor type, per language. Attach a document to a visitor type and nobody of that type checks in without signing it. Each document can have a version per language, and the tablet picks the visitor's language, falling back to your organization's, then to English.
• Signed with a finger, on the glass. The signature is captured on the tablet itself — no second device, no emailed link to open later.
• Editing publishes a new version. Previous versions are never edited or deleted, because signatures point at the exact version they agreed to. If a tablet is showing a stale version when someone signs, the server refuses it rather than recording a signature against text that no longer exists.
• A re-sign window you choose. By default a visitor is re-prompted when the document version changed, or when their last signature is more than a year old. You can set that window yourself.
• The visitor gets the PDF. The signed copy holds the text, the signature, the name and the timestamp, and it's stored against the visit. If the visitor left an email address, their own copy is sent to them automatically.
• Pre-registration isn't a loophole. A guest invited in advance signs at the tablet exactly like a walk-in, so an invitation can never become the way around your NDA. Switching the tablet's language isn't a way around it either.
• Two retention clocks, deliberately. Visits purge themselves on a window you choose — 90 days by default. Signed documents keep their own, longer clock — three years by default — because a signed agreement is a legal record and a log entry is not. Deleting an old visit doesn't destroy the signature that came from it.

If your screens also need to respect Québec's language expectations, our guide to bilingual digital signage in Québec covers the display side of the same question. And if you're still deciding whether a kiosk is worth it at all, start with visitor management for small business.

FAQ

Is an electronic signature on a tablet valid? General orientation, not legal advice: electronic signatures are broadly recognized in Canadian practice, and Québec's legal framework for technology-based documents is explicitly technology-neutral. What tends to matter in a dispute is evidentiary — can you show what was signed, by whom, and when, and can you show the text hasn't changed since. That's why versioning and a stored PDF matter more than the signature graphic itself. For your specific agreements, ask your counsel.

Can a visitor refuse to sign? Yes, and they should be able to. Declining ends the check-in without storing anything. What you do about a contractor who won't sign your safety briefing is a policy question for you, not something software should decide at the door.

Do returning visitors sign every time? No — that's what the re-sign window is for. A visitor is asked again when the document version has changed, or when their previous signature is older than the window you set (a year, by default). A weekly contractor signs once, not fifty times.

How long should we keep visitor records? There's no universal number, and the honest answer is that it depends on why you're keeping them. The useful discipline is to choose a period deliberately and let the system enforce it, rather than accumulating by default. WeDisplay defaults to 90 days for visits and three years for signed documents, and both are settings.