# Sign your BAA

> Who signs Kalman's Business Associate Agreement, what waits until it's signed, and how to get a copy.

Updated 2026-11-10 · Getting started · https://kalmananalytics.com/support/sign-your-baa/

## Who signs

Only the **account owner** signs, from the main workspace. Kalman has already signed its side. Admins and members can read the agreement, and they'll see "Waiting for (owner) to sign." Additional workspaces share the account's BAA, so they never ask you to sign again. Agency client workspaces are different (see below).

## Sign it

The **Sign BAA** step opens right after you pay. You can also reach it from **Review and sign** on the banner, or from **Billing → Business Associate Agreement**.

1. Read the agreement. Initial the three marked sections, using the same initials in each box.
2. Enter your **Full legal name** and **Title**, and check the **Legal business name (as it should appear on the agreement)**. It's filled in from the company you entered at checkout, never from your website's address. The agreement shows it as the customer as you type; your website appears separately, as "Website". Use **Edit** to correct it. You can't sign while it's empty.
3. Type your full name as your signature. It has to match the name you entered.
4. Tick "I have read this agreement and I am authorized to sign it" and agree to sign electronically.
5. Click **Sign and continue**.

When you sign, Kalman records your name, title, the time, your IP address and browser, and a fingerprint of the exact text. It then emails you a signed copy.

## Skipping for now

**Skip for now** takes you on to the install step. Everything else keeps working: the tag and your sources keep collecting data. Until the BAA is signed, though:

- nothing is sent to your ad platforms, such as Meta, and events wait;
- the Meta test event and the switch to live are refused;
- every workspace page shows a banner reminding you to sign.

When you sign, the waiting events go out. Events older than Meta's 7-day window by then are skipped, so don't wait long.

## What Kalman collects before you sign

Signing controls what **leaves** Kalman, not what Kalman collects. From the moment the tag is installed and your sources are connected, and before the BAA is signed:

- **Stored:** page views and funnel events from the tag (the page path with sensitive parts removed, click ids, and the visitor's browser and IP address); events from your platform's webhooks, with emails and phone numbers hashed on arrival; and a raw, encrypted copy of each incoming webhook, deleted after 30 days. If you signed up from a scan report, the name, work email, company and phone you entered are stored too.
- **Not sent:** nothing goes to Meta or any other ad platform. Deliveries wait as pending until the owner signs. The Meta test event and the switch to live are refused.

See [Data deletion and retention](/support/data-deletion/) for how long each kind of record is kept.

## Get a copy

The signed copy arrives by email. Owners and admins can also open **Billing → Business Associate Agreement → View signed copy**. From there, **Print / Save as PDF** saves the copy as a PDF.

## When a new version comes out

If Kalman publishes an updated agreement, the owner sees "An updated BAA is ready to sign." Events keep flowing in the meantime.

## Agency client workspaces

Each client workspace of an agency account holds its own BAA, because each client is its own covered entity. Until a client workspace is signed, its own events wait. Open that client's workspace and pick one of these:

- **Sign on the client's behalf.** The client is named as the customer. You tick an extra box confirming that the client authorized you to sign for it.
- **Send it to your client to sign.** Enter the **Signer's name** and **Signer's email**, then click **Send link**. **Your company** is optional: the email says the link comes from you at that company, or from you by name when it's blank. It's filled in from your agency branding name when you've set one. Your client doesn't need a Kalman login. The link works once, for 14 days. Sending a new link cancels the old one, and **Cancel link** withdraws it. The signed copy goes to the client and to you.

Still stuck? Log in and open a request: https://app.kalmananalytics.com/support