Compliance and trust

Signa records signer intent, protects completed PDFs with PAdES-style signatures, verifies trust chains, and exposes audit evidence for teams that need production-grade document accountability.

Signa supports SES/AES-style workflows. Qualified electronic signatures require an external qualified trust service provider and jurisdictional identity proofing.

Audit trail

Signa records who signed, when they signed, what device/session was used, and the ordered activity trail for the document.

  • Submission, submitter, template, mail, SMS, webhook, and signing events.
  • Device, user agent, IP, and optional location metadata captured during signing.
  • Combined completed document and audit log setting for record retention.

Document integrity

Completed PDFs can include visual signer ID stamps plus cryptographic PAdES signatures.

  • PAdES-compatible ETSI.CAdES.detached signature subfilter.
  • RFC3161 timestamp support when a timestamp server is configured.
  • DSS/VRI revocation evidence collection and verification status where certificate endpoints provide OCSP/CRL data.

Certificate trust

Signa supports default signing certificates and uploaded customer certificates/trust roots.

  • P12/PFX, PEM, and CRT certificate handling.
  • Trust-chain display for Signa and external customer certificates.
  • Trusted/external/no-signature verification outcomes.

Policy controls

Controls are available for regulated teams that need stronger signer intent and authentication.

  • Authenticator-app MFA, signing reason, signer ID, download auth, expirable file links.
  • Typed-signature control and saved-signature reuse policy.
  • Test mode separation for sandbox workflows.

Verification evidence Signa shows

1

Signed byte range verification

2

Signer and signing time extraction

3

Certificate chain and trust classification

4

PAdES subfilter detection

5

RFC3161 timestamp token reporting

6

DSS/VRI LTV evidence status

Operational boundaries

Legal acceptance depends on your jurisdiction, identity policy, certificate authority, retention settings, and signer authentication requirements. Keep test mode separate, configure production certificates and timestamp URLs deliberately, and validate sample documents with the same PDF viewers your customers use.