Service
Digital Signature & PKI Solutions
Signing systems that still verify in five years — eIDAS and ESIGN compliant, with the certificate lifecycle, timestamping and audit trail an auditor will actually accept
Why work with us on digital signature & pki solutions
A digital signature is easy to produce and hard to keep valid. The signature itself is a few lines of cryptography; the engineering sits in everything around it — issuing and revoking certificates without breaking live workflows, protecting private keys in hardware, timestamping so signatures outlive the certificates that made them, and recording an audit trail that holds up years later when someone disputes what was signed. We build that layer end to end, across PAdES, XAdES, CAdES and JAdES, on-premise or in your cloud, and we will tell you plainly when an off-the-shelf platform would serve you better than a custom build.
eIDAS Advanced and Qualified electronic signatures, ESIGN and UETA compliance
PAdES, XAdES, CAdES and JAdES signing across PDF, XML, binary and JSON payloads
PKI design: root and issuing CA hierarchy, enrolment, renewal and revocation
HSM and PKCS#11 hardware token integration, Azure Key Vault and AWS CloudHSM
RFC 3161 timestamping and long-term validation that survives certificate expiry
Chain validation with OCSP and CRL revocation checking
Hash-chained, tamper-evident audit trails exportable for compliance review
Embedded signing UI inside your own product, browser-side or server-side
Get started
Technical proposal call
Scope and timeline agreed
Development and delivery
Stack
Technologies we use
Cryptography
OpenSSL
Encryption
RSA
Cryptography
ECDSA
Cryptography
AES Encryption
Encryption
SHA-256
Hashing
Certificates & key protection
PKI
Security
X.509 Certificates
Certificates
PKCS#11
Hardware Security
HSM
Hardware Security
Azure Key Vault
Hardware Security
Signature formats & validation
PAdES
Signature Formats
XAdES
Signature Formats
CAdES
Signature Formats
JAdES
Signature Formats
OCSP
Validation
CRL
Validation
RFC 3161 Timestamping
Validation
Compliance & platforms
eIDAS
Compliance
ESIGN / UETA
Compliance
DocuSign
Platforms
Adobe Sign
Platforms
Compliance
Which signature tier do you actually need?
This is the first question worth answering, because it determines your hardware, your cost and your timeline. Most teams assume they need the highest tier. Most do not.
Simple Electronic Signature
A typed name, a drawn mark, a checkbox click.
Legally admissible under eIDAS and ESIGN, but the burden of proving who signed sits entirely with you. Appropriate for low-value internal approvals.
No certificates required
Advanced Electronic Signature
Cryptographically bound to the signer and the document.
Uniquely identifies the signer, is created with data under their sole control, and detects any later change to the document. Most commercial contracts and SaaS products land here.
PKI and certificate management
Qualified Electronic Signature
Legally equal to a handwritten signature across the EU.
An Advanced signature plus a qualified certificate from a trust-service provider on the EU Trusted List, created on certified secure hardware. Required for many public-sector and cross-border filings.
QSCD hardware and a qualified TSP
Formats
Signature formats, and when each applies
The ETSI advanced-signature family covers different container types. What you are signing decides the format, not preference.
PAdES
PDF documentsEmbeds the signature inside the PDF itself, so the file stays verifiable when emailed, archived or copied elsewhere. The default for contracts, invoices and consent forms.
XAdES
XML payloadsSigns XML structures in place, including selective signing of individual elements. Common in e-invoicing, government filings and financial messaging.
CAdES
Any binary dataA CMS-based detached or enveloped signature over arbitrary bytes. Used when the payload is not a document at all: firmware, archives, data exports.
JAdES
JSON and JWSThe newest of the family, signing JSON payloads for API-native workflows where a document container would be an awkward fit.
Engineering
What we build
PKI design and certificate lifecycle
Root and issuing CA hierarchy, enrolment, renewal and revocation. Built so certificates expire predictably instead of taking a production workflow down on a Friday.
Key protection and HSM integration
PKCS#11 hardware tokens, on-premise HSMs, Azure Key Vault and AWS CloudHSM. Signing keys are generated inside the hardware boundary and never exported.
Timestamping and long-term validation
RFC 3161 timestamp authorities plus embedded revocation evidence, so a signature still verifies years after the signing certificate has expired.
Verification and revocation checking
Full chain validation with OCSP and CRL handling, including the failure modes most implementations get wrong: soft-fail policies and stale responder caches.
Tamper-evident audit trails
Hash-chained event logs recording who signed what, when, from where, and under which certificate. Exportable in a form an auditor can read without engineering help.
Embedded signing experience
Signing flows inside your own product rather than a redirect to a third-party branded portal. Browser-side or server-side, themed to match your application.
Build or buy
Three ways to get signing into production
We have built a signing platform from scratch and integrated hosted ones. That means we can tell you honestly which of these fits, including when the answer is the cheapest option.
Integrate a hosted platform
DocuSign, Adobe Sign or a similar provider, integrated into your product. The cheapest path when your workflow is standard, and we will say so rather than sell you a build you do not need.
Talk through the options →Custom build
When signing has to live inside your own product, keys must stay in your infrastructure, or the document formats and workflow are specific to your industry.
Get a scoped quote →Hire a specialist
Bring a PKI and e-signature engineer onto your own team when you have the development capacity but not the cryptography experience.
Hire a digital signature expert →Applications
Where signing has to hold up
Mortgage and loan origination
Disclosure packages, closing documents and MISMO-conformant data, signed with the retention and audit properties lenders are examined against.
Healthcare consent and records
Patient consent, clinical sign-off and records release, with signer identity evidence that survives a HIPAA audit.
HR and employment contracts
Offer letters, onboarding packs and policy acknowledgements signed at volume, with countersigning and reminder workflows.
Procurement and cross-border trade
Multi-party agreements signed under different national regimes, where eIDAS tiering and trust-list validation decide enforceability.
Regulated product workflows
Signature capability embedded inside your own SaaS, so customers never leave your product and per-signature economics stay yours.
Code and document integrity
Signing release artefacts, firmware and data exports so downstream consumers can verify provenance independently.
FAQ
Digital signature questions we get asked
What is the difference between an electronic signature and a digital signature?
An electronic signature is any mark showing intent to sign — a typed name, a drawn squiggle, a click. A digital signature is a specific cryptographic technique: the document is hashed and the hash encrypted with a private key, so any later change to the file breaks verification. Every digital signature is an electronic signature; the reverse is not true.
Are digital signatures legally binding?
Yes, in every major jurisdiction. The US ESIGN Act and UETA make electronic signatures enforceable, and the EU eIDAS regulation gives a Qualified Electronic Signature the same legal standing as a handwritten one. What varies is the evidence you must produce in a dispute, which is why signer identity, timestamping and the audit trail matter more than the signature image.
What is the difference between eIDAS and the ESIGN Act?
ESIGN is US federal law and technology-neutral: it says a signature cannot be denied legal effect merely for being electronic. eIDAS is EU regulation and defines three tiers — Simple, Advanced and Qualified — with specific technical requirements for each. Selling into the EU generally requires Advanced or Qualified; US-only workflows usually do not.
What are PAdES, XAdES and CAdES?
They are ETSI signature formats for different container types: PAdES for PDF, XAdES for XML, and CAdES for raw CMS data. Each defines how signature data, certificates and timestamps are embedded so the file stays verifiable on its own. Choosing the right one is determined by what you are signing, not by preference.
Why do signatures need a timestamp?
A signing certificate expires, and may be revoked. Without proof of when the signature was made, verification fails once that happens, even though the signature was valid at the time. An RFC 3161 timestamp from a trusted authority anchors the signing moment, which is what keeps signatures verifiable for the years or decades a contract must survive.
What is long-term validation and why does it matter?
Long-term validation, or LTV, embeds the certificate chain plus revocation evidence into the signed file itself. Without it, verifying a five-year-old contract depends on a certificate authority still answering queries about a certificate that has since expired. With it, the document proves itself offline, which is what auditors and courts require.
Do we need an HSM or hardware tokens?
It depends on your compliance tier. A private key in software can be copied; a key generated inside a hardware security module cannot leave it, which is what qualified signature schemes and most regulated industries require. If you only need Advanced signatures under eIDAS, or ESIGN compliance in the US, a well-managed software key store is often sufficient.
Can we build this on DocuSign or Adobe Sign instead?
Often yes, and we will tell you when that is the right answer. Hosted platforms are the cheaper path for standard document workflows. Custom work earns its cost when you need signing embedded inside your own product, self-hosted keys for data-residency reasons, unusual document formats, or per-signature economics that a per-seat licence makes untenable.
How long does a digital signature integration take?
Adding signing to an existing application typically takes two to four weeks, including certificate setup and verification. A full PKI implementation with certificate lifecycle management, HSM integration and a compliance audit trail runs six to twelve weeks, depending on how much of your existing identity infrastructure can be reused.
Can the signing keys stay inside our own infrastructure?
Yes. We deploy into your VPC or data centre, backed by your own HSM or a cloud key service such as Azure Key Vault or AWS CloudHSM. Nothing signable leaves your network, which is usually the deciding requirement for banking, healthcare and government work.
How we work
Our development process
Compliance scoping
Establish which jurisdictions apply and which assurance tier you actually need. This decision drives hardware, cost and timeline.
2-3 days
Architecture and key strategy
PKI hierarchy, signature format, where private keys live, and how certificate expiry and revocation are handled without downtime.
3-5 days
Implementation
Signing and verification services, certificate lifecycle, timestamping, audit logging, and integration into your existing systems.
2-8 weeks
Validation and handover
Signature conformance testing, revocation and expiry scenarios, penetration review, runbooks and team training.
1-2 weeks
Why us
Benefits of working with us
Engineers who have shipped signing into regulated production, not just read the spec
Signatures that still verify after certificates expire, via timestamping and LTV
Private keys that never leave hardware you control
Audit trails your compliance team can read without engineering help
Honest build-versus-buy advice: we sell a signing product and will still tell you not to build
Deployment into your own VPC or data centre when data residency requires it
Ready to hire our digital signature & pki solutions experts?
A senior engineer replies within one business day with a real technical read on your project.