A product by

Signature evidence

Every signature carries the evidence of how it happened

Who opened the document, when, from which address, with which code: kSign records it step by step, links it with a chain of digital fingerprints and delivers it in a certificate anyone can check with a QR code. If someone ever disputes a signature, you have nothing to reconstruct.

Request a demo kSign overview

The value of an electronic signature lies in its evidence

The eIDAS regulation gives legal effect to electronic signatures, but in a dispute what counts is what you can prove: that the signer really was that person, that they saw that document and not another, that the file has not changed since. kSign gathers this evidence while the signature happens, not afterwards, and keeps it with the document. Times are in UTC and dates in ISO format, so nobody can misread an hour or a day.

How it works

  1. Every step leaves a trace

    Upload, sending, link opened, OTP code sent and verified, CIE check, signature or refusal: each event is recorded with its time, IP address and a SHA-256 fingerprint that includes the one of the previous event.

  2. Once signed, the document is sealed

    kSign applies a cryptographic signature with an RFC 3161 timestamp inside the PDF, generates a signature certificate for each signer with the document fingerprint and a QR code, and closes the event log.

  3. Anyone can check

    The certificate’s QR code opens a public verification page: request status, signers, integrity of the event chain. Anyone holding the original PDF uploads it and sees at once whether the fingerprint matches.

A signature is worth as much as the evidence you can show.

What you can do

  • SHA-256 hash chain

    Each event is tied to the previous one by its fingerprint: if someone alters one, the chain no longer adds up and the check flags it. The request history shows every step in order, signer by signer.

  • Downloadable event log

    From the request you download the event log as a PDF, readable by a lawyer or a judge, and as JSON for anyone who wants to recheck the fingerprints themselves. A copy is also kept on storage separate from the database.

  • Signature certificate with QR code

    One for each signer: the person’s details, the document fingerprint, signature details, the level (simple, or advanced with CIE) with its legal references, and the QR code leading to the verification page.

  • Cryptographic signature and timestamp

    The signed PDF contains a digital signature covering the whole file and an RFC 3161 timestamp issued by a public timestamping authority: any later change invalidates the signature. With several signers on the same document there is one cryptographic signature, applied after the last one.

  • OpenTimestamps anchoring

    If you turn it on, when the log is closed its fingerprint is anchored to the Bitcoin blockchain through OpenTimestamps. From then on any later change to the log can be detected, and the proof can be downloaded as an .ots file to check it with independent tools.

  • Documents encrypted at rest

    Original, signed PDF and certificates are stored encrypted with AES-256-GCM, with a different key for each company. Fingerprints are calculated on the document before encryption, so verification works on the PDF you are holding.

Frequently asked questions

Can the event log be modified?

Nobody can edit it from the application, and the hash chain exposes a partial alteration of the events. To also have a fixed point in time, turn on OpenTimestamps anchoring: the fingerprint of the closed log stays fixed on the Bitcoin blockchain and any later change becomes detectable by anyone holding the .ots proof. The evidential weight of the signature, in any case, comes above all from the signer’s identity: the OTP code by SMS and, for the advanced signature, the CIE.

What does the public verification page show, and to whom?

Anyone with the certificate’s QR code or link can reach it. It shows the title and status of the request, the signers with their email partly hidden, whether they verified the code, the integrity of the chain and the list of events with time and fingerprint. The PDF you upload for comparison is not sent anywhere: the fingerprint is calculated in your browser.

What do I see if I open the signed PDF in a reader such as Acrobat?

In the signatures panel you find the digital signature with its timestamp, and the reader warns you if the file was modified afterwards. The technical certificate is generated by kSign, not by a certification authority on the trust lists, so the reader marks the identity as not verified: the signer’s identity is proven by the event log and the signature certificate, not by that technical certificate.

Is the timestamp qualified?

No. The timestamp inside the PDF follows the RFC 3161 standard and is issued by a public timestamping authority, not qualified under eIDAS. If you need a qualified timestamp (eIDAS Article 42), it is on the price list as a separate extension: ask us about timing and activation terms before relying on it.

Where do signed documents end up, and who can read them?

They are stored encrypted with AES-256-GCM and a key belonging to your company: even someone accessing the storage without that key would see only unreadable data. In the application they are opened by whoever has permissions on the request, and every signer receives the signed copy by email once the document is complete.

The other kSign features

Sign your company documents with kSign

Request a demo: we’ll show you how kSign makes signing fast, compliant and non-repudiable.

Request a demo