Cryptographic Integrity • Legal Admissibility
A transparent, rigorous explanation of our security architecture, statutory compliance mechanisms, and non-repudiation guarantees.
1. Statutory Legal Framework
United States ESIGN Act (15 U.S.C. § 7001 et seq.)
The Electronic Signatures in Global and National Commerce Act mandates that a signature, contract, or other record relating to a transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form.
Consumer Disclosure Compliance (15 U.S.C. § 7001(c)): When a transaction involves a consumer, SignExact enforces an affirmative pre-execution disclosure modal. Signers are provided clear hardware/software requirements, explicit information regarding their statutory right to obtain paper copies, and withdrawal procedures prior to adopting an electronic signature.
Document Eligibility & Statutory Exclusions (15 U.S.C. § 7003): By federal statute, certain document categories are excluded from electronic execution, including wills, codicils, testamentary trusts, family law documents (adoption, divorce), court orders, notices of utility cancellation, and notices of residential foreclosure/eviction. SignExact is designed for commercial business, real estate, employment, and service agreements.
Uniform Electronic Transactions Act (UETA)
Adopted by 49 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands, UETA provides uniform legal rules governing commercial transactions. SignExact satisfies UETA attribution requirements by permanently binding signer legal names, email addresses, IP telemetry, and time-stamped audit events into the document's cryptographic certificate.
In non-UETA jurisdictions (such as New York under the Electronic Signatures and Records Act, NY ESRA), SignExact satisfies equivalent attribution and retention standards.
European Union eIDAS Regulation (Regulation (EU) No 910/2014)
The European Union eIDAS framework establishes three distinct signature tiers. To ensure accurate compliance scoping:
| eIDAS Level | Statutory Criteria | SignExact Alignment |
|---|---|---|
| Simple Electronic Signature (SES) | Data in electronic form attached to or logically associated with other electronic data. | ✓ Fully Supported |
| Advanced Electronic Signature (AdES) | Uniquely linked to signer, identifies signer, created under signer's sole control, tamper-evident. | ✓ Fully Supported (Article 26) |
| Qualified Electronic Signature (QES) | Created via Qualified Signature Creation Device (QSCD) based on qualified certificate from EU QTSP. | Requires external EU QTSP integration |
SignExact natively provides Advanced Electronic Signatures (AdES) under Article 26 and Electronic Document Sealing under Article 35. We do not claim to issue automated Qualified Electronic Signatures (QES) without third-party accredited QTSP hardware.
2. Tamper-Evident SHA-256 Audit Ledger
Conventional document tools record logs in centralized databases that are vulnerable to silent database updates or unauthorized administrative tampering. SignExact utilizes a mathematical hash chain identical to PostgreSQL's fn_process_audit_hash() trigger standard:
Because every row incorporates the hash of the preceding event, altering any past action—such as changing an email, timestamp, or consent status—breaks every subsequent hash in the chain. This provides mathematical non-repudiation in court disputes.
3. Encryption & Infrastructure Security
Encryption in Transit
All traffic between signers, authors, and SignExact is encrypted using TLS 1.3 with modern cipher suites and automated Let's Encrypt certificate renewal.
Encryption at Rest
Documents and audit ledgers are persisted in isolated file storage with AES-256 equivalent filesystem encryption and strict POSIX permissions.
Multi-Tenant Authorization Isolation
Every API call and document download strictly verifies organization ownership. Cross-tenant access is blocked with HTTP 403 Forbidden.
256-Bit Cryptographic Guest Tokens
Signer invitation tokens carry 256 bits of cryptographically secure random entropy. Tokens are stored as SHA-256 hashes in the database.
4. X.509 PAdES Digital Sealing & Custom Keys
When a document is executed, SignExact embeds an ETSI.CAdES.detached digital seal. By default, SignExact signs using its corporate non-repudiation digital certificate.
Enterprise Custom Trust Authorities: Organizations with custom corporate CAs or Adobe Approved Trust List (AATL) credentials can configure their own PKCS#12 (.p12 / .pfx) cryptographic bundles via VPS environment variables (PKCS12_CERT_BASE64), allowing Adobe Acrobat to automatically display a green trusted checkmark.