Digital Signature’s legality – Is a digital signature legally binding? Posted on March 4, 2026 - 7:52 am by John Webster Today, most countries welcome the use of electronic signatures (eSignatures) as a way to move beyond a paper-based environment. New Zealand, Australia (all states), the United States, Canada, South Africa, the United Kingdom, the European Union, and many others have established laws regarding the signing of documents in electronic format. While people use various ways to sign electronically, ONLY Digital Signature technology that uses industry-based standards of cryptography can satisfy these laws. The Secured Signing digital signatures online solution complies with and exceeds these requirements! What is Public Key Infrastructure (PKI) technology? Secured Signing web service uses Digital Signatures PKI technology for digitally signing documents. Public Key Infrastructure (PKI) technology has been proven to be the ONLY technology available today that ensures non-forgeable signatures. In a PKI system, you will get as a user, two keys: a public key and a private key. These keys are used for encrypting and decrypting information, digitally signing electronic information and verifying the authenticity of their owner. While the public key is distributed widely, the corresponding private key is held and encrypted in Secured Signing hardware (HSM) device and only the private key’s owner able to access and use it. The EU Directive 1999/93/EC for Digital Signatures recognised and defined a stronger type of electronic signature, the Advanced Electronic Signature. Only Public Key Infrastructure (PKI) digital signatures meet the requirements for such signatures. Law requirements Legal requirement for a signature is met by means of an electronic signature if the signature: Adequately indentifies the signatory; Adequately indicates the signatory’s approval of the information to which the signature relates; and (Intent) Is as reliable as is appropriate given the circumstances. An electronic signature is sufficiently reliable if: The means of creating the signature is linked to the person signing and no-one else, and The means of creating the signature was under the control of the person signing and no-one else, and Any changes to the signature are detectable, and Any changes to the documents are detectable (data integrity). Secured Signing’s Legal Compliance How Secured Signing Meets Global Electronic Signature Laws Secured Signing’s digital signature service is engineered to exceed the rigorous requirements of global electronic transaction laws. Every document signed through our platform achieves legal validity and non-repudiation through the following four pillars: 1. Identifying the Signatory Secured Signing issues a unique digital certificate for every User, Invitee, and Witness. During registration or the signing session, we capture essential metadata—including verified email addresses, IP addresses, timestamps, and physical locations—to ensure the signatory is identified at the moment of execution. This identity is cryptographically bound to the document and can be instantly verified using our Free Online Verification Service or standard PDF readers. 2. Signature is linked to the signatory Unlike simple “electronic” signatures (which are often just an image of a squiggle), our Personalized PKI technology ensures every signature is uniquely linked to the specific signatory. By utilizing a private cryptographic key, we eliminate the risk of signature duplication or forgery. 3. Creating the signature is under sole control of the signatory The signing process remains under the exclusive control of the intended party. Documents are delivered via secure, private links, and signatories must authenticate their identity, via email ownership, SMS two-factor authentication (2FA), or secure passwords; before they are granted access to execute the document. 4. Document Integrity (Tamper-Evidence) Secured Signing’s trusted digital signature service is based on PKI technology that is considered to be the ONLY technology that ensures non-forgeable signatures. Once a signature is applied, the document is “sealed.” If even a single character or pixel is altered after the fact, the digital certificate will immediately show as Invalid, providing an unbreakable audit trail of data integrity. Enhanced Security Features Secured Signing provides a comprehensive suite of security layers: Bank-Grade Encryption: All documents are protected by high-level SSL/TLS encryption during transit and at rest. Cryptographic Timestamps: Each signature includes a secure local timestamp to prove exactly when the intent was captured. Legal Intent: Clear “Reason for Signing” fields establish the signatory’s purpose and consent. Comprehensive Audit Logs: A detailed “Full Signing Process” report tracks every action, from the initial invitation to the final execution. Secure Document Residency: Robust storage protocols ensure your sensitive data remains protected and accessible only to authorized parties. Legally binding service Digital signatures that use Personalised X509 PKI Digital Signature technology sustain signer authenticity, accountability, data integrity and non-repudiation of documents and transactions. In 1999, the EU passed the “EU Directive for Electronic Signatures” and on June 30, 2000, President Clinton signed into law the Electronic Signatures in Global and National Commerce Act (“ESIGN”), which made signed electronic contracts and documents as legally binding as a paper-based contract. In recent years, most countries worldwide have adopted legislation and regulations that recognise the legality of a digital signature and deem it to be a binding signature. Many of them have an Electronic Transactions Act in place. These legislations create a uniform standard for all electronic transactions and encourage the use of electronic signatures, giving electronic signatures the same legal effect as pen-and-paper signatures. "We are confident that the systems used by Secured Signing ensure that the electronic signatures produced meet the New Zealand legal requirements for a signature. In fact, the security and logging facility, in our view, provides better authenticity than many of the methods by which documents are now commonly signed and exchanged (e.g. email and facsimile). So, unless there are specific laws dictating that a document can only be signed in a particular way, any form of contract can be signed using the Secured Signing System. " Rick Shera, Partner at LOWNDES JORDAN, Barristers & Solicitors, Auckland, New Zealand Secured Signing maintains strict adherence to the ESIGN Act, UETA, and various Electronic Transactions Acts across global jurisdictions. Below is a comprehensive list of the international legislation we support Australian Capital Territory -ELECTRONIC TRANSACTIONS ACT 2001 Australia, New SouthWales (NSW) – ELECTRONIC TRANSACTIONS ACT 2000 Australia, Northern Territory (NT) – ELECTRONIC TRANSACTIONS ACT 2000 Australia, Queensland (QLD) – ELECTRONIC TRANSACTIONS (QUEENSLAND) ACT 2001 Australia, Victoria (VIC) – ELECTRONIC TRANSACTIONS (VICTORIA) ACT 2000 Australia, South Australia (SA) – ELECTRONIC TRANSACTIONS ACT 2000 Australia, Western Australia (WA) – ELECTRONIC TRANSACTIONS ACT 2003 Australia, Tasmania – ELECTRONIC TRANSACTIONS ACT 2000 Canada – Uniform Electronic Commerce Act (UECA) China – Electronic Signature Law of the People’s Republic of China Europe – eIDAS New Zealand – Contract and Commercial Law Act 2017 South Africa – Electronic Communications and Transactions Act, 2002 UK – Electronic Communications Act 2000 (c.7) U.S. – Electronic Signature in Global and National Commerce Act (ESIGN) U.S. – Uniform Electronic Transactions Act (UETA)- adopted by 48 states Nothing on this page constitutes legal advice.
The Difference between Electronic Signature and Digital Signature Posted on January 8, 2023 - 2:27 pm by John Webster In the push for digital transformation, the terms “electronic signature” and “digital signature” are often used interchangeably. However, from a legal and security standpoint, they are worlds apart.Understanding this distinction is critical for industries like finance, legal, healthcare, and accounting, where document integrity is non-negotiable. This guide breaks down the technology, the benefits, and why a Digital Signature, backed by Remote Online Notarization (RON), is the superior choice for high-stakes transactions. What is an Electronic Signature (e-Signature)?An electronic signature is a broad category that represents a person’s intent to agree to the contents of a document. It is the digital equivalent of a “wet ink” signature.Common Forms: A typed name, a scanned image of a handwritten signature, or a mark made on a touchscreen.How it Works: It captures the intent of the signer but does not necessarily offer a high level of identity verification or document security.Advantages of Electronic SignaturesSpeed: Ideal for low-risk documents like internal memos or simple NDAs.Convenience: Can be executed on any mobile device with an internet connection.Legal Standing: Recognized as legally binding under acts like ESIGN and UETA for most basic commercial transactions. What is a Digital Signature?A digital signature is a specific, highly secure type of electronic signature. It is not just a “picture” of a name; it is a cryptographic process that binds a Digital Certificate to the document using Public Key Infrastructure (PKI).Think of a digital signature as a digital fingerprint. If even a single character in the document is changed after it’s signed, the signature becomes invalid immediately.Why Digital Signatures are SuperiorTamper-Evidence: Any modification to the document after signing is detectable.Non-Repudiation: Because the signature is tied to a specific digital certificate, the signer cannot later claim they didn’t sign it.Identity Integration: The signer’s verified identity is cryptographically embedded into the signature itself. Differences between Electronic Signatures and Digital Signatures Key Differences at a GlanceFeatureElectronic SignatureDigital Signature (Secured Signing)TechnologyImage or text-basedPKI EncryptionSecurityMinimal (prone to forgery)High (Tamper-proof)VerificationOften relies on email accessIndependent VerificationComplianceBasic (ESIGN/UETA)Global (eIDAS, FDA CFR 21 Part 11)IntegrityContent can be altered post-signSignature breaks if content changes Secured Signing & Remote Online Notarization (RON)While many platforms offer basic e-signatures, Secured Signing is a dedicated digital signature provider. We leverage PKI to ensure that your documents are not just signed, but fortified.Elevating Trust with RONFor documents that require the highest level of scrutiny, such as deeds, mortgages, or legal affidavits, Secured Signing offers Remote Online Notarization (RON).Face-to-Face Verification: Conduct notarizations via secure video link.Tamper-Proof Audit Trail: Every step of the process is recorded and cryptographically sealed.Global Compliance: Meet the stringent requirements of the eIDAS Regulation (EU) and various state-level RON legislations in the US. Which One Do You Need?If you are simply signing a vacation request, an electronic signature might suffice. However, if you are handling confidential client data, legal contracts, or regulated healthcare documents, a Digital Signature is a requirement, not an option.Secured Signing provides the infrastructure to ensure your signatures are genuine, unaltered, and legally ironclad. FAQ: Understanding the Mechanics of Digital Trust How does Public Key Infrastructure (PKI) actually work? Digital signatures rely on a two-key system: a Private Key (kept securely by the signer) and a Public Key (available to anyone who needs to verify the signature). When you sign, your private key creates a unique cryptographic hash. The recipient uses your public key to decrypt that hash; if it matches the document exactly, the signature is valid. Can a Digital Signature be forged? While a standard electronic signature (like a typed name) can be easily copied, a digital signature is virtually impossible to forge. Because it is tied to a specific Digital Certificate issued by a Certificate Authority (CA), any attempt to alter the signature or the document would break the cryptographic seal, alerting all parties immediately. What is the difference between an e-Signature and Remote Online Notarization (RON)? An e-signature is a method of signing. RON is a legal process. RON uses digital signature technology combined with live identity proofing and audio-visual recording to allow a Notary Public to legally notarize a document over the internet. Secured Signing integrates both to provide the highest level of legal “non-repudiation.” Are digital signatures valid across international borders? Yes. Digital signatures provided by Secured Signing are designed to meet global standards, including:eIDAS (European Union)ESIGN & UETA (United States)GPEA (Government Paperwork Elimination Act)CFR 21 Part 11 (FDA regulations for life sciences) What happens if I edit a document after it has been digitally signed? The moment a change is made, even a single space or comma, the digital “hash” no longer matches the original. The Secured Signing platform will instantly flag the document as “Invalid” or “Tampered,” ensuring the integrity of the original agreement is never compromised.
Introduction to Digital Signatures Posted on October 28, 2022 - 3:28 pm by John Webster The Process & Validity behind Digital Signature Technology. What is Public Key Infrastructure – PKI A cryptographic system that uses two keys, a public key known to everyone and a private key, the private key has full control to the key owner, and has to keep in secured environment. A unique element to the public key system is that the public and private keys are related in such a way that only the public key can be used to encrypt messages and only the corresponding private key can be used to decrypt them. Moreover, it is virtually impossible to deduce the private key if you know the public key. When David wants to send a secure message to Donna, he uses Donna’s public key to encrypt the message. Donna then uses her private key to decrypt it. Public key cryptography was invented in 1976 by Whitfield Diffie and Martin Hellman. It is also called asymmetric encryption because it uses two keys instead of one key (symmetric encryption). Digital Signatures Process: An Explanation We can use David and Donna to demonstrate how digital signatures work. From David’s perspective, the process of digitally signing a document seems simple. However, several important steps happen behind the scenes. Generating a Private and Public Key Before David can digitally sign any documents, he must first obtain a Private Key and a corresponding Public Key. This is a one-time setup that is typically done by the Secured Signing Service when David first registers. The Private Key is kept secret and is used only by David to sign documents. It is never shared. The Public Key is made available to everyone (including Donna). It is used to validate the signer’s (David’s) digital signature. Digitally Signing Document This section details the steps David takes to sign a document and what happens when he sends it to Donna. Create a Digital Signature First, a unique cryptographic code called a hash is generated for the document using a mathematical algorithm. This hash is a short string of characters that represents the entire document. Even a tiny change to the document will result in a completely different hash. Add the Digital Signature to the Document To create the final digital signature, the following elements are combined: The document’s hash (from step 1). David’s Digital Certificate (which contains his Public Key). This is done by using David’s Private Key to encrypt the document’s hash. The resulting digital signature is unique to both the document and David. Finally, this digital signature is embedded into the document. David then sends the signed document to Donna. Donna’s Validation Process Donna uses David’s Public Key (included in the Digital Certificate) to decrypt the digital signature. This action reveals the original document hash that David created when he signed the document. Donna compares the original hash (extracted from the signature) with the new hash (she just calculated). Determine Validity: If the hashes match: The signature is valid, and the document has not been altered since David signed it. If the hashes do not match: The document has been changed after signing, or the signature is invalid. What is a Certificate Authority (CA) A Certificate Authority (CA) is a trusted third party that issues digital certificates. Digital Certificates act like a digital ID card, confirming the identity of a signatory (user). The CA issues a certificate after verifying the user’s information. In a digital signature system (PKI), the CA uses its own authority to authenticate the user’s certificate, assuring others that the signatory is genuinely who they claim to be.
Digital Signatures & Secured Signing Security Posted on October 27, 2021 - 7:58 am by John Webster Secure trusted service with PKI Technology Secured Signing web service uses Digital Signatures PKI technology for digitally signing documents. Public Key Infrastructure (PKI) technology has been proven to be the ONLY technology available today that ensures non-forgeable signatures. In a PKI system, you will get as a user, two keys: a public key and a private key. These keys are used for encrypting and decrypting information, digitally signing electronic information and verifying the authenticity of their owner. While the public key is distributed widely, the corresponding private key is held and encrypted in Secured Signing hardware (HSM) device and only the private key’s owner able to access and use it. The EU Directive 1999/93/EC for Digital Signatures recognised and defined a stronger type of electronic signature, the Advanced Electronic Signature. Only Public Key Infrastructure (PKI) digital signatures meet the requirements for such signatures. Communication All communications with Secured signing are encrypted with SSL technology. Users authenticate with encrypted login and password. Data Center Located in one of the most peaceful places on the planet (New Zealand) with: 3 high-speed, high-capacity internet feedsPower protection2MVA mains supplyDual AC mains power supply system serviced by two independent suppliersBinary Uninteruptable Power Supplies with redundant re-routing (500kVA)One of the most advanced and reliable IDC power systems availableDiesel generatorsHumidity controlled Heat Ventilation and Air Conditioning (HVAC) cooling unitsHigh Availability – 99.99% uptime SLA24/7 armguard on-site securityBiometric access controlSecurity Cameras Payment gateway The Payment Gateway we are using is fully certified as Visa AIS and MasterCard SDP (PCI-DSS) compliant at processor level; using an approved QSA for quarterly scans on systems and full on-site audits, annually. All sensitive information is encrypted with the 3DES protocol, with Hardware Security Module as Network Security Processors. Compliance Certifications and Regulations The privacy and protection of your data is something we take very seriously – which is why our security and privacy program is based on and aligned with industry-standard frameworks, and we maintain a comprehensive suite of certifications and attestations to further demonstrate our commitment to security and privacy. ISO 27001 Certification IS 747283 Secured Signing is ISO/IEC 27001 certified and manages information security within a framework based on related standards such as ISO/IEC 27017 (Code of Practice for Information Security Controls Based on ISO/IEC 27001 for Cloud Services) and ISO/IEC 27018 (Protection of Personally Identifiable Information). “Internationally recognized ISO/IEC 27001 is an excellent framework which helps organizations manage and protect their information assets so that they remain safe and secure. It helps you to continually review and refine the way you do this, not only for today, but also for the future.” – Learn more about ISO 27001 with BSI. Secured Signing – ISO 27001 Control Structure Information security policies: A policy framework is in place to provide management direction and support for information security in accordance with business requirements and relevant laws and regulations. Organisation of information security: Secured Signing have established a management framework to initiate and control the implementation and operation of information security within the organisation. This framework considers and ensures the security of teleworking and use of mobile devices as per the Mobile Device and Teleworking Policy. The framework will also assess risks to projects and review of the types and confidentiality levels of information the project will utilise and manage. Human Resource Security: Secured Signing have established processes and responsibilities relating to information security during the recruitment process, employment and separation. All employees receive security awareness training upon induction, and at least annually thereafter. Asset Management: Information assets, including hardware, software and data have been identified and classified and an inventory of assets is maintained. Secured Signing classify and handle all information assets in accordance with the Information Classification Policy. Secured Signing and dispose of information in accordance with the Acceptable Use Policy. Access Control: Methods and controls have been implemented to manage logical access to sensitive data to protect the confidentiality of information as well as integrity and availability requirements. Access requirements are assessed against Access Control Policy and Information Classification Policy. Access to Secured Signing information and systems must be: attributable to a uniquely identifiable individual who is responsible for actionsperformed with their system accountbased on the requirements of the individual’s rolemanaged by passwords or other accepted authentication mechanisms and formally authorised by asset ownersroutinely revalidated and removed if no longer required Cryptography: Methods and controls for ensuring data are secured during transmission or storage through appropriate encryption processes. Includes methods and processes for managing keys, software and other artefacts. Physical and environmental security: Appropriate physical controls protect information assets against loss, physical abuse, unauthorised access and environmental hazards. These include perimeter security controls, physical access controls, intruder detection controls, fire, and flood and power protection controls. Operations security: Methods and controls are implemented that balance the need for IT Operations professionals to have privileged access to systems and networks with the requirement to maintain secure access and confidentiality of data. Management and operation of computers and networks shall be, commensurate with the business risk and value of the information assets. Access into networks will be granted on an individual user and application basis using authorised devices and secured pathways. Communications security: Methods and controls are implemented to manage the secure transmission of information to ensure confidentiality of sensitive data and to minimise the risk of data loss or leakage. Systems and networks are segregated according to their respective information security risks and use appropriate control mechanisms such as firewalls/gateways, physical isolation and encryption. System acquisition, development and maintenance: Information security controls for system acquisition, development and maintenance are specified in the Secure Development Policy and included as an integral part of the software development and implementation process. Security requirements are identified prior to the development or procurement of new information systems, documented in business requirements, validated and tested prior to implementation, and regularly throughout the systems lifecycle. Supplier relationships: Secured Signing have implemented security controls and processes to manage supplier access to information assets. Suppliers and vendors are be given access privileges only at the level required to deliver contracted services and contracts must comply with information security policies. Information security incident management: Secured Signing apply a consistent and effective approach to the management of information security incidents. Procedures that define the course of action when a security incident is identified are documented and made available to all employees. Information security aspects of business continuity management: The application of business continuity management minimises disruption to Secured Signing operations, defining the approach to resilience, disaster recovery and general contingency controls. Secured Signing have developed and periodically review and test Business Continuity Plans that support information security continuity. Compliance: Secured Signing ensure compliance with all applicable legal and contractual obligations related to information security including taking reasonable steps are taken to monitor, review and audit information security effectiveness. This includes the assignment of security roles, maintenance of policies and processes and reporting of non-compliance. Secured Signing maintains formal processes in place to manage a data breach and the mandatory notifications that are required under relevant laws and specific customer contracts.