Privacy-first eSignature

Introduction

Certifaction electronic signature is based on a privacy-first approach, ensuring document confidentiality without having to trust the underlying cloud providers or Certifaction itself.

We achieve this with local document processing and end-to-end encryption. Depending on the level of protection required, users can choose the right trade-off between convenience and confidentiality while taking advantage of a feature-rich electronic signature solution.

The problem with legacy electronic signature

Electronic signature of documents has brought many benefits in efficiency and convenience. However, it has often been at the cost of document confidentiality.

In legacy document electronic signature solutions, documents are sent in full to servers outside of your control, giving no other choice than trusting their security claims.

While legacy electronic signature providers brandish their compliance certifications and secure processes, they are not immune to potential accidental or malicious leaks.

Our solution: local document processing

To safeguard your document confidentiality, Certifaction processes your documents locally and never sends their content outside of your controlled IT environment.

Certifaction provides several client technologies that

• add the relevant PDF signature fields,
• calculate the document hash to be signed and
• send the hash to the Certifaction API.

The resulting signature PAdES certificate is then returned to the Certifaction client and added to the document.

The benefits of on-premise without the cost

Certifaction local processing solution can be deployed as a stateless Local API in your datacenter or simply run in the confines of user browsers.

The Local API is used to add electronic document signatures to your existing processes using a simple HTTP API.

This hybrid approach with local client and remote API gives the benefits of an on-premise deployment without the associated burden and costs of a traditional on-premise electronic signature service.

	Certifaction	Traditional on-premise solution
Model	Hybrid deployment — on-premise document privacy	Full on-premise deployment
Infrastructure	Any OR none at all	Hardware appliance
Components	Single stateless internal component	Multiple components — internet-facing application to maintain and protect (publicly exposed)
Databases / Storage	None — storage component optional	Required — database & volumes to maintain
Key Store / HSM	None — no documents, secrets or keys stored	Recommended — complex setup and maintenance required

In the rest of this document, we describe how Certifaction features combine to deliver our privacy-first electronic signature promises.

End-to-end encrypted Digital Archive

While Certifaction does not have access to your document content in clear text, you can still share documents and invite other people to sign them.

This is made possible by the Certifaction end-to-end encrypted Digital Archive, which can store and retrieve documents securely.

Document storage

The Certifaction Digital Archive securely stores documents by

• generating a unique 256-bit symmetric encryption key,
• creating a unique storage URL containing the encryption key as URL fragment,
• encrypting the document using the key client-side with NaCl Secretbox,
• sending the encrypted document to an external store, additionally,
• protecting the storage URL encryption key with a cryptographically strong password.

Secret encryption keys always stay on the client and are returned as part of the Digital Archive URL. Because Digital Archive URLs contain the secret necessary to decrypt documents, they must be securely transmitted and stored. This can be achieved by protecting the secret with a cryptographically strong password.

Document retrieval

Users can easily download and decrypt documents using their Digital Archive URLs by

• using the URLs to retrieve the encrypted documents and
• decrypting the encrypted documents using the secret encryption key in the URL fragments using NaCl Secretbox.

Document expiry

Encrypted document storage period can be configured. After expiry, the encrypted document is permanently deleted from storage and cannot be retrieved anymore, even with the Digital Archive URL.

Digital Archive URL

Digital Archive URLs are composed of a unique document identifier and a secret encryption key fragment. Since, by design, URL fragments are never transmitted during HTTP requests, secrets always stay client-side.

As long as they are exchanged using an appropriately secure channel, Digital Archive URLs can be used to conveniently share confidential documents between parties.

We use NaCl Secretbox — XSalsa20 and Poly1305 — to encrypt and authenticate the document with secret-key cryptography. The key length is 256 bits.

Digital Twin

A visible Digital Archive URL QR code can be added to documents. If a document is printed, the scannable QR code can be used to securely retrieve a Digital Twin of the paper copy.

Digital Twin URLs contain document identifiers and secret encryption keys. Documents can be loaded and decrypted by scanning them, even if Certifaction can never access the document content in clear text.

Signature request

Users can invite other people to sign one or more documents by creating and sharing signature requests.

Signature requests are associated with secure URLs containing secret fragments using the same principle as for Digital Archive URLs.

Signature request URLs can be shared out-of-band using an appropriately secure channel of your choice or by leveraging Certifaction's invitation emails.

Sharing secure signature request URLs out-of-band

If you have a secure channel already available, it can be used to share signature request URLs.

Initiators create a signature request with one or more documents and receive a secure signature request URL in return. Initiators take the responsibility to share the URL with third parties.

This solution is suitable if people have access to an application that you control. In this case, it is straightforward to securely transfer signature request URLs to the application and open the signing application in a web view component.

Sending signature request emails through Certifaction

If a dedicated secure channel is unavailable, you can rely on Certifaction's invitation emails. Certifaction takes responsibility to send the signature request URLs.

Optionally, Certifaction can protect signature request URL secret fragments with a randomly generated 256-bit cryptographically strong password that is displayed to users once. We use the XOR function to encrypt the decryption key.

Please note that securing the signature request URL with a password is optional to let users decide between confidentiality and ease of use.

This option is available in all Certifaction Clients.

Ecosystem

The Certifaction architecture is modular, secure and scalable. Documents are always processed client-side and are never sent in clear text to the cloud.

Certifaction provides several Client implementations:

• a web application for easy low-volume document signature,
• a Local API for integration inside customer data centres and
• a CLI for power users, scripting and integration with standalone applications.

Each client will process PDF documents and add electronic signatures locally without requiring sending the full document in clear text to the Certifaction API — contrary to legacy electronic signature providers which can access document content in their data centres.

Certifaction partners with reputable Trust Service and Identification Providers. We are continuously searching for new solutions and integrating them into our modular architecture.

In summary

Legacy electronic document signature solutions cannot guarantee document confidentiality because document content is sent to their datacenter.

Certifaction privacy-first electronic signature solves this problem by processing documents locally and never sending their content in clear text outside of your trusted IT environment.Certifaction provides a web application, a Local API and a CLI to securely sign and store documents, request signatures and create Digital Twins conveniently while keeping document content confidential.

Using the Certifaction hybrid solution, you can achieve document confidentiality without the cost and complexity of traditional on-premise solutions.