inSign: secure & provable
electronic signature
Legal
eIDAS Regulation – Types of Signatures
The eIDAS Regulation provides the legal framework for electronic signatures.
Article 3.10 defines all the requirements for an electronic signature. Signatures that meet these requirements are often called simple electronic signatures. There are also two types of signatures with additional requirements, the advanced electronic signature (AES) and the qualified electronic signature (QES).
Use in the EU and globally
The requirements for electronic signatures differ depending on the legal area. In Europe, eIDAS (EU) and the largely identical ZertES (Switzerland) are the relevant legal bases. inSign supports eIDAS and ZertES.Send us a message if you need information on other countries.
These signature types are supported by inSign.
The simple electronic signature (SES) can be created with inSign by entering a name on the keyboard without a mobile number. The email address and the automatically generated audit report serve as proof.
The simple electronic signature (SES) can be created with inSign by entering a name on the keyboard without a mobile number. The email address and the automatically generated audit report serve as proof.
The advanced electronic signature (AES) can be done in two different ways with inSign:
In addition, there is an automatically generated audit report as further proof.
With the handwritten signature, the signature is made on a touch-sensitive screen. The biometric signature data thus captured is embedded in the document in encrypted form. This allows the identity of the signatory to be verified by a handwriting expert.
The qualified electronic signature (QES) is a certificate-based signature. The signatory is already identified before signing via Video-Ident, eID-Ident or Giro-Ident and provides his signature via TAN.
- by handwritten signature on a touch device
- by entering a name on the keyboard
In addition, there is an automatically generated audit report as further proof.
With the handwritten signature, the signature is made on a touch-sensitive screen. The biometric signature data thus captured is embedded in the document in encrypted form. This allows the identity of the signatory to be verified by a handwriting expert.
The qualified electronic signature (QES) is a certificate-based signature. The signatory is already identified before signing via Video-Ident, eID-Ident or Giro-Ident and provides his signature via TAN.
eIDAS Regulation – Document protection
Subsequent modification of the document must be impossible or recognisable. With inSign, the signed document is protected with a seal certificate. After the signature of the first signatory, no more changes to the document are possible.
Simple electronic signature
(SES)
by name input
by name input
Declaration of intent is made by:
Name input
Proof of identity:
Confirmed email address, mobile number if applicable, audit report
Proof of content:
Sealed PDF hash
Name input
Proof of identity:
Confirmed email address, mobile number if applicable, audit report
Proof of content:
Sealed PDF hash
Advanced electronic Signature
(AES)
by name input & mobile number
by name input & mobile number
Declaration of intent is made by:
Name input
Proof of identity:
Confirmed email adress, confirmed mobile number, audit report
Proof of content:
Sealed PDF hash
Name input
Proof of identity:
Confirmed email adress, confirmed mobile number, audit report
Proof of content:
Sealed PDF hash
Advanced electronic Signature
(AES)
by handwriting
by handwriting
Declaration of intent is made by:
Handwriting
Proof of identity:
Via biometric data (encrypted) and audit report
Proof of content:
Sealed PDF hash
Handwriting
Proof of identity:
Via biometric data (encrypted) and audit report
Proof of content:
Sealed PDF hash
Qualified electronic signature (QES)
by certificate
by certificate
Declaration of intent is made by:
Personal certificate (PIN/TAN)
Proof of identity:
Via personal identification and audit report
Proof of content:
Sealed PDF Hash
Personal certificate (PIN/TAN)
Proof of identity:
Via personal identification and audit report
Proof of content:
Sealed PDF Hash
Confidentiality declaration §203 StGB
Some professional groups are subject to special confidentiality obligations. These so-called secrecy bearers include, for example, doctors, pharmacists, psychologists, lawyers, patent attorneys, marriage, family or youth counsellors or employees in the public service. inSign can be used by these professional groups in compliance with the applicable secrecy obligations. Both the employees of inSign GmbH and those of the relevant subcontractors used by it are obliged to comply with the regulations of §203 StGB.Civil Code (BGB)
Declarations of intent
In principle, the contracting parties are free to choose the form in which a declaration of intent is concluded. Verbal declarations of intent are more difficult to prove, which is why contracts are usually concluded in writing on paper or electronically with an e-signature solution.Written form requirement
If a written form requirement is prescribed under the German Civil Code (BGB), the signature must be on paper or via a qualified electronic signature (QES). The QES is equivalent to signing on paper. With inSign, the documents to be signed are transferred to a cooperation partner for signing via QES. The QES process takes place seamlessly within inSign.Evidence & provability
Linking signature to signatory
According to the eIDAS Regulation, an advanced electronic signature must be able to be linked to the signatory. With the qualified electronic signature, identification is also necessary. In contrast to the AES, this already takes place before signing.Electronic signature may not be rejected as evidence
The eIDAS Regulation of 01 July 2016 further increases legal certainty in the use of the e-signature. inSign can be used in any country of the European Union. Thus, an electronic signature may not be rejected as evidence.„An electronic transaction may not be rejected because a document is in electronic form.“
Biometric signature data
A handwritten signature (AES) on a touch-sensitive device records biometric signature data. This can be used as evidence in the event of a dispute.What is biometric data?
These are, for example, writing speed, writing direction and writing pauses. These are stored together with the document checksum.
Audit report
inSign automatically creates an audit report for each process for all signature methods. This can help clarify any disputes.What does an audit report contain?
- Date and time of an event
- Event type e.g. process created, file upload and download, signature etc.
- Details of an action e.g. type of device used, system information, participant, name of the process etc.
- Signature type
- Contact information of persons involved (optionally masked)
Confirmed email address/SMS number
When signing by name entry via keyboard (AES), clicking on the signature link ensures that the signatory has access to the email address/SMS number used and links this to the signature.
Personal identification/qualified certificate
With the qualified electronic signature (QES), personal identification takes place before the signature (e.g. through Video-Ident). After successful identification, a qualified certificate is issued.
Security
Encryption/Notary Key
All captured biometric signature data is encrypted using an asymmetric encryption method (NIST P-384). A private and public key are used. The private key is typically generated and deposited by an independent authority (e.g. notary). We will be happy to assist you with this on request.Document seal
All documents are protected from changes with a seal (hash). In the event of subsequent manipulation, the broken seal is displayed when the document is opened.Two-factor authentication (2FA)
Two-factor authentication provides additional data protection. Here, the identity of a person is proven with the help of two different factors. When the document is released, the link to the document and the password for access are sent separately. It is possible to set in the software which method, e.g. SMS or email, is to be used for authentication.Authentication
With the inSign verification tool, documents can be checked for authenticity. After uploading an inSign document, you receive further information about the individual signatures in the document, such as signature certificate, time stamp certificate, integrity, signature level,…To the free verification tool
Request API connection
Data privacy
Made & Hosted in Germany
Our digital signature solution was developed in Germany and is operated on servers in Germany by German companies. We stand for maximum quality standards, the highest standards of data protection (especially with regard to the change in the law regarding the Privacy Shield) and thus for satisfied customers. Your data will stay in Germany and will of course not be transferred to the USA or other countries.100 % GDPR-compliant
The electronic signature inSign takes into account all legal regulations of the DSGVO without exception. Data protection has the highest priority for us.Independent audits
BITMi certification
inSign was successfully certified by BITMi e. V. and also awarded the quality labels
„Software Hosted in Germany“ and „Software Made in Germany“.
ISO 27001 certification
inSign complies with the ISO 27001 standard for information security in organisations.
Download certificate
Download certificate
ISAE 3402 certification
The International Standard on Assurance Engagements 3402, or ISAE 3402 for short, is an internationally recognised standard for auditing the internal control system of an outsourcing service provider.
Convinced and curious to try it out?
Ask for your
