Trust Service Provider (TSP)
Definition
Frequently asked questions
What services does a trust service provider offer?
The eIDAS regulation lists several: the creation, verification and validation of signatures, seals and electronic timestamps, registered electronic mail services, issuance of certificates, including for website authentication, and preservation of these elements. Its 2024 revision adds in particular electronic archiving and attribute attestations.
What is the difference between a qualified and non-qualified provider?
The qualified provider has had its compliance checked by an accredited body before starting its activity, and is listed on a national trust list. The non-qualified provider remains subject to the regulation, but is only checked retrospectively. Only qualified services produce the enhanced legal effects provided for by eIDAS, such as equivalence with handwritten signature.
How do you verify that a provider is truly qualified?
By consulting the trust list of its country of establishment, accessible from the European Commission's trust list browser. Each service is listed there with its status and effective date. A provider can be qualified for one service, for example signature certificates, without being qualified for another, such as timestamping.
Does a qualified provider engage its liability?
Yes. The eIDAS regulation makes providers liable for damages caused, intentionally or through negligence, as a result of a breach of their obligations. For a qualified provider, intent or negligence is presumed: it is up to them to prove that they have committed no fault. This rule protects users who rely on its services.
Related guides
Related terms
Ready to Put These Concepts Into Practice?
Certyneo allows you to create eIDAS-compliant signature envelopes in just a few clicks, without installation.