Is the electronic signature secure?

The real question: safer than what?

Compared to paper, the electronic signature is significantly more secure. A paper contract can be altered, lost or forged without leaving a trace. An electronically signed contract is encrypted, time-stamped, traced and verifiable at any time.

The 4 pillars of security

1. Encryption of communications

All modern platforms use TLS 1.3: intercepting the document in transit is impossible. It is the same level as online banking.

2. Authentication of the signatory

• SES: trusted email
• AES: email + SMS OTP (two factors)
• QES: qualified certificate + secure device

The higher the level, the harder it is to impersonate the signatory.

3. Cryptographic hash

Every signed document embeds a SHA-256 hash that validates its integrity. Any change produces a different hash → the signature is invalidated. Forging it without the change showing is impossible.

4. Time-stamped audit trail

Every action is recorded: sending, opening, OTP entered, signature, refusal. With IP, user agent and timestamp. Evidence admissible in a dispute. See signature evidence.

Comparison with paper

Risk | Paper | Electronic

Forgery | Easy (imitated signature) | Extremely difficult (cryptographic hash)

Loss | Possible (fire, theft) | Redundant archiving

Alteration | Undetectable | Invalidates the signature

Disputed date | Hard to prove | Precise timestamp

Identity theft | Easy (false name) | Strong authentication

The real risks

No system is perfect. The genuine residual risks:

• Phishing: the signatory clicks a fake email. Training plus sender verification.
• Phone theft: the SMS OTP is intercepted. Prefer an app-based OTP or biometrics.
• Email account compromise: the signatory must secure their mailbox. MFA recommended.
• Deepfake in video KYC: for very high-stakes contracts, plan cross-checks.

Sovereignty and the Cloud Act

Beyond technical security, sovereignty matters: where is your data? A US provider can be subject to the Cloud Act, which compels it to hand data to the American authorities — even for French documents.

Prefer 100% EU hosting to avoid that risk, particularly in sensitive sectors (law, healthcare, defence).

GDPR compliance

The GDPR requires:

• minimising the data collected
• technical security (encryption)
• a documented retention period
• the right of access and erasure
• notification in the event of a breach

Check that your provider honours these principles.

How Certyneo helps you

Certyneo applies the highest standards:

• TLS 1.3 on every connection
• AES-256 encryption at rest
• 100% EU hosting (Germany, IONOS), no Cloud Act exposure
• two-factor authentication for AES
• a complete audit trail, qualified timestamping
• eIDAS and GDPR compliance
• redundant, versioned archiving

Discover the Certyneo electronic signature solution

FAQ

Is SMS secure enough for the OTP?

Enough for AES. For very high stakes, an app-based OTP or biometrics are more robust.

Can a hacker modify a signed PDF?

Yes, but the signature then becomes invalid and Adobe Reader shows it.

Is the signatory's IP address protected?

It is kept in the audit trail and never shared publicly.

Can the provider read my documents?

In theory yes (without client-side encryption). Check the contractual commitments (DPA, confidentiality clauses).

Will I be informed if there is a breach?

A GDPR obligation: notification within 72 hours.

Conclusion

The electronic signature is more secure than paper on every count: integrity, authentication, traceability, resilience. The residual risks are known and manageable.

Try Certyneo to send, sign and track your documents online simply, quickly and securely.