Electronic signature glossary

112 key terms to master electronic signatures, cryptography and eIDAS compliance.

Beyond the definitions, put them into practice: discover Certyneo's electronic signature solution

Updated on 14 July 2026.

Glossaire signature électronique — références et définitions

A

Electronic authentic deed (AAE): An electronic authentic deed (AAE) is a notarial deed drawn up, received, and kept in digital form in accordance with Decree No. 2005-973 of August 10, 2005. The notary affixes their qualified electronic signature (QES level, eIDAS) using an authorized QSCD, and the deed is then sent to the Real.not platform (Electronic Network of Notarial Deeds). The AAE has the same probative force and enforceability as a paper deed: it constitutes perfect proof of its contents and can support enforcement without prior judgment. Real estate contracts, donations, business mergers, and future protection mandates are among the deeds that may be drawn up in electronic form. Certyneo assists notary offices in implementing co-signature workflows upstream (preliminary contracts, sale mandates) before signing the authentic deed at the notary.
AES (Advanced Electronic Signature): AES est l'acronyme d'Advanced Electronic Signature, la signature électronique avancée définie par l'article 26 du règlement eIDAS — voir la fiche signature avancée pour les exigences détaillées, la comparaison SES / AES / QES et les cas d'usage. À ne pas confondre avec l'autre AES de la cryptographie, l'Advanced Encryption Standard, un algorithme de chiffrement symétrique sans rapport avec la signature.
Electronic signature REST API: A REST API (Representational State Transfer) for electronic signature exposes the signature engine's operations as HTTP resources accessible by any programming language. Typical workflows include: envelope creation (POST /envelopes), document upload (PUT /envelopes/{id}/documents), adding signers and fields (POST /recipients), sending for signature (PUT /envelopes/{id}/send), then retrieving the signed document (GET /envelopes/{id}/signed-pdf). Authentication relies on Bearer tokens (OAuth 2.0 / API keys). Webhooks complement the API by pushing events (document signed, rejected, expired) to your backend without polling. A good electronic signature REST API guarantees document integrity via a SHA-256 hash returned at each step and supports timestamped audit trail. Certyneo exposes a complete REST API documented in OpenAPI 3.1 with SDKs available in Node.js, Python and PHP.
Electronic archiving (signature, evidentiary value): L'archivage électronique désigne la conservation à long terme de documents numériques signés dans des conditions garantissant leur valeur probante, leur lisibilité et leur intégrité dans le temps. À ne pas confondre avec la simple sauvegarde : l'archivage probant impose des contraintes techniques et juridiques précises qui le distinguent d'un simple stockage dans un cloud.

Les trois piliers de l'archivage probant :
• Intégrité : le document archivé ne peut pas être modifié — toute altération est détectable et invalide la preuve. Garantie par le hachage cryptographique du document à l'archivage et la vérification périodique de ce hash.
• Pérennité : le document reste lisible dans 10, 20 ou 50 ans, indépendamment des évolutions logicielles. Cela impose des formats normalisés (PDF/A pour le contenu, PAdES B-LTA pour la signature) et une migration des supports à intervalles réguliers.
• Traçabilité : toute opération sur le document archivé (consultation, communication, destruction) est consignée dans un journal d'événements horodaté et infalsifiable.

Cadre normatif : en France, l'archivage probant est régi par les normes NF Z42-013 (référentiel français, AFNOR) et la norme internationale ISO 14641. Pour le secteur public et certaines activités réglementées (santé, services financiers), l'agrément SIAF (Service Interministériel des Archives de France) ou une certification par un tiers-archiveur ESG sont requis. Le règlement eIDAS 2.0 introduit un nouveau service de confiance qualifié dédié à l'archivage électronique qualifié, reconnu de plein droit dans toute l'UE.

Durée de conservation légale en France :
• Contrats commerciaux et factures : 10 ans (Code de commerce art. L123-22)
• Contrats de travail : 5 ans après le départ du salarié
• Documents fiscaux : 6 ans (Livre des procédures fiscales art. L102 B)
• Actes notariés : 75 ans (Code du notariat)
• Documents médicaux : 20 ans après le dernier acte (Code de la santé publique)

Mise en œuvre Certyneo : tous les documents signés sont archivés au format PAdES B-LT (B-LTA disponible sur le plan Business pour les conservations > 10 ans), avec horodatage RFC 3161 qualifié, conservation 10 ans incluse dans tous les plans, journal d'événements consultable à tout moment, et téléchargement de la piste d'audit au format PDF. Voir aussi valeur probante et LTV (Long-Term Validation).
Attestation France Travail: L'attestation destinée à France Travail (anciennement Pôle emploi) est un document que l'employeur doit obligatoirement remettre au salarié à la fin de son contrat (art. R1234-9 du Code du travail). Elle permet au salarié de faire valoir ses droits à l'assurance chômage ; l'employeur la transmet également à France Travail. Elle peut être générée et signée électroniquement dans le parcours de fin de contrat. Documents obligatoires de fin de contrat →
Authentication: Authentication is the process of verifying the identity of a user or system before granting them access to a service or authorizing the application of an electronic signature. It can be simple (password alone), strong (multi-factor) or biometric. The robustness of authentication directly determines the signature level achievable: an AES requires at least two distinct factors.
Strong authentication: L'authentification forte exige la présentation d'au moins deux preuves d'identité appartenant à des familles différentes pour vérifier l'identité d'une personne — c'est le principe de la MFA (authentification multi-facteurs) :
• Ce que je sais : mot de passe, code PIN ;
• Ce que je possède : téléphone recevant un code OTP, clé de sécurité YubiKey/FIDO2, carte à puce ;
• Ce que je suis : empreinte digitale, reconnaissance faciale (biométrie).

Deux cadres réglementaires l'imposent : la directive DSP2 (art. 97) impose la SCA — Strong Customer Authentication — pour les paiements et l'accès aux comptes bancaires en ligne ; le règlement eIDAS l'exige de fait pour la signature électronique avancée (AES), dont l'article 26 impose que la signature soit créée sous le contrôle exclusif du signataire et lui soit liée de manière univoque.

Dans la signature électronique, l'authentification forte intervient au moment de signer : le signataire prouve qu'il contrôle son adresse email (lien unique) et son téléphone (code OTP SMS) avant que le document ne soit scellé. Cette double vérification, horodatée dans la piste d'audit, est ce qui distingue une AES opposable d'une simple case cochée.

Sur Certyneo : pour les enveloppes de niveau avancé, la combinaison email + OTP SMS est appliquée par défaut à chaque signataire ; les comptes utilisateurs peuvent activer la MFA (TOTP ou OTP email). DSP2 & authentification forte : le guide →
Certification Authority (CA): A certification authority (CA) is a trusted organization that issues X.509 electronic certificates linking a public key to the identity of its holder. Qualified CAs are supervised by national authorities (ANSSI in France) and registered on the EU trust list. They form the foundation of the PKI and the trust chain of qualified signatures.

B

Bearer token: A bearer token is an API access token that grants whoever holds it ("the bearer") the right to access protected resources, without any other identity proof — possession alone is sufficient, like cash. It is transmitted in the HTTP header Authorization: Bearer <token>. In OAuth 2.0: bearer tokens are the standard access token format; they are generally short-lived and carry scopes that limit what the bearer can do. Certyneo''s REST API uses bearer tokens to authenticate programmatic calls: creation of envelopes, status queries, webhook configuration, and download of signed documents. Security concerns: since the token is the identifier, it must only travel over TLS, never be exposed client-side nor logged, and be renewed regularly; a leaked bearer token is as dangerous as a leaked password until its expiration or revocation. Best practice: limit each token to strictly necessary permissions, set a short expiration, and prefer one token per integration so you can revoke one without affecting others.
Biometrics: Biometrics encompasses identification techniques based on a person''s physical or behavioral characteristics (fingerprint, facial recognition, handwriting pattern, voice). In electronic signature, biometric signature can capture the handwriting pattern on a touch screen (speed, pressure, angle) to create a direct link between the signatory and their consent. Under eIDAS, biometrics alone is insufficient to reach the advanced level (AES): it must be combined with strong authentication. Biometric data is considered sensitive under GDPR and its processing requires explicit consent.
Blockchain and electronic notarization: Blockchain notarization consists of anchoring the cryptographic fingerprint (SHA-256 hash) of a document in an immutable distributed ledger (Bitcoin, Ethereum, etc.) to prove its existence at a given point in time. Unlike RFC 3161 qualified timestamps, blockchain notarization is not recognized as legal proof under eIDAS: it constitutes admissible evidence before certain jurisdictions but does not replace an accredited QTSP. Its advantage is decentralization: the proof survives the disappearance of the service provider. In an enterprise context, blockchain is most relevant for archiving supplementary evidence (hash published on-chain) as a redundancy layer above standard electronic archiving with evidentiary value.

C

Electronic seal: Electronic seal is the equivalent of electronic signature for legal entities (companies, administrations). It guarantees the origin and integrity of a document issued on behalf of an organization without involving an identified human signatory. The eIDAS regulation recognizes simple, advanced, and qualified electronic seals in the same way as signatures.
SSL / TLS padlock: The SSL/TLS padlock is the visual indicator displayed by the browser (padlock icon in the address bar) confirming that an encrypted TLS connection is established between the browser and the server. It attests that the exchanged data (documents, OTP codes, credentials) cannot be intercepted in plain text. Certyneo enforces TLS 1.3 across all its endpoints, making the padlock visible on all signature pages.
Certificat de travail (employment certificate): Le certificat de travail est un document que l'employeur doit obligatoirement remettre au salarié à la fin de tout contrat de travail (art. L1234-19 et D1234-6 du Code du travail), quelle que soit la cause de la rupture. Il mentionne les dates d'entrée et de sortie, la nature des emplois occupés et les périodes correspondantes. C'est un document « quérable » : il est tenu à la disposition du salarié, qui vient le chercher. Il peut être signé et remis par voie électronique avec pleine valeur juridique. Voir tous les documents de fin de contrat →
Electronic certificate: Un certificat électronique est un fichier numérique délivré par une autorité de certification (AC) qui associe une clé publique à l'identité vérifiée de son titulaire — on parle aussi de certificat de signature numérique lorsqu'il sert à signer. C'est la pièce d'identité numérique sur laquelle repose toute signature numérique.

Ce que contient un certificat : l'identité du titulaire (Distinguished Name), sa clé publique, l'AC émettrice, la période de validité (1 à 3 ans en général), les usages autorisés (signature, cachet, TLS) et l'empreinte cryptographique de l'ensemble, signée par l'AC.

La chaîne de confiance : chaque certificat est signé par une AC, elle-même certifiée par une AC de niveau supérieur, jusqu'au certificat racine. Vérifier une signature revient à remonter cette chaîne — et à contrôler que le certificat n'a pas été révoqué (listes CRL, protocole OCSP).

Certificat simple ou qualifié : un certificat standard suffit pour la signature avancée (AES) ; la signature qualifiée (QES) exige un certificat qualifié, délivré par un prestataire de confiance qualifié après vérification d'identité en face à face ou équivalente.

Sur Certyneo : vous n'avez aucun certificat à acheter ni à installer — les certificats de signature sont portés par la plateforme et appliqués côté serveur au moment du scellement PAdES du document. Le certificat de signature numérique : guide complet →
Qualified certificate: Un certificat qualifié est un certificat électronique délivré par un prestataire de services de confiance qualifié (QTSP) inscrit sur la liste de confiance d'un État membre de l'UE — le niveau d'assurance le plus élevé reconnu par le règlement eIDAS.

Ce qu'il ajoute à un certificat standard : l'identité du titulaire est vérifiée avant la délivrance (face à face physique, identification vidéo ou identité électronique équivalente) ; la clé privée est protégée dans un dispositif certifié (QSCD, souvent adossé à un HSM) ; et le QTSP est audité régulièrement par l'organe de contrôle national (en France, l'ANSSI).

À quoi sert-il ? C'est le composant obligatoire de la signature qualifiée (QES), seule à bénéficier de l'équivalence automatique avec la signature manuscrite dans toute l'UE (art. 25 eIDAS), avec présomption de fiabilité en cas de litige. Il est requis pour les actes les plus sensibles : actes d'avocat, certains marchés publics, cessions d'entreprise.

Sur Certyneo : la QES est proposée à l'acte, sans abonnement dédié — la vérification d'identité du signataire et la délivrance du certificat qualifié sont intégrées au parcours de signature. La signature qualifiée (QES) chez Certyneo →
Root certificate and trust chain: A root certificate is the apex of the PKI: self-signed by the root certification authority, it anchors the trust of the entire chain. When verifying an electronic signature, the verifier traverses the certificate chain (End Entity → Intermediate(s) → Root) and verifies that each link is valid, not revoked (OCSP / CRL) and compliant with its usage policy. Browsers and operating systems embed trusted root stores (Mozilla NSS, Microsoft Root Store, Apple Root Certificate Program). For eIDAS qualified signatures, the chain must trace back to a QTSP listed on the EU trust list. A certificate whose root is not in the verifier''s store will be rejected even if the cryptographic signature is technically correct.
Encryption: Encryption is the process of transforming a readable message into an unreadable format (ciphertext) using an algorithm and a secret key. It protects the confidentiality of data in transit and at rest, and is complementary to hashing used to guarantee integrity in signature. Certyneo uses TLS 1.3 to encrypt all communications between the browser and servers.
Encryption at rest: Encryption at rest refers to the protection of stored data through encryption, so that it is unreadable without the decryption key, even in case of unauthorized physical or logical access to the storage medium. Certyneo encrypts documents and their audit trails at rest (AES-256) on its infrastructure hosted in Germany, in compliance with GDPR requirements.
CLM (Contract Lifecycle Management): CLM (Contract Lifecycle Management) refers to the set of processes and tools covering the complete lifecycle of a contract: drafting, negotiation, internal approval, electronic signature, storage and renewal. Single repository: a CLM solution centralizes all contracts in a single queryable repository, with expiration alerts, clause libraries, validation workflows and contract exposure reports, replacing scattered email threads and shared drives. Place of signature: electronic signature is one step in the CLM chain — once the contract is approved, it moves to signature and then to archiving with probative value. Integration with Certyneo: Certyneo covers the signature phase and integrates with a third-party CLM via REST API — it receives the finalized document, manages the signature circuit (sequential or parallel, at advanced (AES) or qualified (QES) level), and returns the signed PDF with a timestamped audit trail that the CLM archives as the definitive version. Why it matters: a signed contract but not tracked in a CLM still exposes the company to missed renewals and tacit renewal penalties, hence the increasingly joint purchase of signature and lifecycle management.
Co-signature and multiple signatures: Co-signature designates the collection of at least two signatures on the same document. Two modes are distinguished: sequential signature (signer B receives the invitation only after A has signed — useful for hierarchical contracts or notarial deeds) and parallel signature (all signers receive the invitation simultaneously — faster for symmetric documents). Co-signature raises the question of inter-round integrity: each PAdES added in the PDF must reference the previous revision via an incremental signature, ensuring that no party has modified the document between two appositions. Certyneo manages signer order, targeted reminders, per-signer expiration deadlines, and automatically detects inter-round modification attempts via SHA-256 hash verification at each step of the audit trail.
OTP (One-Time Password / OTP code): An OTP (One-Time Password — sometimes called "OTP code" in French) is a temporary numerical code, usually 4 to 8 digits, randomly generated and valid for a single session or transaction. Once used or expired (typically 5 minutes), it becomes invalid — even if an attacker replayed it, it would be rejected.

Three main OTP variants :
• OTP SMS : code sent by text message to the signer''s phone number. Most common on the consumer side because no application is required. Known vulnerabilities: SIM swapping, SS7 interception — which is why OTP SMS is sufficient for advanced signature (AES) but is no longer accepted for QES (ANSSI and ENISA have recommended since 2020 switching to stronger factors).
• OTP e-mail : code sent by e-mail. Easier to implement, but inherits the weaknesses of the recipient''s e-mail account security. Acceptable for simple signature (SES).
• TOTP (Time-based OTP) : code generated locally by an application on the signer''s phone (Google Authenticator, Authy, 1Password). Synchronized via a shared secret key at registration. No network channel at the time of signature — resistant to interceptions. Standard RFC 6238.

OTP and electronic signature : in advanced electronic signature, sending an OTP via e-mail or SMS creates a verifiable link between the signed document and the identity of the signer via their communication channel (phone or e-mail). The OTP is recorded in the document''s audit trail (timestamp, IP, channel identifier) — evidence that can be raised in case of dispute.

Certyneo implementation : OTP SMS via Twilio Verify on AES envelopes — triggered just before signature, valid for 5 minutes, 3 attempts. TOTP available for administrator accounts as an alternative to SMS OTP. See also MFA and strong authentication. Learn more about signer authentication →
Compliance: Compliance refers to the adherence to laws, regulations and standards applicable to an organization. In the context of electronic signature, it notably refers to the eIDAS regulation, the GDPR, the Labor Code (for employment contracts), the ALUR law (real estate) and ethical rules specific to certain professions (CNB for lawyers, CGAER for notaries). Non-compliance exposes the company to the nullity of its acts and administrative sanctions.
Electronic consent: Electronic consent is the manifestation of will of a person, expressed by digital means, to accept terms or to sign a document. To have probative force, this consent must be freely given, specific, informed and unambiguous, in accordance with the GDPR. In a signature workflow, clicking "Sign" constitutes the electronic consent of the signer.
Electronic contract: An electronic contract is any agreement of will formed by digital means, governed in France by articles 1366 to 1368 of the Civil Code and the LCEN. Unlike simple online ordering, an electronic contract involves a multi-step procedure: offer, pre-contractual information, explicit acceptance ("click to accept" or electronic signature), then evidentiary preservation for the legal duration. Evidentiary value is strengthened by adding: an advanced signature (AES) or qualified (QES), a qualified timestamp, capture of consent and the signer''s IP address. The eIDAS 2 regulation extends these requirements to cross-border contracts within the EU through the European Digital Identity Wallet.
CRL (Certificate Revocation List): A CRL (certificate revocation list) is a list published periodically by a certification authority listing certificates revoked before their expiration date, usually due to key compromise or change of identity. When verifying a digital signature, the software consults the CRL (or uses OCSP) to ensure that the signer''s certificate was not revoked at the time of signature.
Asymmetric cryptography (public key / private key): Asymmetric cryptography relies on a mathematically linked pair of keys: the private key (secret, preserved in an HSM or QSCD) and the public key (freely distributed in a certificate). To sign a document, the signer calculates the fingerprint of the document and encrypts it with their private key; anyone can verify the signature by decrypting this fingerprint with the public key and comparing it to the hash of the original document. The dominant algorithms are RSA (2048–4096 bit keys) and ECC (P-256, P-384 curves). RSA 2048 bits is recommended until 2030 by NIST; ECC P-256 offers equivalent security level with 10× shorter keys (performance gain on HSM). Resistance to quantum computers is assured by post-quantum algorithms CRYSTALS-Dilithium and CRYSTALS-Kyber, currently being standardized by NIST.

D

Signature delegation: Signature delegation is the mechanism by which an authorized signatory (delegating party) formally transfers his or her signing authority to a third party (delegatee) for a defined duration and scope. Under French law, signature delegation must be explicit, formalized in writing and precisely specify the acts covered (article 1994 Civil Code for agency, and statutory provisions for companies). On Certyneo, delegation is managed on the administration side: the delegating party configures a signature role for the delegatee; the audit trail records the actual identity of the signatory and the legal basis for his or her delegation.
Dematerialization: Dematerialization refers to the replacement of paper documents and processes with their digital equivalents. It encompasses digitization, native creation of electronic documents, and their signature via tools like Certyneo. It enables reducing delays, costs and environmental footprint of document processes. See the benefits of contract dematerialization →
Distinguished Name (DN): The Distinguished Name (DN) is the unique identifier of a subject in an X.509 certificate. It is composed of hierarchical attributes: CN (Common Name, name of the holder), O (Organization), OU (Organizational Unit), C (Country, country in ISO code), etc. — for example CN=Jean Dupont, O=Certyneo, C=FR. The DN of the signer is readable in the signature properties of a PDF validated in Adobe Acrobat Reader.
DPA (Data Processing Agreement): A DPA (Data Processing Agreement) is the contract required by Article 28 of the GDPR between a data controller (the client) and a processor (such as Certyneo). It specifies the purposes of processing, categories of data, security measures, conditions for further subprocessing, and obligations in case of breach. A DPA must be executed before any processing of personal data of signatories. Certyneo offers a standard DPA appended to its Terms and Conditions.

E

ECC (Elliptic Curve Cryptography): Elliptic Curve Cryptography (ECC) is an approach to asymmetric cryptography based on the algebraic properties of elliptic curves. It offers security equivalent to RSA with significantly shorter keys (256-bit ECC ≈ 3072-bit RSA), reducing computational load. ECC is the preferred algorithm for TLS 1.3 (X25519 curve, P-256) and is increasingly used in certificates for digital signature.
eIDAS: eIDAS (Electronic IDentification, Authentication and trust Services) is European Regulation No. 910/2014 which establishes a common legal framework for electronic signatures, seals, time-stamping and other trust services in the EU. It defines three signature levels (simple, advanced, qualified) and creates the concept of qualified trust service providers. Learn more about eIDAS →
eIDAS 2.0: eIDAS 2.0 (EU Regulation 2024/1183, entered into force in 2024) is the major revision of eIDAS which notably introduces the European Digital Identity Wallet (EUDIW). It aims to extend the recognition of digital identities across all public and private services in the EU, and strengthens requirements for qualified providers. The digital identity of each European citizen will be carried by a certified mobile wallet by 2026.
Signature envelope: A signature envelope is the logical container grouping one or more documents to be signed, the list of signatories, the positioned signature fields, and the configuration of the workflow. On Certyneo, each envelope has its own lifecycle (draft, sent, pending, signed, refused, expired) and a time-stamped audit trail.
Bulk sending (bulk signing): Bulk sending (or bulk signing) refers to the ability to send a document to many signatories simultaneously, or to send several distinct documents in a single operation. This functionality is essential for HR (employment contracts), insurance (amendments) or real estate (mandates). On Certyneo, the API allows orchestrating bulk sends via a single programmatic call, with each signatory receiving an individual link and their own audit trail.
ESIGN Act: The ESIGN Act (Electronic Signatures in Global and National Commerce Act, 2000) is the U.S. federal law that recognizes the legal validity of electronic signatures and online contracts in the United States. Complementary to the UETA (state model law), it establishes the principle that a signature cannot be rejected solely on the grounds that it is electronic. For transatlantic contracts, an eIDAS AES is generally recognized as ESIGN/UETA compliant, facilitating contractual exchanges between the EU and USA.
EUDI Wallet (European Digital Identity Wallet): The European Digital Identity Wallet (EUDI Wallet) is the mobile application mandated by eIDAS 2.0. It allows EU citizens to store and share certified identity attributes (civil status, diplomas, driving licenses) and perform qualified signatures (QES) from their smartphone. The EUDI Wallet will progressively replace FranceConnect+ in France by 2026–2027.

F

Approval workflow: An approval workflow is a structured sequence of validation steps through which a document must pass before being signed. Typically: drafting → legal review → financial validation → signature. Under French business law, certain acts require formalized approval before signature (board meeting resolution, CFO sign-off). Technically, an approval workflow differs from co-signature: approvers validate the content without necessarily affixing their electronic signature (they click "Approved"), while final signers commit their responsibility. Certyneo supports both modes in the same envelope workflow, with distinct roles (Approver vs Signer) and webhooks triggered at each state transition.
Hash function: A hash function is a one-way mathematical function that transforms an input of any size into an output of fixed length called a digest (or hash). Any modification, even of a single bit, produces a radically different digest. Modern functions (SHA-256, SHA-3) are collision-resistant. In digital signature, the document is first hashed and then the digest is encrypted with the private key — which guarantees the integrity of the signed content.
FranceConnect: FranceConnect is France''s government digital identity service that allows citizens to authenticate to online public or private services using an existing identifier (Impots.gouv, Ameli, La Poste, MSA, Identité Numérique). A step above, FranceConnect+ is rated "substantial" under the eIDAS regulation and can be used to trigger an advanced signature (AES) or even qualified signature (QES). By the end of 2026, FranceConnect+ will be progressively replaced by the digital identity carried by the European Wallet (EUDIW) provided for by eIDAS 2.0.

G

Template (document template): A template is a pre-configured standard document with dynamic fields (signatories, dates, amounts, signature locations) that serves as a starting point for recurring envelopes. On Certyneo, templates industrialize high-volume workflows (employment contracts, NDAs, purchase orders): you duplicate the template, fill in the case-specific variables, and send. Free contract templates available on /modeles-contrats are designed to be downloaded and then instantiated as templates in your account.
GDPR (General Data Protection Regulation): The GDPR (General Data Protection Regulation, EU Regulation 2016/679) is the English version of the RGPD. This European regulation governs the collection, processing and retention of personal data within the EU. It applies to any organization processing data of European residents, regardless of its location. It notably requires the conclusion of a DPA with subprocessors, data minimization and respect for individuals'' rights (access, rectification, erasure).
Document generator and digital mail merge: A document generator combines a contract template with variable data (name, SIREN, amount, date, etc.) to automatically produce a PDF ready for signature. Common technologies are: Word/DOCX template engines (Carbone.io, Docxtemplater), LaTeX, HTML-to-PDF (Puppeteer/headless Chrome) and Adobe PDF Services API. The advantage of digital mail merge over paper mail merge is direct sending to the signature workflow without printing: the generated document is injected into the signature envelope via the REST API, signature fields are positioned by coordinates or HTML tags, and the cycle closes in seconds. The main risk is layout divergence between local DOCX rendering and server rendering — a suite of visual regression tests (PNG capture + diff) is recommended.

H

Hashing (hash): Hashing is a cryptographic operation that transforms a document of any size into a digital fingerprint of fixed size, called a "hash". Any modification, however minor, to the document produces a completely different hash, thus guaranteeing the integrity of the file. Digital signature relies on the encryption of this hash with the signatory''s private key.
TLS handshake: The TLS handshake ("handshake") is the negotiation phase that takes place at the beginning of a TLS connection. The client and server agree on the cipher suite, exchange their certificates (optional mutual authentication), and establish session keys via an ephemeral key protocol (ECDHE). TLS 1.3 reduced the handshake to 1 round-trip (versus 2 in TLS 1.2), improving the performance of signing sessions on mobile.
Electronic timestamping: Electronic timestamping is a mechanism that links digital data to a precise moment in time, in a verifiable and unforgeable manner. A qualified timestamp, issued by a qualified provider under eIDAS, provides legal evidence of the existence of a document at a given date. It is essential for maintaining the probative value of documents over the long term.
Qualified timestamp (TSA): A qualified timestamp is an electronic timestamp issued by a Trusted Stamp Authority (TSA) qualified under eIDAS. It produces legally recognized proof of a document''s existence at a specific date and time, linked to the document''s hash. Essential for PAdES B-T, B-LT, and B-LTA profiles to guarantee legal probative value over the long term.
HSM (Hardware Security Module): An HSM (Hardware Security Module) is a tamper-proof hardware device dedicated to the secure generation, storage and use of cryptographic keys. The HSM performs cryptographic operations (signing, decryption, key generation) without ever exposing the private key — it remains inside the hardware perimeter, protected by physical countermeasures (intrusion sensors, automatic erasure on any opening attempt).

HSM Certifications: to be qualified under the eIDAS regulation, an HSM must meet strict standards — FIPS 140-2 level 3 or FIPS 140-3 level 3+ (NIST American standard), and/or Common Criteria EAL4+ (European standard). Common Criteria certified HSMs are eligible to host qualified signature (QES) keys and qualified timestamping keys. The European Trusted List references authorized HSMs for each qualified provider.

Cloud HSM vs Physical HSM: historically HSMs were dedicated appliances installed in private datacenters. Cloud providers now offer shared or dedicated HSMs as SaaS — AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM, but also national HSMs operated by European QTSPs. The eIDAS 2.0 regulation explicitly recognizes cloud HSMs for remote qualified signatures.

HSM and encryption ("HSM encryption"): beyond signatures, HSMs protect database encryption keys, disk encryption keys (BitLocker, FileVault, LUKS), internal PKI root keys, and application secrets. Key rotation, backup and revocation are managed via PKCS#11 or proprietary interfaces.

Certyneo implementation: the cryptographic keys for remote signing are hosted in Common Criteria EAL4+ HSMs operated by our qualified trust service provider (QTSP). No private key is ever accessible to Certyneo or its hosting provider — each signing operation goes through strong authentication of the signatory and an API call to the HSM, which returns the signature without exposing the key. See also QSCD and cloud signature.
HTTP/3: HTTP/3 is the third major version of the HTTP protocol, based on QUIC (UDP transport) rather than TCP. It reduces latency (eliminates head-of-line blocking), improves recovery after network interruption, and natively integrates TLS 1.3. Certyneo leverages HTTP/3 to accelerate document loading for signing and submission of consent forms, particularly on mobile in degraded network environments.

I

Digital identity: Digital identity is the set of data allowing identification of a natural or legal person in the digital space. It can be provided by a State (electronic identity card, FranceConnect) or by private operators (qualified providers). With eIDAS 2.0, each European citizen will have an official digital identity wallet (EUDIW).
IdP (Identity Provider): An Identity Provider (IdP) is a service that manages digital identities and delivers authentication assertions to third-party applications (Service Providers). Dominant protocols are SAML 2.0 (enterprise, SSO Okta/Azure AD) and OIDC/OAuth 2.0 (web, FranceConnect). In the context of electronic signature, the IdP plays two roles: (1) authenticate the signer when accessing the signature portal (MFA via enterprise SSO); (2) provide verified identity attributes (name, email, employee number) that feed the signature certificate and audit trail. FranceConnect is the French public IdP enabling "substantial" trust level for advanced signatures intended for state services. Certyneo integrates with SAML and OIDC IdPs via the administration console.
Ink signature (digitized handwritten signature): An ink signature (or digitized handwritten signature) is the digitization of a traditional handwritten signature as an image (JPG/PNG) affixed to a document. It constitutes the most basic level of simple electronic signature (SES) under eIDAS: without strong authentication or audit trail, its probative value is limited. It remains nonetheless used for documents with low legal stakes (internal signatures, annotations).
Integrity (of data): Integrity is the property guaranteeing that data has not been altered or falsified after its creation, transmission, or storage. In digital signature, integrity is ensured by the hash function: any modification to the document means that the recalculated hash no longer matches the one encrypted in the signature, immediately invalidating verification. This is why a PDF signed with Certyneo is "sealed" — it cannot be modified without the signature breaking.
eIDAS interoperability: eIDAS interoperability refers to the mutual recognition of digital identities and electronic signatures between EU Member States, as required by the eIDAS regulation (articles 6 and 25). A qualified certificate issued by a trusted service provider (TSP) listed on the trust list of one Member State is automatically recognized as valid in all other Member States — without further action. This interoperability covers the AES and QES levels. The eIDAS 2.0 regulation (EU 2024/1183) extends this mechanism to the EUDI wallet (European Digital Identity Wallet), expected in 2026.

J

Signature token: A signature token is the cryptographic object produced at the moment of signing that groups together: the document''s hash, the timestamp, the signer''s identifier, and the cryptographic signature itself (encrypted with the private key via PKI). This token is embedded in the final PDF according to the PAdES format and allows any verifier — judge, expert, auditor — to reconstruct proof of signature without depending on the platform. The token is self-sufficient: even if Certyneo disappeared, the signature would remain verifiable with a standard PDF reader (Acrobat Reader, pdfsig).
Logging and preservation of signature logs: Logging in the context of electronic signature designates the immutable recording of all events in a document''s lifecycle: creation, sending, opening, OTP verified, signature affixed, signed document download, archiving. These logs constitute the technical layer of the audit trail and may be required in case of dispute. Legal requirements vary: GDPR imposes a limit on the retention period of personal data, while statutory limitation periods for contracts (5 years in commercial law, 10 years for civil acts) define the minimum log retention duration. Best practice: logs must be cryptographically signed (integrity token) to prove they have not been altered. Certyneo preserves the logs of each envelope for the applicable legal duration and includes them in the downloadable digital safe.
JWT (JSON Web Token): A JWT (JSON Web Token, RFC 7519) is a compact and secure format for representing assertions between two parties. It consists of three parts encoded in Base64URL separated by periods: the header (algorithm), the payload (claims), and the signature. The Certyneo API uses signed JWTs (HS256 or RS256) for session management and authentication of API calls, ensuring that tokens have not been falsified. Access JWTs have a short lifespan, supplemented by long-lived refresh tokens.

K

KYC (Know Your Customer): KYC (Know Your Customer) refers to the set of identity verification procedures that a company applies to its customers before entering into a business relationship. Historically imposed on banks by anti-money laundering directives, KYC has extended to electronic signature operations with high stakes: account opening, credit, insurance, notarial deeds. Three pillars: verification of identity documents (OCR and fraud detection on the security features of a card or passport), liveness control (proof that the person is real and present, not a photo or deepfake), and cross-checking information with reference databases. Link with signature level: the more sensitive the deed, the stronger the KYC — a simple signature may require none, while the eIDAS regulation requires face-to-face or equivalent remote identity verification (video KYC) before issuing a qualified signature (QES) certificate. KYC and AML/CFT: KYC is the entry stage of the relationship; ongoing transaction monitoring (AML/CFT) continues afterward. Why it matters: robust KYC is what allows a remote signature to have the same legal value as a signature witnessed in person, by linking the signing key to a verified human.

L

LCCJTI (Law on the legal framework for information technologies): The LCCJTI is the Quebec law (R.S.Q., chapter C-1.1) establishing the legal framework for signature and electronic documents in Quebec. It explicitly recognizes electronic signature as equivalent to handwritten signature provided that the signatory''s identity is established reliably and the link between the signature and the document is ensured (section 39). The LCCJTI is complementary to the eIDAS regulation (applicable in Europe) and PIPEDA (applicable to personal information outside Quebec). It is the legal foundation for Certyneo signatures on Quebec contracts. Law 25 (2022) modernizes the accompanying personal information protection regime.
LCEN (Law 2004-575): The LCEN (Law for Confidence in the Digital Economy of June 21, 2004, No. 2004-575) is the founding text of French digital law. It governs online commerce, the liability of hosting providers, digital advertising, and requires professional website publishers to display legal notices (company name, capital, RCS, address, publisher, hosting provider). Complementary to the European eIDAS regulation, it also transposed the first electronic signature directive into French law. The LCEN continues to apply alongside eIDAS, particularly regarding pre-contractual information obligations and the retention of electronic contracts over €120.
LegalTech: The term LegalTech (Legal Technology) refers to startups and software solutions that apply technology to the legal field to automate, accelerate, or make accessible services previously reserved for legal professionals. Electronic signature, contract dematerialization, AI-driven due diligence, and document management are part of it. Certyneo is part of the European LegalTech ecosystem by offering eIDAS-compliant signature that is simple to integrate.
LTV (Long-Term Validation): Long-term validation (LTV, Long-Term Validation) is a feature of PDF signatures (PAdES B-LT/B-LTA) that embeds in the signed document all the data necessary for future signature verification: certificate chain, timestamps, OCSP responses or CRL. Thanks to LTV, a signed document remains verifiable years after signing, even if the certificates have expired. Certyneo integrates LTV to guarantee probative value for 10 years.

M

Electronic SEPA Mandate (direct debit mandate): The electronic SEPA mandate (e-mandate) allows a creditor to collect authorization for automatic direct debiting from a debtor entirely online, in accordance with EU Regulation No. 260/2012 and EPC (European Payments Council) directives. The debtor enters their IBAN and BIC, then signs the mandate via simple electronic signature (SES); the debtor's bank can authenticate it via Open Banking (DSP2/PSD2). The signed mandate must be retained for 14 months after the last debit. A valid e-mandate contains: the SEPA creditor identifier (SCI), the unique mandate reference (UMR), and the signature date. SaaS platforms, software publishers and training organizations frequently use Certyneo to collect SEPA mandates during online subscription, integrating the signature via the REST API in the order funnel.
Handwritten (signature): Handwritten signature is the graphical trace made by hand by a person at the bottom of a paper document, recognizable by its personal stroke. It remains the historical reference in French civil law (Article 1367 of the Civil Code). The eIDAS regulation establishes the principle of non-discrimination: an electronic signature, regardless of its level, cannot be rejected as evidence solely because it is electronic. A qualified signature (QES) has the same probative force as a handwritten signature throughout the EU. Advanced signatures (AES) often provide superior traceability (audit trail with timestamps) compared to their paper equivalent.
MFA (Multi-Factor Authentication): MFA (Multi-Factor Authentication — sometimes abbreviated as 2FA for two-factor authentication when exactly two factors are combined) is a security mechanism that requires the presentation of at least two proofs of identity belonging to different categories:

• Knowledge factor ("what I know") : password, PIN code, answer to a secret question, passphrase.
• Possession factor ("what I have") : phone that receives an OTP via SMS or via a TOTP application (Google Authenticator, Authy, 1Password), YubiKey or other FIDO2 key, certificate on smart card.
• Inherence factor ("what I am") : fingerprint, facial recognition, voice, iris. Implemented via native APIs of modern operating systems (Face ID, Touch ID, Windows Hello, Android BiometricPrompt).

MFA vs 2FA : 2FA is a strict subset of MFA — exactly two factors. MFA can combine two, three or more factors. Mass-market practice often confuses the two terms; in B2B and legal cybersecurity, MFA is the generic term.

MFA and electronic signature : advanced electronic signature (AES) requires strong authentication of the signer, which translates in practice to MFA (typically e-mail + OTP SMS). Qualified signature (QES) requires reinforced MFA — identity verification with identity document + possession factor (smart card or QSCD). The eIDAS regulation does not explicitly name MFA but requires it through strong authentication requirements.

Certyneo implementation : MFA mandatory for all administrator access (TOTP via Google Authenticator or e-mail OTP at choice). For signers, the e-mail + SMS OTP combination is applied by default on AES-level envelopes. See also OTP and strong authentication.

N

Signature level (simple, advanced, qualified): The eIDAS regulation distinguishes three levels of electronic signature: simple signature (SES), which requires minimum identification; advanced signature (AES), which requires a unique link to the signer and strong authentication; and qualified signature (QES), which relies on a qualified certificate and a secure creation device. QES has the same legal value as a handwritten signature throughout the EU. Understand signature levels →
Non-repudiation: Non-repudiation is the property of an electronic signature that makes it impossible for the signer to deny having performed the action (sign, send, accept). It is assured by the combination of cryptographic signature (irreplaceable technical link), timestamped audit trail, and strong authentication. A qualified signature (QES) offers the strongest non-repudiation recognized by European law.
ISO/IEC 27001 standard and ISMS certification: ISO/IEC 27001 is the international reference standard for Information Security Management Systems (ISMS). It defines the requirements for establishing, implementing, maintaining and continuously improving an ISMS, via 93 controls distributed across 4 domains (organizational, human, physical, technological). For an electronic signature service provider, ISO 27001 certification demonstrates a level of security maturity aligned with the obligations of eIDAS and GDPR. It is often required in public tenders and supplier security questionnaires from large enterprises. ISO 27017 standard (cloud security) and ISO 27018 (personal data protection in the cloud) complement ISO 27001 for SaaS services. Certyneo is hosted in ISO 27001 certified datacenters and maintains a documented ISMS covering the entire signature processing chain.

O

OCSP (Online Certificate Status Protocol): OCSP (Online Certificate Status Protocol, RFC 6960) is a protocol for real-time verification of the revocation status of an electronic certificate, by querying an OCSP responder operated by the certification authority. Why revocation matters: a certificate can be valid by date but revoked in advance (key compromise, employee departure); a signature or TLS connection must therefore check the status, not just the expiration. OCSP vs CRL: OCSP is a lighter and more reactive alternative to a CRL — instead of downloading the entire revocation list, the client queries a single certificate and receives a concise signed response (valid / revoked / unknown). OCSP Stapling: to avoid a privacy leak and an extra round trip, the server retrieves its own OCSP response and "staples" it in the TLS handshake, so the browser never directly contacts the CA. In signed documents: OCSP responses are embedded in the PDF at the time of signature for long-term validation (LTV), so the signature remains verifiable years later even if the responder is offline.
Electronic onboarding (digital subscription): Electronic onboarding is the process of subscription or account opening that is entirely dematerialized, combining KYC, identity verification and electronic signature of contractual documents (Terms of Use, SEPA mandate, account agreement) in a single web or mobile session. The banking, insurance and fintech sectors are the most advanced: the DSP2 directive requires strong authentication (SCA) when opening an account. An onboarding compliant with the eIDAS regulation requires that remote identity verification be at a "substantial" or "high" level of confidence for binding acts. Solutions combine: OCR of identity document, liveness check (video or selfie), AES or QES signature, and automatic filing of the complete KYC file in the digital safe.

P

PAdES (PDF Advanced Electronic Signature): PAdES (PDF Advanced Electronic Signature, ETSI EN 319 142 standard) is the European standard for digital signatures embedded in PDF files. Adopted by the eIDAS regulation as the reference format for European documents, PAdES is today natively implemented by all PDF readers (Adobe Acrobat, Foxit, PDF.js, pdfsig). A PAdES signature is embedded IN the PDF: no detached file, no dependency on a third-party platform, offline verifiability.

The four PAdES profiles define an increasing level of guarantee:
• PAdES B-B (Baseline-B): basic signature with minimal ETSI attributes. Sufficient for common uses where immediate evidential value is enough.
• PAdES B-T (Baseline-T): adds a qualified RFC 3161 timestamp immediately after the signature, proving the date.
• PAdES B-LT (Baseline-Long Term): adds long-term validation with embedded certificate chain and revocation data. Verifiable even after the original certificate expires.
• PAdES B-LTA (Baseline-Long Term with Archive timestamp): adds periodic archive timestamps to maintain evidential value beyond 10 years, essential for documents requiring very long preservation (real estate, patents).

Certyneo implementation: all signed PDFs are produced in PAdES B-LT by default, the profile recommended for the majority of B2B uses. The B-LTA profile can be activated on the Business plan for contracts requiring preservation longer than 10 years. Verifiability guaranteed in Adobe Acrobat Reader without plug-in.

PAdES vs other formats: see XAdES (for XML), PAdES / XAdES / CAdES comparison.
Electronic parapheur (approval workflow): The electronic parapheur is the digital equivalent of the physical parapheur used in government agencies and large companies: it centralizes documents awaiting visa or signature by a decision-maker. Historically reserved for the public sector (ADULLACT, Pastell by Libriciel), the electronic parapheur has expanded to enterprises with solutions integrated into ECM systems (Documentum, SharePoint, Alfresco). An electronic parapheur manages: the incoming mail list, signature delegations (see delegation), multi-level validation workflows (approval workflow), and the application of qualified electronic signature by the authorized signer. The main difference from a simple signature tool is the management of inboxes (pending, signed, rejected, archived documents) and passage audit for each document. Certyneo offers an integrated parapheur accessible via the dashboard or API.
PDF/A (long-term archiving): PDF/A is a standardized ISO version of the PDF format (ISO 19005) specially designed for long-term archiving. It embeds all fonts, images and resources within the file, forbids encryption and content dependent on an external environment. This guarantees that the document remains readable in 30 years without software dependency. For electronic archiving with evidential value, combining PDF/A with PAdES B-LTA is the recommended practice.
PIPEDA (Personal Information Protection and Electronic Documents Act, Canada): PIPEDA (Personal Information Protection and Electronic Documents Act, in French: Loi sur la protection des renseignements personnels et les documents électroniques) is the Canadian federal law on personal information protection in the private sector (S.C. 2000, c. 5). It governs the collection, use and disclosure of personal information in interprovincial and international commercial activities. It is the Canadian equivalent of the European GDPR, although less strict on some points (implicit consent sometimes permitted, lower financial penalties).

The 10 PIPEDA principles (from the Canadian Standards Association CAN/CSA-Q830):
1. Accountability — designate a personal information protection officer.
2. Identifying purposes — clearly state the purpose of collection.
3. Consent — obtain informed consent.
4. Limiting collection — collect only what is necessary.
5. Limiting use — use only for stated purposes.
6. Accuracy — keep data current.
7. Safeguards — appropriate technical and organizational protection.
8. Openness — public privacy policy.
9. Individual access — right to access and correct personal information.
10. Complaining procedure — complaint mechanism to the Privacy Commissioner of Canada.

PIPEDA and electronic signature: electronic signature involves processing personal data (name, email address, phone number, IP, session metadata, audit trail). PIPEDA requires:
• informed consent from the signatory before collection;
• secure retention (encryption at rest, restricted access);
• retention period proportionate to purpose (10 years for commercial contracts is generally accepted);
• right of access, correction and deletion on signatory''s request;
• mandatory notification in case of breach presenting real risk of serious harm (since 2018).

Quebec Law 25: the province of Quebec has its own law (Law 25 / Law modernizing personal information protection provisions, in force 2022-2024) which prevails over PIPEDA for intra-Quebec activities. Law 25 is stricter than PIPEDA — aligned with European GDPR on most points: mandatory explicit consent, designation of a personal information protection officer, impact assessments (DPIA), penalties up to 4% of worldwide revenue.

PIPEDA vs GDPR: the European Commission recognizes PIPEDA as providing an "adequate" level of protection under article 45 GDPR (Decision 2002/2/EC confirmed 2024). Transfers of personal data from the EU to Canada are therefore permitted without further formality. For Canadian organizations operating in the EU, GDPR remains applicable to the data of European residents (extraterritoriality, article 3).

Certyneo implementation: PIPEDA + Law 25 + GDPR compliance ensured by our data protection architecture — EU sovereign hosting (IONOS Germany), TLS 1.3 encryption in transit + AES-256 at rest, access logging, right to complete erasure within 30 days, compliant sub-processors. Transfers to Canada (rare — only accounts hosted on request in Canada) are governed by GDPR-PIPEDA standard contractual clauses.
Audit trail: The audit trail is the timestamped log of all actions performed on a document: sending, opening, viewing, OTP entry, signing, rejection, expiration. It constitutes the primary proof of evidential value in case of dispute, by demonstrating that the signature process was carried out in accordance with the rules. On Certyneo, the audit trail is integrated into the final PDF and stored in our database for a period of 10 years. Understand the audit trail in detail →
PKI (Public Key Infrastructure): A PKI (Public Key Infrastructure) is the set of hardware components, software, procedures and policies enabling the issuance, management and revocation of electronic certificates. It is based on asymmetric cryptography: a private key (secret) is used to sign, a public key (distributed in the certificate) allows anyone to verify the signature. Qualified providers operate PKIs compliant with ETSI standards.
Data portability (GDPR Art. 20): Article 20 of the GDPR grants data subjects the right to obtain their personal data in a structured, commonly used and machine-readable format, and to transmit it to another data controller. For users of an electronic signature platform, this right covers: signed documents and their audit trails, account metadata, and activity logs. Portability requires the service provider to provide a standardized export (JSON, CSV, ZIP) within one month. Conversely, the right to erasure (Art. 17) may be limited by legal retention obligations (evidential archiving 5–10 years) — signed documents cannot be erased as long as the legal period has not elapsed. Certyneo implements full account export via the customer portal and supports migration of archives to a third-party safe.
Trust Service Provider (TSP): A Trust Service Provider (TSP) is an entity that provides timestamping, certificate issuance, signature or archiving services under the eIDAS regulation. A qualified TSP is subject to regular audits and appears on the national trust list (in France: ANSSI list). Qualification guarantees the highest level of assurance recognized in the EU. See TSP obligations →

Q

QES (Qualified Electronic Signature): The qualified electronic signature (QES, Qualified Electronic Signature) is the highest level defined by the eIDAS regulation. It is legally equivalent to a handwritten signature throughout the European Union. Its issuance requires: prior identity verification, a qualified certificate issued by a QTSP, and the use of a Qualified Signature Creation Device (QSCD). It is required for electronic notarial acts, certain public procurement and sensitive administrative procedures.
QSCD (Qualified Signature Creation Device): A QSCD (Qualified Signature Creation Device) is a hardware or software device meeting the strict requirements of Annex II of eIDAS for the creation of qualified signatures (QES). It guarantees that the signature private key is generated within the device, never leaves it in clear, and can only be used by the legitimate holder. Certified HSMs and smart cards are common forms of QSCD. Cloud signature uses virtual QSCDs hosted in certified HSMs.
QTSP (Qualified Trust Service Provider): A QTSP (Qualified Trust Service Provider) is a TSP that has been audited and registered on the trust list of an EU Member State under the eIDAS regulation. Qualification is the highest level of European recognition: it is mandatory to issue qualified certificates, qualified timestamps, or qualified signatures (QES). In France, ANSSI maintains the official list (docaposte, Universign/Oodrive, CertEurope…). Certyneo interfaces with multiple QTSPs to trigger QES when the qualified level is required (public procurement, notarial acts, certain social procedures).

R

Automatic reminder: Automatic reminder is the feature of an electronic signature platform that automatically sends reminders by email or SMS to signers who have not yet signed, according to a configurable frequency. It reduces signature abandonment and accelerates completion of workflows. On Certyneo, reminders are configurable per envelope (frequency, message content) and all actions are tracked in the audit trail.
GDPR: The GDPR (General Data Protection Regulation, EU Regulation 2016/679) regulates the collection, processing and storage of personal data in the EU. In the context of electronic signature, it notably requires minimizing the data collected from signers, defining a retention period and ensuring the right to erasure. Certyneo is GDPR compliant with hosting in the EU (Germany) and an available processing register. See our security page →
ROI of electronic signature: The ROI (return on investment) of electronic signature is measured across four areas: (1) signature cycle reduction — from 5–10 days (mail/scan) to less than 1 hour on average, (2) direct savings — printing, postage, physical archiving (estimated at 15–30 € per envelope), (3) abandonment rate reduction — contracts awaiting paper signature have 3× higher abandonment rates, (4) compliance — GDPR fines for poor paper contract retention can exceed the annual cost of a SaaS tool. Going paperless typically breaks even within 3–6 months for SMEs processing more than 50 contracts per month.

S

SES (Simple Electronic Signature): Simple Electronic Signature (SES) is the basic level defined by the eIDAS regulation. It requires no specific technical requirement: a click "I accept", a signature image or email signature satisfies it. Its probative value is presumed but can be contested if the signatory denies their act. It suits low legal risk documents (quotes, internal meeting notes, letters of intent). For significant stakes, prefer the AES or QES level.
Signatory: Le signataire est la personne physique qui appose sa signature électronique sur un document et s'engage juridiquement sur son contenu — à distinguer de l'expéditeur, qui prépare et envoie le document, et d'une personne morale, qui « signe » via un cachet électronique.

Qui peut être signataire ? Toute personne physique juridiquement capable : un particulier majeur pour ses propres engagements, ou un représentant habilité pour une entreprise — dirigeant, salarié muni d'une délégation de signature, mandataire. Vérifier l'habilitation du signataire est un point de contrôle essentiel : un contrat signé par une personne non habilitée peut être contesté.

Signataire, cosignataire, approbateur : le cosignataire est un signataire supplémentaire du même document (co-signature), engagé au même titre ; l'approbateur, lui, valide le document dans un flux d'approbation sans apposer de signature juridiquement engageante. L'ordre des signataires peut être séquentiel (chacun signe à son tour, avec relances automatiques) ou parallèle (tous en même temps) — c'est le workflow de signature.

Comment l'identité du signataire est-elle vérifiée ? Selon le niveau de signature : en signature simple (SES), par le lien email unique ; en signature avancée (signature avancée), par authentification forte — code OTP email + SMS ; en signature qualifiée (QES), par vérification de la pièce d'identité auprès d'un prestataire de confiance qualifié.

Sur Certyneo : le signataire reçoit un lien unique par email, visualise le document, s'authentifie et signe depuis son mobile ou son ordinateur, sans créer de compte. Chacune de ses actions (ouverture, OTP, signature, refus) est horodatée et consignée dans la piste d'audit jointe au PDF signé — c'est elle qui relie juridiquement le document au signataire. Comprendre les niveaux de signature →
Advanced Signature (AES / eIDAS level 2): La signature avancée (Advanced Electronic Signature — AES) est le deuxième des trois niveaux de signature électronique définis par le règlement eIDAS (UE) n°910/2014, entre la signature simple (SES) et la signature qualifiée (QES). C'est le niveau recommandé pour la grande majorité des documents contractuels à enjeu.

Les quatre exigences de l'article 26 eIDAS :
• Lien univoque au signataire : la signature ne peut être attribuée qu'à une seule personne — assuré par le canal d'identification (email nominatif, mobile personnel).
• Identification du signataire : le procédé permet de retrouver qui a signé — état civil déclaré, adresse email, numéro de mobile vérifiés par code OTP.
• Contrôle exclusif : les données de création de signature sont sous le contrôle du seul signataire — matérialisé par l'authentification forte au moment de signer.
• Intégrité : toute modification ultérieure du document est détectable — garanti par le scellement cryptographique (hachage + PAdES).

AES vs SES vs QES : la SES n'exige aucune vérification renforcée (case à cocher, signature dessinée) — suffisante pour les documents du quotidien ; l'AES ajoute l'authentification forte et la preuve d'intégrité — adaptée aux contrats de travail, mandats, baux, dossiers bancaires et d'assurance ; la QES ajoute un certificat qualifié délivré après vérification d'identité et un dispositif certifié (QSCD) — c'est l'équivalent légal de la signature manuscrite dans toute l'UE, requis pour les actes les plus sensibles.

Valeur juridique : l'article 25 d'eIDAS interdit de refuser un effet juridique à une signature au seul motif qu'elle est électronique, et l'article 1367 du Code civil la reconnaît dès lors qu'un procédé fiable identifie le signataire et garantit l'intégrité de l'acte. En cas de litige, la fiabilité de l'AES se démontre par le faisceau de preuves : piste d'audit horodatée, codes OTP consignés, empreinte du document, horodatage. La QES bénéficie en plus d'une présomption de fiabilité (charge de la preuve inversée).

Quand l'AES suffit-elle ? Contrats de travail et avenants, contrats commerciaux, devis et bons de commande, mandats (vente, gestion locative, SEPA), baux, dossiers KYC et crédit : l'AES est le standard du marché. Passez à la QES pour les actes authentiques, certains marchés publics, la cession de fonds de commerce, ou lorsqu'un texte l'exige.

Sur Certyneo : l'AES est disponible sur tous les plans payants — le signataire est authentifié par double OTP email + SMS, le PDF signé est scellé au format PAdES avec horodatage, et la piste d'audit complète est jointe au document. La QES est disponible à l'acte, sans abonnement dédié. Comprendre les trois niveaux eIDAS → · Le règlement eIDAS en détail →
Biometric signature: Biometric signature is a form of electronic signature that captures, in addition to the image of the handwriting pattern, dynamic behavioral data: stylus pressure, speed, angle of inclination, acceleration. These parameters create a unique fingerprint that is difficult to forge. It provides more robust authentication than a simple signature image. Biometric data is considered sensitive under GDPR and requires explicit consent. Biometrics alone is insufficient to reach AES eIDAS level; it must be combined with strong authentication.
Cloud signature: Cloud signature is an electronic signature in which the signer''s private key is generated, stored and managed by a trusted service provider in the cloud, rather than on a local device (USB key, smart card). This approach simplifies user experience and enables qualified signature (QES) from a simple browser. Keys are protected in a certified HSM operated by a QTSP.
Electronic Signature: An electronic signature is a mechanism for affixing proof of identity and consent to a digital document, equivalent to a handwritten signature. Under the eIDAS regulation, it encompasses three levels of trust: simple (SES), advanced (AES) and qualified (QES). Unlike a digital signature, an electronic signature is a legal concept that can rely on different technologies. Discover our complete guide →
Mobile signature: Mobile signature refers to the ability to electronically sign a document from a smartphone or tablet, without a native application — via the web browser. The signer receives a link via email or SMS, views the document in their mobile browser, initials and signs with a tap gesture or by typing their full name (depending on required level), then validates via SMS OTP. On Certyneo, the signature interface is 100% responsive: identity verified, audit trail generated, and co-signed PDF delivered to the recipient in under 60 seconds on 4G mobile. No installation required for the signer.
Digital Signature: A digital signature is a technical implementation of electronic signature based on asymmetric cryptography. It consists of encrypting the hash of a document with the signatory''s private key, producing a fingerprint verifiable by anyone with the corresponding public key (contained in the certificate). It guarantees both the signatory''s identity and document integrity.
Smart contract and contract automation: A smart contract is a self-executing program deployed on a blockchain, whose terms are coded directly into the computer code and execute automatically when predefined conditions are met. Although popular in the Ethereum ecosystem (Solidity), smart contracts do not constitute an electronic contract in the sense of French civil law: their execution is automatic but their legal enforceability remains conditional on proof of a valid agreement of will. In B2B practice, the most robust combination is: qualified electronic signature of the master contract (certain legal proof) + smart contract for automatic execution of financial clauses (payments, penalties). The blockchain notarization of the hash of the signed contract constitutes a third complementary layer of proof.
Solde de tout compte (final settlement): Le solde de tout compte fait l'inventaire des sommes versées au salarié lors de la rupture de son contrat de travail (salaire, indemnités, congés payés…). Régi par l'article L1234-20 du Code du travail, il est établi en double exemplaire et son reçu peut être signé par le salarié. Une fois signé, le salarié dispose d'un délai de six mois pour le dénoncer. La signature électronique sécurise sa remise et en horodate la date. Documents de fin de contrat →
Cipher suite: A cipher suite is a named combination of cryptographic algorithms (key exchange, authentication, symmetric encryption, MAC/HMAC) negotiated between the client and server during the TLS handshake. TLS 1.3 enforces modern suites like TLS_AES_256_GCM_SHA384, eliminating weak algorithms (RC4, 3DES, MD5). Certyneo only accepts TLS 1.3 cipher suites to maximize the security of signature sessions.

T

Trusted Third Party: A trusted third party is a neutral and independent actor whose mission is to secure an exchange between two parties: in electronic signature, they attest to signatories'' identity, seal the document, time-stamp actions and preserve evidence. Historically, notaries played this role for paper documents. In the digital realm, the trusted third party is formalized by the eIDAS regulation as trust service providers (TSP) and their qualified version (QTSP). Certyneo acts as a trusted third party by issuing advanced signatures (AES) and can delegate to a partner QTSP to issue qualified signatures (QES).
TLS (Transport Layer Security): TLS (Transport Layer Security) is the cryptographic protocol that secures Internet communications, succeeding SSL. It ensures confidentiality (encryption), integrity and server authentication (via its certificate). TLS 1.3, the current version, mandates modern cipher suites and a single round-trip handshake. The padlock in the browser signals that a TLS connection is active. Certyneo enforces TLS 1.3 minimum across all endpoints.
Trusted List (EU trust list): The Trusted List is the official list published by each EU Member State and supervised by the European Commission, listing qualified trust service providers (QTSP) and their services (qualified certificates, time-stamps, etc.). In France, the list is maintained by ANSSI. It is proof of a QTSP''s legitimacy under the eIDAS regulation. Only listed services benefit from the legal presumption of eIDAS compliance.
TSA (Timestamp Authority): A TSA (Timestamp Authority) is an accredited trusted third party that issues timestamp tokens compliant with RFC 3161 (Internet X.509 PKI Time-Stamp Protocol). The process: the client calculates the fingerprint (hash) of the document and sends it to the TSA via HTTPS; the TSA cryptographically signs a token containing this hash + the certified UTC reception time. This token proves that the document existed in that exact state on that specific date, without the TSA ever having access to the document itself. A qualified TSA (QTSA) listed on the EU trust list produces a qualified eIDAS timestamp, the most evidential form. In PAdES-LT and PAdES-LTA, TSA tokens are embedded in the PDF, ensuring offline verifiability in 20 years even if the original TSA has disappeared.

U

UETA (Uniform Electronic Transactions Act): UETA (Uniform Electronic Transactions Act, 1999) is the American model law that recognizes the probative value of electronic signatures in 47 of 50 states. Complemented by the ESIGN Act (2000) at the federal level, it provides that contracts and signatures "cannot be declared invalid solely because they are in electronic form". It is the American functional equivalent of the European eIDAS regulation, with a more liberal approach: UETA does not define levels (SES/AES/QES) and has no qualified equivalent. For transatlantic contracts, an eIDAS advanced signature (AES) is generally recognized as UETA/ESIGN compliant, whereas the reverse is not automatic.

V

Probative value (electronic signature): Probative value is the capacity of an electronic document to be accepted as evidence before a court in the same way as a paper document. It is the pivotal legal concept that determines whether a contract signed electronically can be enforced against your client, employee or supplier in the event of a dispute.

Legal basis in France: the law of 13 March 2000 introduced into the Civil Code article 1366, which establishes a principle of equivalence between paper and electronic documents, provided that (1) the person from whom the document originates can be duly identified, and (2) the document is created and retained under conditions guaranteeing its integrity. Article 1367 specifies that electronic signatures complying with the European regulation eIDAS benefit from this equivalence.

The four cumulative conditions for an electronically signed document to have probative value:
• Identification of the signatory: has authentication enabled identification of a specifically named natural person? Mechanisms: SMS OTP for AES, video identification + KBIS for QES.
• Document integrity: has the content not been modified since signing? Guaranteed by the cryptographic hash embedded in the signature.
• Process reliability: does the signature provider apply best practices (encryption, key management via HSM, traceability)? A qualified provider (QTSP) listed on the European trust list provides the strongest guarantee.
• Traceability: is there a timestamped audit trail that is enforceable (who signed, when, from which IP, after which authentication)?

Legal presumption: eIDAS establishes a presumption of integrity and origin for advanced (AES) and qualified (QES) signatures. In practice, this reverses the burden of proof: it is up to whoever contests the signature to prove it is invalid, not the signatory to prove it is valid. A qualified signature additionally benefits from full equivalence with handwritten signature (Civil Code art. 1367 al. 2).

Duration of probative value: a signed document retains its probative value as long as archiving complies with conditions (integrity, durability, traceability). For contracts with retention > 5 years, the PAdES B-LTA profile with periodic archival timestamps allows extending probative value beyond the expiration of original certificates. See also non-repudiation and LTV.
Antivirus verification of uploaded documents: Before a document is integrated into a signature workflow, any responsible platform must submit it to antivirus (AV) analysis. Threats targeting PDFs include: embedded macros, malicious JavaScript (AcroForms), PDF parser exploits (CVE-2019-12657, etc.). Cloud scanning solutions (ClamAV open-source, OPSWAT MetaDefender, VirusTotal API) analyze the file in milliseconds. ISO 27001 and SOC 2 Type II compliance requirements impose AV analysis of all incoming documents. An infected document in a signature workflow is particularly risky because it is sent to all signers, amplifying the attack vector. AV verification must be done before database storage, not after. Certyneo analyzes each uploaded document via ClamAV (in-process daemon) and blocks suspicious files with an explicit error message, never propagating them to the workflow.
Identity verification (identity proofing): Identity verification (identity proofing) is the process of verifying a person''s actual identity before issuing them credentials or authorizing them to sign. It ranges from simple email address collection (basic level) to biometric identity document verification via video (video KYC, qualified level). It is mandatory to issue a qualified certificate and trigger a qualified signature (QES).
Electronic Approval (Paraph): Electronic approval (or electronic paraph) is an intermediate validation action affixed to a document by an approver before final signature. It indicates that a reader has reviewed the document and approves it without legally committing themselves through signature. On Certyneo, multi-actor workflows allow combining approval steps (internal validation) and signature steps (external legal commitment), guaranteeing complete traceability of the validation workflow.

W

Webhook: A webhook is an API mechanism that allows Certyneo to automatically send an HTTP notification to the client''s application when an event occurs (document signed, refused, expired, audit trail generated). Unlike polling, the webhook operates in push mode: the client does not need to query the API regularly. It enables integration of Certyneo into third-party systems (CRM, ERP, HRIS) to trigger business actions in real time upon completion of a signature workflow.
Signature workflow: The signature workflow is the organized process defining the order, conditions and actors involved in signing a document. It can be sequential (each signatory signs after the previous one), parallel (all sign at the same time) or mixed. On Certyneo, the workflow includes management of automatic reminders, expiration deadlines and multi-document envelopes.

X

XAdES (XML Advanced Electronic Signature): XAdES (XML Advanced Electronic Signatures, ETSI EN 319 132 standard) is the European standard for digital signatures applied to XML documents. Adopted by the eIDAS regulation, XAdES is the reference format for signing structured XML files: electronic invoices (Factur-X, PEPPOL), EDI schedules, administrative declarations, market data, SEPA transcriptions.

Four XAdES profiles of increasing maturity, aligned with PAdES and CAdES:
• XAdES B-B: basic XML signature with minimal ETSI attributes. Use case: one-off signing of an XML sample without date constraint.
• XAdES B-T: adds a qualified timestamp RFC 3161. Standard for electronic invoices and EDI flows where issue date must be proven.
• XAdES B-LT: long-term validation with certificate chain and embedded revocation data. Remains verifiable after the original certificate expires.
• XAdES B-LTA: periodic archive timestamps to maintain evidential value over 10+ years. Essential for tax archives and regulated registers.

XAdES vs PAdES: choose XAdES to sign a native XML document (Factur-X invoice, PEPPOL schedule, EDI exchange). Choose PAdES to sign a PDF (contracts, quotes, HR documents). Both formats are legally equivalent — the difference is technical: the format suited to the document type.

XAdES variants: enveloping XAdES (the XML document is included in the signature structure), enveloped XAdES (the signature is added to the document), detached XAdES (signature stored in a separate file). Certyneo handles all three variants via REST API. See the PAdES / XAdES / CAdES comparison.
XAdES / PAdES / CAdES: XAdES, PAdES, and CAdES are the three standard digital signature formats defined by ETSI for the eIDAS regulation. XAdES (XML Advanced Electronic Signatures, EN 319 132) signs XML documents, PAdES (PDF, EN 319 142) embeds the signature token directly in the PDF — this is the format Certyneo uses to produce offline-verifiable files in Acrobat Reader. CAdES (CMS, EN 319 122) applies to arbitrary binary streams. Each format comes in profiles (B-B, B-T, B-LT, B-LTA) offering increasing guarantees: validity over time, qualified timestamp, long-term archival proof.

Y

YubiKey (hardware security key): A YubiKey is a hardware security key (USB/NFC) designed by Yubico that stores non-extractable cryptographic secrets and supports FIDO2/WebAuthn, OpenPGP, and PIV protocols. As part of a qualified signature (QES), a YubiKey (or an equivalent device compliant with Annex II of eIDAS) can serve as a Qualified Signature Creation Device (QSCD): the private key associated with the qualified certificate never leaves the hardware, guaranteeing the highest level of assurance over the signer''s identity. On a Certyneo admin account, a YubiKey can also protect admin access via hardware MFA.

Z

Paperless: "Paperless" (or going paperless) is the process of completely replacing paper document flows with signed digital equivalents. Beyond operational gain (signature cycle divided by 5 to 20 on average), paperless reduces the carbon footprint related to printing, postage, and physical archiving. Electronic signature, combined with probative electronic archiving (minimum 10 years for commercial contracts), is the technical prerequisite for the transition. Dematerialization describes the movement; paperless is the end goal.
Zero Trust (zero-trust security): The Zero Trust model (zero trust) is a security architecture based on the principle "Never trust, always verify" — unlike the classic perimeter model which trusts everything inside the corporate network. Its pillars are: continuous identity verification (MFA at each access), least privilege (access strictly limited to operational need), micro-segmentation (service isolation), traffic inspection (including internal), and real-time monitoring. In the context of electronic signature, Zero Trust applies at multiple levels: access to the HSM (no private key accessible without strong operator authentication), access to envelopes (identity-based control, not just link-based), and admin access (ephemeral sessions with automatic revocation). The NIST SP 800-207 framework and the ANSSI guide "Recommendations on Zero Trust" (2021) formalize the requirements in France.

Deepen your knowledge with our guides

These guides expand on the key concepts in the glossary with concrete examples and real-world use cases.

Certyneo Community

A question about electronic signatures?

Join the Certyneo community: ask your questions, share your answers and connect with thousands of users and our team.

Ready to put these concepts into practice?

Certyneo allows you to create eIDAS-compliant signature envelopes in just a few clicks, with no installation required.

Try for free View pricing