The digital safe, explained simply
A digital safe is not just storage space: it is a preservation system that guarantees the integrity, date and origin of your documents over time. This guide explains how it works, its probative value, the applicable standards and regulations (NF Z42-020, eIDAS) and the cases where it becomes essential.
What is a digital safe?
A digital safe is a secure preservation service that protects your electronic documents reliably and durably. Unlike a hard drive or standard cloud storage, it guarantees that each document remains unalterable, timestamped and retrievable throughout its retention period.
In France, it is governed by a specific standards framework: the NF Z42-020 standard defines the functions of a "digital safe component". Its role is to provide technical proof of the date and integrity of each document, an essential condition for its probative value in the event of a dispute.
Digital safe or electronic archiving: what's the difference?
The two concepts are closely related but distinct. The digital safe (NF Z42-020 standard) is a component: it seals and preserves individual documents with proof of integrity and a timestamp. The electronic archiving system, known in France as an SAE (NF Z42-013 standard), is a broader organizational and technical framework that manages the entire lifecycle of the archive: transfer, classification scheme, final disposition and traceability.
In practice, a digital safe is often the building block that provides storage with probative value at the heart of an archiving project. To find out more, see our electronic archiving guide and the electronic archiving glossary entry.
Probative value: what makes the difference
Probative value is a document's ability to serve as evidence. It rests on four technical guarantees provided at the time of deposit.
Integrity fingerprint
A digital fingerprint (SHA-256 hash) is calculated on deposit: any later change, even to a single character, becomes detectable.
RFC 3161 timestamping
An RFC 3161 timestamp token, issued by a third-party timestamping authority, attests to the date of each document.
Immutability (WORM)
The document is locked in write-once mode: it can be neither modified nor deleted before the end of its retention period.
Guaranteed retrieval
You can retrieve your documents at any time, with no dependence on a proprietary format.
The standards framework: NF Z42-020, NF Z42-013 and eIDAS
Three reference texts underpin storage with probative value. The NF Z42-020 standard specifies the functions of a digital safe component; the NF Z42-013 standard (carried over into ISO 14641) governs the electronic archiving system as a whole.
At the European level, the eIDAS Regulation defines qualified trust services, including qualified electronic timestamping, which gives a document a legally certain date enforceable against third parties. The eIDAS 2.0 revision extends this framework to the European Digital Identity Wallet. Together, these texts underpin the legal value of the documents stored.
The NF Z42-020 standard in practice
The NF Z42-020 standard describes the expected functions of a "digital safe deposit box component" (CCFN): what it must do from the filing of a document until its retrieval or deletion. It covers this preservation component, and not the entire information system — it is NF Z42-013 that covers the electronic archiving system as a whole.
In practice, it is what serves as a reference when a call for tenders or an internal archiving policy requires a safe deposit box "to standards". Knowing what it covers allows you to read a supplier response without relying solely on commercial terminology.
The five functions of a digital safe deposit box component
- Filing and sealing — the document is recorded and then sealed by a fingerprint, which fixes its content at the moment of filing.
- Integrity control — the fingerprint is recalculated on demand: an alteration, even of a single byte, becomes visible.
- Operation traceability — filing, consultation, retrieval and deletion are logged in an unalterable manner.
- Retrieval — the holder retrieves their documents and associated evidence in an exploitable format, without dependence on the service provider.
- Controlled deletion — a document disappears only at the end of its retention period, and the operation leaves a trace.
"Compliant with NF Z42-020" and "certified NF 203" do not mean the same thing
The standard is a technical framework: an editor can implement its functions and declare it themselves. NF 203 CCFN certification, on the other hand, is issued by a third-party organization after audit, and it is what procurement specifications require when they call for a "certified" safe deposit box. Certyneo Vault implements the functions described by the standard — sealing, RFC 3161 time-stamping, immutability, logging and retrieval — and does not claim NF 203 certification. When facing a supplier who announces it, always ask for the certificate number rather than a mention of compliance.
When should you use a digital safe?
The need arises whenever a document must be kept in a legally enforceable form, for a statutory or contractual period. A digital safe therefore complements an electronic signature or HR digitization project. A few common examples:
- Pay slips — the employer must offer the employee a secure storage space (French Labor Code).
- Signed contracts — keep an electronic contract with probative value throughout its term.
- Invoices — archiving with probative value, as required by the French e-invoicing reform.
- Personal documents — diplomas, deeds and supporting documents kept secure and accessible for life.
Security and GDPR compliance
In any reputable digital safe, each document is encrypted at rest with a key specific to that safe. Key management ideally relies on a hardware security module (HSM), which protects cryptographic secrets against extraction.
Storing personal documents falls under the GDPR: data minimization, a justified retention period, rights of access and retrieval. A compliant safe logs every access and ensures that only the holder, or an authorized person, can view or retrieve the documents.
Digital safe or cloud storage?
Cloud storage (Drive, Dropbox…) is designed for sharing and synchronization: files can be modified and deleted at will, without proof of their state on a given date.
A digital safe does the opposite: it seals, timestamps and makes each document immutable. The former meets a need for convenience; the latter, a need for proof and compliance. You can also verify the integrity of a signed document at any time.
How long should you keep your documents?
The retention period depends on the nature of the document and your legal obligations. A digital safe lets you set, for each document, a period during which it remains immutable, followed, where appropriate, by a controlled purge. A few common benchmarks in France:
| Document | Indicative retention period |
|---|---|
| Pay slip (employee) | until retirement, then + 3 years (lifetime recommended) |
| Invoice (customer or supplier) | 10 years |
| Commercial contract | 5 years after the end of the contract |
| Tax documents | 6 years minimum |
| Personal deeds and diplomas | for life |
Ready to preserve your documents with probative value?
Certyneo Vault: the digital safe for individuals and businesses.
See also our pricing and the Certyneo Vault offering.
Frequently asked questions
Is a digital safe mandatory?
It is not always mandatory, but in practice it becomes so in several cases: paperless pay slips, invoice archiving (the French e-invoicing reform) and keeping contracts with probative value.
How is it different from an electronic signature?
An electronic signature creates a binding document; the digital safe then preserves it in an unalterable and enforceable form. The two are complementary.
Are my documents encrypted?
Yes, at Certyneo each document is encrypted at rest with a key specific to your safe.
How long is a document retained?
The retention period can be configured to match your legal obligations, with a default of 10 years.
Does a digital safe have legal value?
Yes. Thanks to the integrity fingerprint and RFC 3161 timestamping, a document stored in a compliant digital safe has probative value: it can be produced as evidence, and its date and integrity can be verified by a third party.
What is the difference between a digital safe and an electronic archiving system (SAE)?
The digital safe (NF Z42-020) is the component that seals and preserves a document with probative value. The electronic archiving system, or SAE (NF Z42-013), is the complete archiving system that manages the entire document lifecycle. The former is often a building block of the latter.
What is the NF Z42-020 standard?
It is the French standard that defines the functions expected of a digital safe component: deposit with a fingerprint, timestamping, immutable storage (WORM), traceability and guaranteed retrieval.
How do I retrieve my documents?
Retrieval is guaranteed at any time, in an open format and with no dependence on a proprietary tool: you get the file and its associated evidence (fingerprint, timestamp token).
What's the difference between the NF Z42-020 standard and NF 203 certification?
NF Z42-020 is the technical framework; NF 203 CCFN certification is issued by a third-party body that audits a product against this framework. An editor can therefore be compliant with the standard without being certified. If your specifications require certification, ask for the certificate number.
Must a digital safe be certified?
No text imposes it generally. Certification becomes a criterion when it appears in a call for tenders or in an internal archival policy. In other cases, what matters is the chain of evidence actually implemented: fingerprint, timestamping, immutability and access log.
