An e-signature platform holds your contracts, decides who counts as the signer, and produces the evidence you will rely on if a signature is ever disputed. Most procurement reviews stop at feature lists and price, yet the security questions decide whether a signature stands up: how the signer was authenticated, whether the document can be shown to be unchanged, what legal level the signature reaches, and where the documents and audit evidence live. This vendor-neutral buyer's guide covers signer authentication, audit trails, the eIDAS signature levels (simple, advanced and qualified), the US ESIGN Act, data residency and platform security. It is for security, legal and procurement teams choosing or reassessing a signing platform. The cryptography behind signatures is covered in the Digital Signatures Guide.
Key takeaways
- Match the signature level to the document. Under eIDAS a qualified electronic signature has the equivalent legal effect of a handwritten signature; most commercial documents need far less, some need exactly that.
- Signer authentication is the weakest link. An email link proves control of a mailbox, nothing more. Require stronger options for high-value or regulated documents.
- The evidence package matters as much as the signature. Tamper-evident documents, a complete audit trail and long-term validation are what you produce in a dispute.
- Treat the platform as a sensitive data store. Contracts contain personal data, pricing and identity documents; assess encryption, residency, retention and admin access accordingly.
- Integrations are non-human identities. API keys and OAuth apps that send envelopes from CRM or HR systems can create and retrieve documents at scale.
Define requirements
- Document types and legal level: list what you sign (sales contracts, HR documents, consumer agreements, board resolutions, regulated filings) and the level each needs. Under the US ESIGN Act (15 U.S.C. 7003) some records are excluded, including wills and testamentary trusts, family law matters, court documents, utility shut-off and primary residence foreclosure or eviction notices, health and life insurance cancellations and hazardous material documents.
- Jurisdictions: EU and EEA signers bring eIDAS (Regulation (EU) No 910/2014, as amended by Regulation (EU) 2024/1183). US signers bring ESIGN and state law. Other countries have their own rules; ask legal which apply.
- Consumers or businesses: where a law requires information to be given to a consumer in writing, ESIGN (15 U.S.C. 7001(c)) requires affirmative consent after specified disclosures, and consent given in a way that reasonably demonstrates the consumer can access the electronic form.
- Signer assurance: which documents need identity verification beyond email, and to what level.
- Data: residency requirements, retention periods, legal hold and deletion.
- Integrations: CRM, HR, procurement and document management systems that will call the API.
eIDAS signature levels at a glance
| Level | Definition (eIDAS) | Legal effect | Typical use |
|---|---|---|---|
| Electronic signature (simple) | Data in electronic form attached to or logically associated with other electronic data and used by the signatory to sign (Art. 3(10)) | Cannot be denied effect as evidence solely because it is electronic (Art. 25(1)) | Routine commercial agreements, internal approvals |
| Advanced electronic signature (AES) | Uniquely linked to and capable of identifying the signatory, created with data under the signatory's sole control with a high level of confidence, linked to the data so later changes are detectable (Art. 26) | As above, with stronger evidential weight | Higher-value contracts, HR and financial documents |
| Qualified electronic signature (QES) | An AES created by a qualified signature creation device and based on a qualified certificate (Art. 3(12)) | Equivalent legal effect of a handwritten signature (Art. 25(2)) | Documents where law or counterparties require handwritten-equivalent signatures |
A qualified certificate must come from a qualified trust service provider, which must verify the signer's identity using methods set out in Article 24(1a), such as a European Digital Identity Wallet or notified eID at assurance level high, an existing qualified certificate, or physical presence. If you need QES, ask which provider issues the certificates and check its status. See the eIDAS Qualified Trust Services Guide.
Capability areas
| Area | What to look for |
|---|---|
| Signer authentication | Options per envelope: email link, access code, SMS or voice one-time code, knowledge checks, ID document and liveness verification, national eID or wallet, SSO for internal signers; policy that sets minimums by document type |
| Document integrity | Cryptographic sealing of the completed document with a platform certificate, so any later change is detectable; trusted timestamps; long-term validation data embedded |
| Audit trail | Per-event record of sending, viewing, authentication method used, consent, signing and completion, with timestamps and IP data; certificate of completion bound to the document |
| Signature levels | Simple, advanced and qualified options; for QES, remote signing through a qualified provider and the provider's identity proofing |
| Consumer consent | Configurable ESIGN disclosure and consent step, withdrawal, paper copy requests, record of consent |
| Admin security | SSO with SAML or OIDC, enforced MFA, SCIM provisioning, granular roles, admin activity logs, domain claiming to stop shadow accounts |
| API and integrations | OAuth with scoped access, JWT or certificate-based service authentication, key rotation, per-integration logging. See the SaaS and OAuth App Governance Guide |
| Data protection | Encryption at rest and in transit, customer-managed key options, regional hosting, retention and purge rules, legal hold |
| Assurance | Independent security attestations and certifications, penetration testing, published subprocessors |
Evaluation criteria
| Criterion | Minimum acceptable | Strong |
|---|---|---|
| Signer authentication policy | Access codes and one-time codes available | Identity verification and eID options, enforced by template or document type |
| Evidence quality | Audit trail and completion certificate | Sealed documents with timestamps and long-term validation, verifiable without the vendor's portal |
| Legal coverage | Simple signatures with ESIGN consent support | AES and QES for the EU signers you have, through named qualified providers |
| Identity integration | SSO and MFA | SSO, SCIM, granular roles, admin action logging to SIEM |
| Integration security | API keys | Scoped OAuth, service authentication without static secrets, rotation |
| Data residency and retention | Region choice for storage | Region choice for processing and backups, configurable retention and purge |
| Exit | Bulk export of documents | Bulk export of documents with audit trails in a verifiable format |
Questions to ask vendors
- Which signer authentication methods can we enforce per template, and can senders weaken them?
- If a signer disputes a signature in five years, what exactly will we produce, and can it be verified without your service?
- Which signature levels do you support for EU signers, and which qualified trust service providers issue the certificates for QES?
- How do you implement ESIGN consumer consent, and how is consent recorded?
- Where are documents, audit data and backups stored and processed, and who at your company can access them?
- Can we use our own encryption keys, and what happens to access if we revoke them?
- How do integrations authenticate, can access be scoped to specific accounts or folders, and are all API calls logged?
- How do you stop employees creating unmanaged accounts on our email domain?
Red flags
- Email-only signer authentication for all documents, with no policy enforcement.
- Completed documents that are not sealed, or audit trails held only in the vendor's database.
- Claims of "eIDAS compliant" with no clarity on which level is supported or who issues qualified certificates.
- No SSO or SCIM, or admin roles that cannot be separated from sending rights.
- API keys with account-wide access and no expiry.
- Vague answers on subprocessors, data location or retention.
Proof of concept
- Build templates for three document types with different authentication policies and confirm senders cannot downgrade them.
- Complete an envelope, then alter one byte of the downloaded PDF and confirm a standard PDF validator reports the change.
- Export the audit trail and check it records the authentication method, consent and each signer event.
- If you need QES, complete a signing with an EU signer through the qualified provider and validate the result.
- Connect SSO and SCIM, deprovision a test user and confirm access ends and their envelopes are reassigned.
- Connect one integration with scoped OAuth and confirm its calls appear in logs you can export.
- Run a bulk export and confirm documents and evidence remain verifiable outside the platform.
How NHI Mgmt Group can help
We provide independent requirements and evaluation support for identity, access and data security programmes, including the integrations and API credentials that connect signing platforms to the rest of the business. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Digital Signatures Guide · eIDAS Qualified Trust Services Guide · eIDAS 2.0 and the European Digital Identity Framework Guide · Identity Verification Buyer's Guide