FAQ on digital signatures

An electronic signature is technical proof that a document has not been altered and that a specific person (or identity) was involved in its creation. The level of assurance regarding identity, integrity, and verifiability varies depending on the signature level. It is usually stored directly in the PDF or as a signature file.

There are three levels of electronic signatures: simple electronic signature (EES), advanced electronic signature (FES), and qualified electronic signature (QES).

A simple signature is any electronic expression of intent without strict requirements. This can be, for example, a typed name, a click, or a scanned signature. It is not automatically “invalid,” but it has little probative value in the event of a dispute. It is often sufficient for low-risk internal processes.

An advanced signature is uniquely linked to a person and makes changes to the document detectable. It must identify the person and be created using signature data that the person alone controls with a high degree of certainty. In practice, this is often implemented using certificate-based digital signatures. An audit trail is not mandatory, but it increases traceability in the event of a dispute.

A QES is the strongest type of signature from a legal standpoint and is equivalent to a handwritten signature. It is created using a qualified certificate and a qualified signature creation device. In many cases, it replaces paper when a written document needs to be reproduced digitally. In practice, a QES is often the “safest” option when there is a high risk of dispute or liability.

You make your decision based on the document’s risk, legal requirements, and likelihood of dispute. A simple rule of thumb: the higher the risk or liability, the higher the classification level. Many organizations use FES as the standard and QES only for specific document classes. A quick document classification saves a lot of effort later on.

You need a QES when you want to securely replace the “written form” requirement with a digital alternative. Typical reasons include strict evidentiary requirements, clear compliance guidelines, or contract clauses specifying the “written form.” Common examples include certain terminations, high-risk contract amendments, and sensitive powers of attorney. QES is often not legally required, but it makes strategic sense.

An electronic seal is the equivalent of a company stamp and protects the origin and integrity of organizational documents. It verifies that a document originates from a legal entity and has not been altered. This is ideal for official notices, supporting documents, certificates, or form letters. Seals work particularly well in automated processes that do not involve a “signatory.”

Electronic signatures are issued to individuals, while digital seals are issued to legal entities. A signature indicates that a person has signed a document. A digital seal indicates that a document originates from an organization and has not been altered.

According to eIDAS, there are two types of electronic seals: the advanced electronic seal and the qualified electronic seal (qSeal). An advanced electronic seal can be uniquely attributed to an organization and makes it possible to detect any subsequent changes to the document. The qSeal is the highest level: It is based on a qualified certificate and is recognized throughout the EU as having particularly strong evidentiary value.

It generates a cryptographic fingerprint that makes it possible to detect changes to the document. To put it simply: A hash is generated from the document, and that hash is signed. Any change alters this fingerprint and will be detected during verification. In addition, certificates are used to verify the identity (or organization).

A TSP provides signatures, seals, and certificates in accordance with the eIDAS standard. Qualified signatures and seals require a qualified TSP and qualified certificates. The TSP must meet high security standards, is regularly audited by the relevant authorities, and is authorized to provide qualified trust services.

LTV ensures that signatures remain verifiable even years later. To achieve this, additional validation data (e.g., timestamps or revocation information) is embedded or archived. Without LTV, a signature may be more difficult to verify later on when certificates expire.