Legal validity of SignLocal signatures

This page is general information, not legal advice. Whether a signature is valid and binding depends on the law that applies, the type of document, and what the parties agreed. For important or regulated documents, check with your legal adviser.

No software can make a signature legally binding on its own. What SignLocal does is produce signatures that meet the elements electronic-signature laws look for, in the internationally standardised formats courts and auditors can check independently, with as much evidence as possible.

What SignLocal records for every signature

Legal element	How SignLocal provides it
Intent to sign	Each signer picks what the signature means: I approve this document, I am the author, or I acknowledge receiving this document. This is stored inside the digital signature as an ETSI commitment type and in the PDF's Reason.
Consent to sign electronically	Before signing, each signer must personally tick agreement to a consent statement. The statement, and the time each person agreed, is recorded on the signature certificate page (or in the package README for other files).
Signature linked to the document	A digital signature (RSA-2048 / SHA-256) covers the entire file. Any later change is detected.
Signature linked to the signer	The signature is made with the signer's private key and carries their certificate. A signing-certificate-v2 attribute binds the signature to that exact certificate.
Reliable time	An RFC 3161 trusted timestamp from an independent timestamp authority (DigiCert by default) proves the signature existed at that moment, independently of the signer's clock.
Record that can be kept and checked	The signed PDF is a self-contained record. Anyone can check it in SignLocal, Adobe Acrobat, pyHanko or OpenSSL, now or years later.
Protection against later changes	Optionally, the signer can certify (lock) the document, so any later change is flagged as a violation.
Audit trail	The signature certificate page records the document fingerprint, signers, emails, key IDs, intent, consent times and mark times.

Standards used

Standard	What it is	SignLocal
ETSI EN 319 142 (PAdES)	The EU/international format for signed PDFs	PDFs are signed as PAdES baseline B-T (B-B if no timestamp)
ETSI EN 319 122 (CAdES)	The format for detached signatures	`.p7s` files are CAdES B-T (B-B if no timestamp)
RFC 3161	Trusted timestamps	Timestamp token stored in each signature
ISO 32000 (PDF)	Signature fields, incremental updates, DocMDP certification	Every signer is added as a new revision; earlier signatures stay valid

Independent validation (pyHanko) reports SignLocal PDFs as intact and valid, with the timestamp trusted, and later signers recognised as permitted signing and form-filling changes.

How this maps to common laws

Malaysia

Electronic Commerce Act 2006 (section 62): an electronic signature satisfies a legal requirement for a signature if it is attached to or logically associated with the document, adequately identifies the signer and indicates their approval, and is as reliable as appropriate for the purpose. SignLocal records approval (intent and consent), binds the signature to the document, and adds a trusted time. Identification is strongest when signers use certificates issued by a certificate authority rather than SignLocal's self-signed ones.
Digital Signature Act 1997: the Act's presumptions for a digital signature require a certificate issued by a licensed certification authority (for example Pos Digicert or MSC Trustgate). SignLocal can sign with such a certificate if it is issued as a .p12/.pfx file (Identity → Use your own certificate). Certificates kept on hardware tokens or smart cards cannot be used from a browser.
Exclusions: the Electronic Commerce Act does not apply to some documents, for example powers of attorney, wills and codicils, trusts, and negotiable instruments. Use the form of signature the law requires for those.

European Union (eIDAS)

Simple electronic signature: SignLocal signatures always qualify.
Advanced electronic signature (AdES, Article 26): this needs a signature uniquely linked to and capable of identifying the signer, created with data under the signer's sole control, and linked to the data so changes are detectable. SignLocal's format (PAdES/CAdES) and tamper detection meet the technical part. To identify the signer reliably, use a certificate from a trust service provider. With a self-signed certificate, identification rests on other evidence (email, key ID exchanged beforehand, the consent record).
Qualified electronic signature (QES) has the legal effect of a handwritten signature across the EU. It requires a qualified certificate on a qualified signature creation device (smart card, token or remote QSCD). SignLocal cannot create QES, because browsers cannot use those devices.
Qualified timestamps: the default timestamp authority is a widely trusted public one, but not an EU-qualified one. Organisations that need qualified timestamps can point SignLocal at a qualified TSA (see setup).

United States (ESIGN Act and UETA)

ESIGN and UETA give electronic signatures the same effect as handwritten ones when there is intent to sign, consent to do business electronically, the signature is associated with the record, and the record can be retained and reproduced. SignLocal captures all four.

For consumer transactions, ESIGN also requires specific disclosures before consent (the right to a paper copy, how to withdraw consent, and hardware and software requirements). SignLocal does not send these disclosures; provide them yourself if they apply.

Other countries

Most countries follow the UNCITRAL Model Law on Electronic Signatures and recognise electronic signatures that reliably identify the signer and show their approval. The same principle applies everywhere: a CA-issued certificate gives the strongest proof of identity.

Getting the strongest legal position

Use CA-issued certificates for formal documents. Issue each signer a document-signing certificate from your organisation's CA or a licensed or qualified provider (.p12/.pfx). Signers load it under Identity → Use your own certificate.
Keep trusted timestamps on. This is the default whenever the device is online.
Have each signer confirm their own consent and intent. When signing together on one device, each person ticks their own box.
Exchange key IDs or certificates with people who use SignLocal's self-signed identity, and add them under Identity → Trusted certificates. Their signatures then show as verified.
Keep the final signed PDF (and .zip packages) as the record. Don't print and rescan: that loses the digital signatures.
Lock final documents that must not change (Finish → Lock the document), when there is a single signer.
Use the right form for excluded documents (wills, powers of attorney and so on).

What SignLocal does not do

Verify who someone is: there is no ID check, email confirmation or SMS code. Identity comes from certificates and from the people involved.
Qualified electronic signatures (EU QES) or hardware-token signatures.
Long-term validation data (PAdES-LT/LTA): certificate revocation information and archive timestamps are not embedded. Validators fetch revocation status online when checking CA-issued certificates. For records that must be checkable for decades, re-timestamp them with a tool that supports PAdES-LTA.
Central audit log or routing: everything stays with the signers; there is no server copy.