The document has to hold up without us.
A completed Signitri document verifies in Adobe Acrobat and with OpenSSL, offline, with Signitri nowhere in the picture. An artifact that needs the vendor alive to be checked is not evidence.
Still checkable when the certificates behind it have expired.
Signitri produces PAdES B-LTA, the long-term validation profile of ETSI EN 319 142. The material needed to validate the signature travels inside the document, so a contract signed today does not become unverifiable when a certificate reaches the end of its life.
PAdES B-LTA
ETSI EN 319 142, the long-term validation profile. Revocation data and validation timestamps are embedded in the file rather than fetched from a server you have to be able to reach.
RFC 3161 timestamps
Issued by a public timestamp authority whose root is in the Adobe Approved Trust List. The time attached to a signature comes from a third party, not from us, and that is the point.
Incremental updates only
Signing appends a revision. It never rewrites a byte that an earlier signature covered, so every signature already on the document stays valid when the next person signs.
Check it on a machine with no network.
Open a completed document in Adobe Acrobat and it reports the signature, the certificate and the time. Run the same file through OpenSSL on a disconnected machine and you get the same answer. Signitri is not consulted, and does not need to still exist.
This is the reason the format was chosen. A verification that depends on a vendor API is a verification of the vendor.
All of it, without calling Signitri
The service that holds the key has never held your document.
Signing runs against the signed attributes, not against the file. The PDF is assembled, hashed and finished in the browser, and the signing service sees a few hundred bytes of DER.
In the browser
Your browser hashes the document and assembles the CMS signed attributes.
On the wire
Only the DER encoding of those attributes is sent. It carries the digest of the document, not the document.
Back in the browser
The signature returns and is written into the PDF as an incremental update. The file never left.
A compromise of the signing service would be a serious event. It would not be a document breach, because the documents were never there.
The PDF and cryptographic layer is our own code, end to end.
DEFLATE through CMS is written and maintained by Signitri, with no third-party dependencies. That is a deliberate cost, paid for one reason: the part of the system that decides whether a signature is valid carries no inherited supply-chain surface.
It also means the defects are ours. There is no independent review of this layer to point at yet, and the section below says so plainly.
Every layer between the file and the signature
The evidence, and the data behind it.
The evidence pack
Sealed the moment the last person signs. The hash is printed in the pack, so a third party can confirm that the file they were handed is the file that was signed.
The data we hold about signers
A government photo ID and a selfie are the highest-value data Signitri holds, and they are treated as such.
- The ID image and the selfie are used for the identity check — OCR extraction, ID number validation, liveness, face match, and the cross-check through ThisIsMe — and for the verification record that sits in the evidence pack.
- The verification result for each signer, including what matched and what a reviewer decided, is part of the audit record and is retained with the document.
- The selfie is never placed on the document.
The retention period for ID images and selfies is being finalized with counsel and is not published yet. We would rather say that than publish a schedule we have to walk back. Ask, and you will be told exactly where it stands. What is already settled is written in the privacy notice and thesubprocessor list.
What we do not claim.
Overclaiming about identity is the one thing that would make this product worthless, so the boundary is stated here rather than discovered later.
Signitri is not a certificate authority.
We are not an accredited certificate authority, we do not issue qualified certificates, and we are not a qualified trust service provider under eIDAS. Whether a particular signature counts as advanced or qualified in a particular jurisdiction is a legal question, and it is not one we answer for you.
Verification reduces impersonation. It does not eliminate it.
A liveness check and a face match against a government photo ID are strong evidence that the person who signed is the person on that ID. They are not proof. No identity check is, and the ones that say otherwise are describing something they cannot deliver.
A verified signer is not a verified authority.
Verification establishes who signed. It does not establish that they were entitled to bind the company they signed for, or that they understood what they signed. Those remain questions for you and your counsel.
Signature law varies by jurisdiction and by document.
Electronic signature is recognized under ESIGN, UETA and eIDAS, but the effect of any given signature depends on where it is made and what kind of instrument it is. Wills, some property transfers and certain family-law instruments are excluded in many places. This page is not legal advice.
There is no third-party audit to point at yet.
Signitri holds no SOC 2 report and no ISO 27001 certificate, and the PDF and cryptographic layer has not been reviewed by an independent party. When that changes it will be stated here, with the date and the scope of the work.
Owning the code means the defects are ours.
Writing the cryptographic layer ourselves removes the supply chain, not the possibility of a bug. It removes the upstream maintainer standing between a defect and its fix.
The questions to ask, and where each one stands.
Some of these are answered above. Some are answered on request. Some are not settled, and they are marked that way here rather than left for you to find out during procurement.
This page was last reviewed on 29 July 2026.
Send us your security questionnaire.
It comes back answered in full, including the questions above that are still open. If you would rather test than read, ask for a completed document and put it through your own verification tooling.