Online Signature Legitimacy for Corporations in European Union

How to eSign a document: online signature legitimacy for corporations in European Union

hi I am Jes Nana the CEO of trust Factory welcome to zoholics 2023 I'd like to speak to you today about Advanced electronic signatures in the context of the South African uh legal framework so trust Factory is a South African trust service provider um it is an holy owned subsidiary of isolve and isol has been in cyber security since 2004 the trust Factory pki solution is wholly owned and developed by isolve and operated by trust Factory as a trust service provider so what exactly is a trust service provider well trust service providers offer a combination of both digital identities together with electronic signature service if you look at the history of trust Factory um it starts way back right in 2002 when the ECT Act was signed into law using the trust Factory pki solution in around 2013 the South African post office trust Center was accredited also with the trust Factory pki solution and in 2018 we established trust Factory to start operating as a public certificate Authority in 2018 we also achieved various International accreditations including web trust uh we got embedded into a few root stores and we also got approval with Adobe for the for the Adobe approved trust list the aat uh this means that electronic signatures generated into PDFs using our solution are internationally recognized in 2021 trust Factory also achieved its owna accreditation for AES that means that that point in time and even till now 2third of all accredited parties have Solutions based on trust Factory pki in 22 we signed a partnership together with zo sign to launch our cloud based electronic signature service called cumulo key cumulo key is essentially the electronic signature service component of the trust Factory offering so what makes trust Factory very different is that we have a deep knowledge expertise and experience with pki and electronic signatures we are proudly South African with a global reach our Solutions are seamlessly integrated with Zoho sign but most importantly what we are offering is Advanced electronic signatures in a manner that is intended by law so for those that don't know what an advanced electronic signature is or more generally how electronic signatures apply uh within the South African legal framework um there are pieces of legislation that govern the use of electronic signatures in South African law those are specified in the ECT Act of 2002 and is also specified in more technical detail in the South African accreditation Authority regulations Thea regulations um in terms of what an exactly an advanced electronic signature is well put very simply it is a signature that is electronic but is legally recognized under law as having equal weight to that of a handwritten signature to achieve this it needs to meet very stringent security requirements that are stipulated in the act and regulations you can think of this as the highest level of security electronic signature available on the market um it uses authenticator identified first on a physical face-to-face identification we then uniquely link the user and and and and offer mechanisms to identify the user on each and every signature these signatures are also importantly maintained under the sole control of the user so you as a user can indicate when you make a signature you and you it creates an audit Trail uh that provides non-repudiation that means indis indisputable proof that you've made that signature it is linked to the data when you're actually signing to identify tampering uh on the document itself this is one of the features that make this type of signature even better than that of a handwritten signature so if you were to compare what's available on the market and what is being offered by other providers and how that Stacks up to Advanced electronic signature this table gives you an overview of of what's out there and how how these different solutions stack up for an embedded image of a signature that is by no means offering any level of security those are easily forged and don't offer any level of protection to you whatsoever uh platform seal signatures are one step above that that Pro provide you with the data Integrity aspect that means ensuring that the documents cannot be tampered with but fall short on on on various other aspects like the legal compliance and the user Soul control uh class three signatures often what referred to as aatl in our market and of course also the class 2 and class one signatures they don't offer uh as much security either because they fall short in in terms of being a ble to prove user soulle control and having the legal compliance in the ACT there are various unaccredited tsps in the market as well offering Advanced electronic signatures or signatures electronic signatures but by virtue of them being unaccredited they basically not offering you anything that is above a class three at best it is equivalent to a class three and they cannot prove to you often times that um the the the the users keys and certificates are actually under users's control the trust Factory AES offers you basically the highest level of security you have everything from legal compliance and meeting all of the requirements of the AES in terms of the act together with the data Integrity so a AES can only be issued by Ana accredited party there are Nona statements of compliance that are out there in the market but these do not constitute legal compliance because it's very clear in the ECT act the requirement foraa accreditation for party to be able to issue an AES signature so when is ECT when is AES actually needed well from an extract from the ECT act there are variety of different use cases specified there where it is mandatory for an advanced electronic signature to be used these range from notarizations to shity ships to licensing agreements uh things related to credit agreements Etc but I'd like to draw your attention to the sixth Point uh on this bullet list any document where a signature is required by law and the law does not specify the type of signature required this is essentially a catchall uh requirement that is saying that uh basically wherever there is no real stipulation on electronic signature then the advanced electronic signature will apply so covers the widest range of of use cases it takes away the legal guesswork for you to decide whether something actually requires AES or not um why is this AES security important well not using an AES is like allowing other people to use your government issued ID document you'll be opening yourself up to identity theft and fraud uh it's like allowing others to share your keys for your house or your office or your safe it opens you to to the risk of cyber crime and also if it's not an as signature it most likely won't offer you any level of insurance or legal Protections in the case that something goes wrong this will open you up to financial reputational and other types of risks so AES is readily available it's a cost effective and conveniently offered solution through platforms like Zoho sign so trust Factory as a trust provider for AES uh has to prove Pro to the public generally and to the cyber security community at large uh that we are operating in a transparent manner that we offer a high degree of trust we held accountable and our Solutions are interoperable with the rest of the solutions out there in the market to achieve this a very important thing we offer everything regarding our certificates and keys under user control this is a very important aspect of the ECT act and what differentiate Ates AES from many other types of electronic signatures each and every signature that you make needs to be under your control so we offer self-service portal uh the URL provided above um where you can actually manage your certificates and keys uh this is together with our electronic signature service cumulo key which operates with uh time based otps so each and every signature that you apply requires an authentication code that you can use uh from your mobile similar to the types of security controls that many of the financial institutions are currently offering and of course there's full audit Trail to ensure that all your signatures Integrity is offered with nonre peration we undergo annual independent audits both internationally and locally to maintain our web trust and our pki for financial services accreditations as well as our local slea ECT act accreditation we have responsibility as a public CA and as a tsp to report on our operations publicly uh we do this through our public CA repository which is open to to to anybody we have the the web trust seal that is offered through our website for people to to peruse our annual audited uh statements of compliance we we have reporting responsibilities for example to Adobe and other vendors uh regarding security and security incidents uh we have to maintain these levels of security to be cons consistently uh represented in the common CA database which is a worldwide database operated by Mozilla Microsoft and Google and of course we have responsibility towards the slea we have to annually report to them with regards to our our audits the service that we offer also comes with cyber insurance we we provide some degree of insurance on the on the signatures that are are made with the trust Factory AES um this is both financial and from security point of view on the right hand side you see our certificate of accreditation um this was issued to us in in in in um 2021 and below that you see a a variety of different um accreditations that we've achieved the slea the iso the web trust Adobe trust list Etc so what we offering is basically AES done correctly and offering you the maximum level of security as far as electronic signatures are concerned in the South African context thank you very much uh we hope to see you again soon uh if you'd like to reach out to us please contact us through our contact page on our website or drop us an email at info@ tract. net enjoy the rest of your conference thank you bye-bye