Series 3 · Flows and organizations · 3.4
How to evaluate a signing service.
The questions that never fail, whatever the provider.
Choosing a signature service usually starts with a demo: a polished screen, a document signed in seconds, a green check mark. All of that matters, but it says little about what will happen on the day a document is disputed, a provider fails, or you need to switch services. These are the questions that separate a convenient tool from trustworthy infrastructure, whoever the provider may be.
1. About the proof
- In what format are signed documents stored? They should be standard formats, such as the ETSI advanced signature profiles, verifiable with independent tools.
- Does every signature carry a timestamp from a third party? The time on the provider's server is not enough.
- Do the documents support long term validation? With embedded validation data and archive timestamps.
- Is the evidence bound to the document? Not as a separate PDF, but in such a way that altering one is detectable in the other.
2. About identity
- What identification methods does it offer, and at what level? Ideally, you can choose the level according to the type of document.
- Does the evidence record the method used and its result? Not just "identity verified."
- How is account recovery protected? It is often the weakest point.
3. About trust in the provider
- What audits and certifications does it hold? For example, inclusion in an official trusted list if it offers qualified services, or information security certifications such as ISO/IEC 27001.
- Which third parties are involved? Certification authorities, timestamping authorities and identity verification providers, each with their own guarantees.
- What happens if a third party fails? A good service says so and records it; a bad one quietly lowers the level.
4. About independence
- Can I verify my documents without the provider? Using independent validators and public trust anchors.
- Can I export everything? Documents, evidence and metadata, in open formats, at any time.
- What happens to my data when the contract ends? Delivery and deletion timelines, in writing.
5. About operations
- Does it integrate with my systems? A documented API, event notifications and connectors for the tools already in use.
- Can it model my workflows? Signer order, approvers, deadlines, delegations and rejections.
- Where is the data stored, and who has access? Location, subprocessors and access logs.
| Red flag | Why it is a concern |
|---|---|
| "Our certificate of completion is enough" | Evidence kept separate from the document can be lost or edited. |
| "It can only be verified on our platform" | The proof depends on the provider continuing to exist. |
| "It always works" | Every system fails; what matters is how it reports failure. |
| "Export is quoted separately" | A way out is part of the service, not an extra. |
The best question to ask a signature provider is not how documents are signed, but how they are proven, and what happens once the provider is gone.
Key points
A signature service should be judged by the proof it leaves behind, the identity it guarantees, the trust it can demonstrate, the independence it offers and the way it fits into operations. Demos show the moment of signing; good questions reveal everything that comes after.