What the signature means
The certificate names the person's name, email and company. It comes from the company's CA at SAN and is valid for one year. The company admin confirmed the person; if they leave or are disabled, the certificate is revoked.
Check signatures / authenticitySigned in your own name. Certified for the company.
When someone of a company signs with SAN PDF Plus, they sign the PDF with their personal company certificate. Anyone can check later that the document came from this person of a company in our system and has not been changed since.
Offline too
The key is made on the device and never leaves it. The certificate chain is inside the PDF - so a document signed offline can be checked later too. When the device is online, a time stamp (not qualified) is added.
How anyone checks it
Drop the PDF on pdf.san-tga.eu/verify. The browser computes the check value and checks the signature itself; only the certificate serial and the check value reach us - never the document. Or in any PDF program with signature validation: trust the SAN root certificate there.
Locked after signing
Companies can lock a document after signing (certification): no changes, form fields only or comments only. A later change visibly breaks the signature.
Honest about the law
What it is - and what it is not
- An electronic signature with a company certificate - not a qualified electronic signature (no QES). It does not replace the written form (§ 126 BGB); where the law requires a QES it is not enough. In court it is admissible as evidence (Art. 25 (1) eIDAS); the court freely assesses it.
- A stamp has no legal effect of its own. The company is bound by the person who signs and their authority (i. A., i. V., ppa.).
- The time stamp from SAN is not qualified (RFC 3161): it shows that the document existed like this at that time - it is not a qualified time stamp under eIDAS.
- "Company verified" means: SAN checked the company details. Otherwise the check says "company account active". The person was confirmed by the company admin.
For specialists
Technology
- PAdES signatures (B-B, with a time stamp B-T) with the embedded chain: personal certificate → company CA → SAN PDF Root CA.
- Revocation lists (CRL) per company and a status lookup per serial.
- RFC 3161 time stamps at https://pdf.san-tga.eu/tsa - not qualified.