Frequently Asked Questions

Trusted Signatures is the document-trust layer that connects cybersecurity controls to legal rigor and financial protection. We apply PKI-based, standards-compliant PDF seals that are tamper-evident and auditable, so critical files hold up in reviews, audits, and cash-flow processes. (Built on ISO 32000 PDF signatures with DocMDP permissions, legal attestation, timestamping, OCSP/CRL, and version-comparison capabilities.)

Our mission: Make verifiable documents the default for business — simple, affordable, and ubiquitous.

Publisher applies an organizational cryptographic seal to your PDFs so recipients can confirm origin and detect any tampering directly in Adobe Acrobat/Reader and other PAdES-aware viewers. Your documents never leave your environment—we sign a cryptographic digest, not your file.

What recipients see:

• A certificate-based signature that validates in Acrobat/Reader (blue ceritified experience).
• Clear signer/certificate details; optional restrictions on what can change after sealing
• Document is tamper-evident with clear signer details.

Built-in assurances:

• PAdES-compliant sealing with Long-Term Validation (LTV) options (configurable)
• RFC 3161 timestamping plus embedded OCSP/CRL data for offline verification (configurable)
• Non-exportable keys protected by FIPS 140-2/140-3 Level 3 HSMs
• DocMDP/Certification profiles to limit post-seal edits (e.g., form-fill only)

How it fits your workflow:

• Integrate via API, CLI, Web sealing, or Zapier; no uploads required and browser-based sealing keeps the PDF on the local device
• Ideal for invoices, statements, reports, and any PDF that must be provably authentic outside an e-signature flow

See Pricing to learn more about our pay-as-you-go, no license fees model and use an estimator to predict your costs.

An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader.

EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority.

What recipients see:

• In Acrobat/Reader (and other PAdES-aware viewers), recipients see the blue certified signature indicator with your organization listed as the signer.

See Pricing to learn more about Identity.

Publisher sealing uses our default certificate (OrgID). Identity add-ons put your organization’s identity on the seal while keeping the same API/CLI/Web sealing/Zapier integration.

Trust path note: PDFs sealed using Publisher, without an Identity add-on, support eIDAS Advanced electronic seals (AdES) and validate in Acrobat/Reader and other PAdES-aware viewers.

Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate. No action is required on your side, and existing documents remain valid.

Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed before the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence. Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time. Documents sealed without LTV may display warnings depending on the viewer and network availability.

PDF size: No imposed limit—Publisher only receives a 256-bit digest regardless of the file size. However, the CLI and Zap process the PDF in memory within your environment, which may create de facto limits based on your system or automation constraints.

Rate limiting: None currently on API keys; we may introduce fair-use rate limits at any time to protect service stability.

We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. (Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.)

Your documents never leave your environment—we sign a cryptographic digest, not your file.

Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID)—AATL or EU Advanced—is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service.

Use our pricing calculator for an estimate or to learn more about Identity Add-on pricing.

We offer three ways to integrate:

• CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs
• REST API: Call from any language; our docs include sample requests and responses
• REST API: Call from any language; our docs include sample requests and responses
• CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs
• Web sealing: Seal PDFs directly in the browser without uploading documents to Trusted Signatures
• Zapier integration: No-code workflows; trigger sealing from tools you already use
• Cloud Connector: Keep orchestration in your Azure, AWS, GCP, or Kubernetes environment
• Power Automate: Trigger sealing from Microsoft workflows through Cloud Connector for Azure

Official SDKs: We don’t offer SDKs, and they’re not on our roadmap right now. You should use a PDF SDK (available for any number of languages) to apply the signature and DSS into your PDF, or use our CLI.

Testing/demos: You can create demo API keys against a self-signed certificate we provide so you can test your implementation without incurring usage charges; behavior mirrors production.

Audit & usage visibility: We maintain internal audit logs of sealing operations for security and billing. Once subscribed, you can access a customer-facing usage report in your account. If you need event-level exports, contact us.