build-vs-buy-pdf-sealing

Trusted Signatures emphasizes digest-only signing rather than full-document upload, and the cloud-connector paths are specifically oriented around keeping document handling in your environment.

Question: Can we avoid uploading documents to a vendor?


build-vs-buy-pdf-sealing

Some teams need organization-specific identity or policy-specific trust paths, while others first need to prove the workflow and recipient experience.

Question: Do we need our own certificate?


build-vs-buy-pdf-sealing

A backend that looks correct to engineers but produces a confusing recipient experience is usually the wrong choice.

Question: How should we evaluate recipient verification experience?


build-vs-buy-pdf-sealing

E-signature platforms focus on signer routing, approvals, and ceremony.

Question: Is this the same as e-signature?


build-vs-buy-pdf-sealing

PDF sealing focuses on document integrity, provenance, and tamper evidence.

Question: Is this the same as e-signature?


build-vs-buy-pdf-sealing

Some workflows need both, but they are not interchangeable decisions.

Question: Is this the same as e-signature?


Data Processing Addendum (DPA)

TS will provide reasonable assistance, proportionate to its role, with security-related obligations, DPIAs, consultations with authorities, and data-subject requests that Customer receives and directs to TS.


Data Processing Addendum (DPA)

Upon written request (no more than annually or following a material incident), TS will make available summary reports or attestations relevant to these controls (e.g., penetration test summaries).


Data Processing Addendum (DPA)

Where additional verification is needed, the parties will agree in advance on scope, timing, confidentiality, and reasonable cost recovery.


Data Processing Addendum (DPA)

Capitalized terms not defined here have the meanings in the Agreement or applicable law.


Data Processing Addendum (DPA)

Effective Date: 11/30/2025 Last Updated: 10/31/2025


Data Processing Addendum (DPA)

Trusted Signatures (“TS,” “we,” “our”) and the counterparty identified in the applicable order form (“Customer”) agree to this Data Processing Addendum (DPA), which forms part of the agreement governing Customer’s use of the Services.


Data Processing Addendum (DPA)

Customer must not send PHI in document content, filenames, content-derived metadata, or support materials.


Data Processing Addendum (DPA)

If required, TS may execute a HIPAA Business Associate Rider (Operations-Only) that covers Operational Metadata (e.g., API logs, SHA-256 digests, certificate/validation status data) and expressly excludes document content.


Data Processing Addendum (DPA)


Data Processing Addendum (DPA)

The Services are not designed to receive or store PHI.


Data Processing Addendum (DPA)

If there is conflict, the SCCs/addenda control for the transfer.


Data Processing Addendum (DPA)

Where Customer Personal Data is transferred to TS in the U.S. or another third country, the parties incorporate the appropriate Standard Contractual Clauses (EU 2021/914 C2P) and, as applicable, the UK IDTA/UK Addendum and Swiss addenda.


Data Processing Addendum (DPA)

If there is a conflict between this DPA and the Agreement, this DPA controls to the extent required by law; otherwise, the Agreement controls.


Data Processing Addendum (DPA)

The Agreement’s limitations and exclusions of liability (including ToS §15) apply to this DPA.


Data Processing Addendum (DPA)

Account/contact data; API/service logs (timestamps, IPs, user/tenant IDs, endpoint, status/latency); document-verification metadata (SHA-256 digests, certificate serials/issuer, validation outcomes); identity data provided for Publisher Identity onboarding (org details, authorized contacts, proofs).

Liability & precedence > Annex I — Processing details

Account/contact data; API/service logs (timestamps, IPs, user/tenant IDs, endpoint, status/latency); document-verification metadata (SHA-256 digests, certificate serials/issuer, validation outcomes); identity data provided for Publisher Identity onboarding (org details, author...


Data Processing Addendum (DPA)

Customer employees/contractors; Customer’s vendors/end users.


Data Processing Addendum (DPA)

Customer (entity named in the order form).


Data Processing Addendum (DPA)

Customer will not submit sensitive data unless required and lawfully justified.


Data Processing Addendum (DPA)

If unresolved in good faith, Customer may suspend the affected functionality or terminate the impacted order(s) with a pro-rata refund of prepaid, unused fees.


Data Processing Addendum (DPA)

Trusted Signatures, 4 Saint Albans Rd W, Hopkins, MN 55305.


Data Processing Addendum (DPA)

TS will post updates at /docs/subprocessors.


Data Processing Addendum (DPA)

Within 15 days of an update, Customer may reasonably object on data-protection grounds.


Data Processing Addendum (DPA)

(a) Governance: policies, least privilege, background-checked personnel.

Liability & precedence > Annex II — Security measures (summary)


Data Processing Addendum (DPA)

(b) Access control: SSO/MFA; RBAC; key rotation and secrets management.


Data Processing Addendum (DPA)

(c) Cryptography: TLS in transit; encryption at rest where applicable; keys protected by FIPS 140-validated HSMs (Level 3 where applicable).


Data Processing Addendum (DPA)

Contacts You may contact us at support@trusted-signatures.com, or for legal notices at Michelle@trusted-signatures.com and Brad@trusted-signatures.com.


Data Processing Addendum (DPA)

(d) Monitoring: centralized logs/metrics with AWS CloudWatch; alerting.


Data Processing Addendum (DPA)

(e) Systems security: hardened images, patching, change control, segmentation.


Data Processing Addendum (DPA)

(f) SDLC: code review, dependency scanning, CI secrets hygiene.


Data Processing Addendum (DPA)

(g) Vulnerability management: scanning and periodic penetration testing.


Data Processing Addendum (DPA)

(h) Incident response: runbooks, on-call, breach notification.


Data Processing Addendum (DPA)


Data Processing Addendum (DPA)

(i) Continuity: backups, redundancy, disaster-recovery objectives.


Data Processing Addendum (DPA)

(j) Vendor risk: Subprocessor due diligence; SCCs/UK addendum as needed.


Data Processing Addendum (DPA)

(k) Customer controls: API key hygiene; permission scoping; revocation tools.


Data Processing Addendum (DPA)

References • Subprocessors: https://trusted-signatures.com/docs/subprocessors/ • Privacy Policy: https://trusted-signatures.com/privacy/ • Terms of Service: https://trusted-signatures.com/terms/


Data Processing Addendum (DPA)

As provided by Customer (e.g., account contacts, API users; document-verification metadata).


Data Processing Addendum (DPA)

Data subjects may include Customer’s personnel, end users, and vendors.


Data Processing Addendum (DPA)

Operating PDF sealing/verification workflows; security, support, and billing.


Data Processing Addendum (DPA)

Processing of Customer Personal Data for the term of the Agreement and the retention windows in §8.


Data Processing Addendum (DPA)

Access is limited to a need-to-know basis.


Data Processing Addendum (DPA)

TS will ensure personnel accessing Customer Personal Data are bound by confidentiality and receive appropriate privacy/security training.


Data Processing Addendum (DPA)

TS will process Customer Personal Data only: (a) to provide, secure, and support the Services; (b) per Customer’s written instructions (including the Agreement and this DPA); or (c) as required by law (with notice to Customer unless prohibited).


Data Processing Addendum (DPA)

TS will not: (a) sell Customer Personal Data; (b) share it for cross-context behavioral advertising; (c) process it outside the business purpose of providing the Services; or (d) combine it with personal information from other sources except as permitted for security, fraud prevention, or service operations.

TS will not: (a) sell Customer Personal Data; (b) share it for cross-context behavioral advertising; (c) process it outside the business purpose of providing the Services; or (d) combine it with personal information from other sources except as permitted for security, fraud pr...


Data Processing Addendum (DPA)

At termination or upon Customer request, TS will delete or return Customer Personal Data, unless retention is required for legal, security, audit, or trust-program reasons; in that case, TS will protect the data per this DPA and delete on the next standard cycle.


Data Processing Addendum (DPA)

Typical retention windows are described in the Privacy Policy.


Data Processing Addendum (DPA)

(a) For Account, Billing, Support, and Site data, TS acts as controller/business (see our Privacy Policy).


Data Processing Addendum (DPA)

(b) For Customer-submitted technical data processed to operate the Services (e.g., API logs, SHA-256 document digests, certificate serials/issuer, validation outcomes), TS acts as processor/service provider on Customer’s documented instructions.


Data Processing Addendum (DPA)


Data Processing Addendum (DPA)

TS will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and will provide information reasonably available to assist Customer with legal notification duties and remediation.


Data Processing Addendum (DPA)

TS maintains appropriate technical and organizational measures, including: encryption in transit and at rest (where applicable); SSO/MFA; role-based access and least privilege; audit logging and monitoring (AWS CloudWatch); vulnerability management; secure SDLC; incident response; and HSM-backed key protection using FIPS 140-validated modules (Level 3 where applicable).

TS maintains appropriate technical and organizational measures, including: encryption in transit and at rest (where applicable); SSO/MFA; role-based access and least privilege; audit logging and monitoring (AWS CloudWatch); vulnerability management; secure SDLC; incident respo...


Data Processing Addendum (DPA)

Customer authorizes TS to use Subprocessors to provide the Services.


Data Processing Addendum (DPA)

Customers may object to a new Subprocessor under the process in Annex I §D.


Data Processing Addendum (DPA)

TS maintains a live list at: Subprocessors List.


Data Processing Addendum (DPA)

TS may update Subprocessors by updating that page (which constitutes notice).


Data Processing Addendum (DPA)

TS will impose data-protection obligations no less protective than those in this DPA and remains responsible to Customer for each Subprocessor’s performance of those flow-down obligations (subject to the limitations in the Agreement).


Publisher - Trusted PDF Sealing

Question: Are there minimums or long-term commitments?

Publisher - Trusted PDF Sealing
Publisher Identity


Publisher - Trusted PDF Sealing

Not for Publisher - Trusted PDF Sealing which is pay-as-you-go - no seat licenses, no monthly service fees, and no long-term commitments.

Question: Are there minimums or long-term commitments?


Publisher - Trusted PDF Sealing

Publisher Identity Add-ons offer annual options and are non-transferable and non-refundable after issuance.

Question: Are there minimums or long-term commitments?


faq

Certificate Authorities and trust programs (e.g., AATL, EUTL) make independent issuance/revocation and inclusion decisions.

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

TS does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions.

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

If your organization requires policy enforcement (e.g., allowed CAs, timestamping/LTV rules, PAdES profiles), contact support to discuss enterprise options.

Question: Can I define custom validation policies?


faq

Question: Can I define custom validation policies?


faq

You can rely on the built-in behavior of PAdES-aware viewers (e.g., Adobe Acrobat/Reader) and our web-based validator for a human-readable view.

Question: Can I define custom validation policies?


faq

Yes—white-label and reseller programs are available.

Question: Can I white-label this for clients?


faq

Yes—we work with multiple CAs and will guide you to the right option.

Question: Can you help with certificate procurement?


faq

Our focus is on securing your digital documents, not your payment credentials.

Question: Do you comply with PCI DSS?


faq

Trusted Signatures processes payments through Stripe, a PCI DSS Level 1–certified provider.

Question: Do you comply with PCI DSS?


faq

We never store or transmit cardholder data on our own systems.

Question: Do you comply with PCI DSS?


faq

Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance.

Question: Do you have a DPA?


faq

Our cloud provider (AWS) maintains SOC 2 Type II and related certifications.

Question: Do you have SOC 2?


faq

We complement this with internal controls (MFA/RBAC, monitoring, SDLC, incident response).

Question: Do you have SOC 2?


faq

It reviews signature metadata (certificate chain, timestamping, OCSP/CRL) and shows a human-readable result.

Question: Do you provide a validator?


faq

We do not store your document or its signature metadata.

Question: Do you provide a validator?


faq

We provide a free web-based validator that checks the signature and trust data of a sealed PDF.

Question: Do you provide a validator?


faq

Customers must not send PHI in PDFs, filenames, or support materials.

Question: Do you support HIPAA? Can you sign a BAA?


faq

If required, we can execute a limited BAA covering narrowly defined operational metadata (e.g., logs, digests, certificate status), expressly excluding document content.

Question: Do you support HIPAA? Can you sign a BAA?


faq

The Service is not designed to receive PHI.

Question: Do you support HIPAA? Can you sign a BAA?


faq

Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV).

Question: Do you support timestamping (RFC 3161 / LTV)?


Publisher Identity

We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services.

Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?


Publisher Identity

Qualified Electronic Seals (QSeal) are not available

Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?


faq

Rotate API keys regularly and scope them per environment.

Question: How do I authenticate API requests?


faq

The Zap and CLI do this for you automatically.

Question: How do I authenticate API requests?


faq

You can limit keys so they only may be used from your network and expire up to a maximum of one year after creation.

Question: How do I authenticate API requests?


faq

Email or chat via Matrix, our support portal.

Question: How do I get support?


faq

Question: How do I get support?


faq

Email privacy@trusted-signatures.com with steps to reproduce.

Question: How do we report a security issue?


faq

Legal notices: Michelle@trusted-signatures.com and Brad@trusted-signatures.com Our security posture and responsible disclosure notes: Trust and Security

Question: How do we report a security issue?


faq

Private keys are non-exportable and all signing occurs inside the HSM boundary.

Question: How do you keep cryptographic keys secure?


faq

Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. _(Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.)_ Your documents never leave your environment—we sign a cryptographic digest, not your file.

Question: How do you keep cryptographic keys secure?

Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. _(Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EA...


faq

We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3.

Question: How do you keep cryptographic keys secure?


faq

Identity can only be used with a Publisher service.

Question: How is pricing structured?


faq

Identity (OrgID)—AATL or EU Advanced—is an annual add-on with rate breaks for multi-year terms.

Question: How is pricing structured?


faq

Publisher (sealing) is a usage-based monthly subscription.

Question: How is pricing structured?


faq

Copying or distributing a sealed PDF doesn't affect usage.

Question: How is Publisher usage measured?


faq

If a PDF changes and you seal the updated file, that’s a new sealing operation.

Question: How is Publisher usage measured?


faq

Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier.

Question: How is Publisher usage measured?


faq

We don't count pages, signer fields, or downloads.

Question: How is Publisher usage measured?


faq

It’s not billed, no credit card is required, and it isn't a “free trial.” You can also use these test keys to configure and test your workflow without getting charged.

Question: Is there a free demo for Publisher?


faq

Just create an account and go to the Publisher page.

Question: Is there a free demo for Publisher?


faq

We offer a free test version of Publisher to try sealing in minutes.

Question: Is there a free demo for Publisher?


faq

When you’re ready, add a payment method and continue seamlessly.

Question: Is there a free demo for Publisher?


faq

Enabling --ltv in the CLI embeds revocation/timestamp data so documents remain verifiable even after certificate expiry.

Question: What about timestamping and LTV?


faq

We support RFC 3161 timestamping and Long-Term Validation (LTV).

Question: What about timestamping and LTV?


faq

Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service.

Question: What data do you retain?


faq

Current retention windows are published in our Privacy Policy

Question: What data do you retain?


faq

Question: What encryption and key protections do you use?


faq

Signing key material is protected by FIPS 140–validated HSMs (Level 3 where applicable).

Question: What encryption and key protections do you use?


faq

TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch.

Question: What encryption and key protections do you use?


faq

Documents sealed without LTV may display warnings depending on the viewer and network availability.

Question: What happens if a certificate expires or is revoked?


faq

Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded.

Question: What happens if a certificate expires or is revoked?


faq

No action is required on your side, and existing documents remain valid.

Question: What happens if a certificate expires or is revoked?


faq

Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed _before_ the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence.

Question: What happens if a certificate expires or is revoked?


faq

Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time.

Question: What happens if a certificate expires or is revoked?


faq

We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate.

Question: What happens if a certificate expires or is revoked?


faq

A yellow triangle usually indicates missing LTV/timestamp data or an offline revocation check.

Question: What if Acrobat shows a yellow warning?


faq

Re-seal with LTV enabled or open while online so trust data can refresh.

Question: What if Acrobat shows a yellow warning?


Publisher Identity

EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

What recipients see: - In Acrobat/Reader (and other PAdES-aware viewers), recipients see the blue certified signature indicator with _your organization_ listed as the signer.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

See Pricing to learn more about Identity.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


faq

Charges to your payment on file are issued monthly and reflect your usage in that cycle.

Question: When does billing start and how are invoices generated?


faq

There are no refunds for Identity products once a certificate has been issued.

Question: When does billing start and how are invoices generated?


faq

Your Identity add-on services are billed immediately based on the length of term you selected.

Question: When does billing start and how are invoices generated?


faq

Your Publisher billing-cycle month starts on the date you add a verified payment method (your “subscriber” start date).

Question: When does billing start and how are invoices generated?


faq

Question: Where can I see your subprocessors?


faq

Updates to that page constitute notice under our DPA.

Question: Where can I see your subprocessors?


faq

We maintain a live Subprocessor List with vendor purposes, regions, and safeguards.

Question: Where can I see your subprocessors?


faq

Trusted Signatures does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions.

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

Certificate Authorities and trust programs such as AATL and EUTL make independent issuance, revocation, and inclusion decisions.

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

Question: Are you responsible for Certificate Authority or trust-program decisions?


faq

Our focus is on securing your digital documents, not your payment credentials.

Question: Do you comply with PCI DSS?


faq

Trusted Signatures processes payments through Stripe, a PCI DSS Level 1-certified provider.

Question: Do you comply with PCI DSS?


faq

We never store or transmit cardholder data on our own systems.

Question: Do you comply with PCI DSS?


faq

Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance.

Question: Do you have a DPA?


faq

Our cloud provider (AWS) maintains SOC 2 Type II and related certifications.

Question: Do you have SOC 2?


faq

We complement this with internal controls including MFA/RBAC, monitoring, SDLC, and incident response.

Question: Do you have SOC 2?


faq

Question: Do you store our PDFs?


faq

Our service operates on non-reversible SHA-256 digests and certificate status data (OCSP/CRL, timestamps).

Question: Do you store our PDFs?


faq

Trusted Signatures does not ingest or store document content or filenames.

Question: Do you store our PDFs?


faq

Customers must not send PHI in PDFs, filenames, or support materials.

Question: Do you support HIPAA? Can you sign a BAA?


faq

If required, we can execute a limited BAA covering narrowly defined operational metadata such as logs, digests, and certificate status, expressly excluding document content.

Question: Do you support HIPAA? Can you sign a BAA?


faq

The Service is not designed to receive PHI.

Question: Do you support HIPAA? Can you sign a BAA?


Publisher Identity

We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services.

Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?


Publisher Identity

Qualified Electronic Seals (QSeal) are not available.

Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?


faq

Email privacy@trusted-signatures.com with steps to reproduce.

Question: How do we report a security issue?


faq

Legal notices: michelle@trusted-signatures.com and brad@trusted-signatures.com.

Question: How do we report a security issue?


faq

Our security posture and responsible disclosure notes are in Trust and Security.

Question: How do we report a security issue?


faq

Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service.

Question: What data do you retain?


faq

Current retention windows are published in our Privacy Policy.

Question: What data do you retain?


faq

Question: What encryption and key protections do you use?


faq

Signing key material is protected by FIPS 140-validated HSMs (Level 3 where applicable).

Question: What encryption and key protections do you use?


faq

TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch.

Question: What encryption and key protections do you use?


Publisher Identity

Many recipients will see both validate in Acrobat; on-screen banners depend on the viewer’s trust store and configuration.

Question: What’s the difference between AATL OrgID and EU Advanced OrgID?


Publisher Identity

EU Advanced OrgID uses an EUTL-listed provider aligned to eIDAS Advanced (AdES) for PAdES.

Question: What’s the difference between AATL OrgID and EU Advanced OrgID?


Publisher Identity

See validation context in Trust and Security.

Question: What’s the difference between AATL OrgID and EU Advanced OrgID?


Publisher Identity

AATL OrgID uses a CA recognized on Adobe’s AATL for global Acrobat/Reader trust.

Question: What’s the difference between AATL OrgID and EU Advanced OrgID?


faq

Question: Where are you hosted?


faq

See hosting and regional details here: Trust and Security.

Question: Where are you hosted?


faq

Question: Where are you hosted?


faq

Question: Where can I see your subprocessors?


faq

Updates to that page constitute notice under our DPA.

Question: Where can I see your subprocessors?


faq

We maintain a live Subprocessor List with vendor purposes, regions, and safeguards.

Question: Where can I see your subprocessors?


faq

White-label and reseller programs are available.

Question: Can I white-label this for clients?


faq

We work with multiple CAs and will guide you to the right option.

Question: Can you help with certificate procurement?


faq

Email or chat via Matrix using our support portal.

Question: How do I get support?


faq

Question: How do I get support?


Publisher - Trusted PDF Sealing

Identity add-ons put your organization’s identity on the seal while keeping the same API/CLI/Web sealing/Zapier integration.

Question: How is using an Identity add-on different from Publisher - Trusted PDF Sealing?


Publisher - Trusted PDF Sealing

Trust path note: PDFs sealed using Publisher, without an Identity add-on, support eIDAS Advanced electronic seals (AdES) and validate in Acrobat/Reader and other PAdES-aware viewers.

Question: How is using an Identity add-on different from Publisher - Trusted PDF Sealing?


Publisher - Trusted PDF Sealing

Publisher sealing uses our default certificate (OrgID).

Question: How is using an Identity add-on different from Publisher - Trusted PDF Sealing?


Publisher Identity

What recipients see: - In Acrobat/Reader (and other PAdES-aware viewers), recipients see the blue certified signature indicator with your organization listed as the signer.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

See Pricing to learn more about Identity.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher Identity

EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority.

Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID


Publisher - Trusted PDF Sealing

Publisher applies an organizational cryptographic seal to your PDFs so recipients can confirm origin and detect any tampering directly in Adobe Acrobat/Reader and other PAdES-aware viewers.

Question: What is Publisher — Trusted PDF Sealing?


Publisher - Trusted PDF Sealing

What recipients see: - A certificate-based signature that validates in Acrobat/Reader (blue ceritified experience). - Clear signer/certificate details; optional restrictions on what can change after sealing - Document is tamper-evident with clear signer details.

Question: What is Publisher — Trusted PDF Sealing?


Publisher - Trusted PDF Sealing

Your documents never leave your environment—we sign a cryptographic digest, not your file.

Question: What is Publisher — Trusted PDF Sealing?


faq

Trusted Signatures is the document-trust layer that connects cybersecurity controls to legal rigor and financial protection.

Question: Who is Trusted Signatures?


faq

We apply PKI-based, standards-compliant PDF seals that are tamper-evident and auditable, so critical files hold up in reviews, audits, and cash-flow processes.

Question: Who is Trusted Signatures?


faq

Neither Adobe nor the EU permits keys generated outside our HSMs.

Question: Can I use my own certificate?

FAQ > Integration & Developer Experience


faq

Audit & usage visibility: We maintain internal audit logs of sealing operations for security and billing.

Question: Do you have audit logs and a sandbox?


faq

If you need event-level exports, contact us.

Question: Do you have audit logs and a sandbox?


faq

Once subscribed, you can access a customer-facing usage report in your account.

Question: Do you have audit logs and a sandbox?


faq

Testing/demos: You can create demo API keys against a self-signed certificate we provide so you can test your implementation without incurring usage charges; behavior mirrors production.

Question: Do you have audit logs and a sandbox?


faq

We version the API and provide deprecation notices with advance timelines in the docs and changelog.

Question: Do you offer API versioning and deprecation notices?


faq

Rotate API keys regularly and scope them per environment.

Question: How do I authenticate API requests?


faq

The Zap and CLI do this for you automatically.

Question: How do I authenticate API requests?


faq

You can limit keys so they may only be used from your network and expire up to a maximum of one year after creation.

Question: How do I authenticate API requests?


faq

Grab the API documentation, CLI documentation, and sample code to seal your first PDF in minutes.

Question: How do I get started?


faq

You can create a test API key to test without billing.

Question: How do I get started?


Publisher - Trusted PDF Sealing

Question: Are there minimums or long-term commitments?


Publisher - Trusted PDF Sealing

Not for Publisher - Trusted PDF Sealing, which is pay-as-you-go with no seat licenses, no monthly service fees, and no long-term commitments.

Question: Are there minimums or long-term commitments?


Publisher - Trusted PDF Sealing

Publisher Identity add-ons offer annual options and are non-transferable and non-refundable after issuance.

Question: Are there minimums or long-term commitments?


faq

Applicable taxes may be added based on your billing location.

Question: Are there taxes or additional fees?


faq

The pricing calculator provides estimates and may not include taxes.

Question: Are there taxes or additional fees?


Publisher Identity

If you have multiple workflows you can add Identity services or use a single add-on with Publisher’s Trusted Signatures OrgID by creating and assigning keys.

Question: Can I switch trust paths later?


Publisher Identity

Once a Publisher Identity OrgId (AATL or EU Advanced) is issued there is no refund.

Question: Can I switch trust paths later?


faq

Volume tiers are applied automatically based on your Publisher usage within each billing-cycle month.

Question: Do you offer volume discounts?


faq

We offer multi-year rate discounts for Identity products.

Question: Do you offer volume discounts?


faq

Your tier resets at the start of each new cycle.

Question: Do you offer volume discounts?


faq

Identity can only be used with a Publisher service.

Question: How is pricing structured?


faq

Identity (OrgID), whether AATL or EU Advanced, is an annual add-on with rate breaks for multi-year terms.

Question: How is pricing structured?


faq

Publisher (sealing) is a usage-based monthly subscription.

Question: How is pricing structured?


faq

Copying or distributing a sealed PDF does not affect usage.

Question: How is Publisher usage measured?


faq

If a PDF changes and you seal the updated file, that is a new sealing operation.

Question: How is Publisher usage measured?


faq

Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier.

Question: How is Publisher usage measured?


faq

We do not count pages, signer fields, or downloads.

Question: How is Publisher usage measured?


faq

It is not billed, no credit card is required, and it is not a free trial.

Question: Is there a free demo for Publisher?


faq

Just create an account and go to the Publisher page.

Question: Is there a free demo for Publisher?


faq

We offer a free test version of Publisher to try sealing in minutes.

Question: Is there a free demo for Publisher?


faq

When you are ready, add a payment method and continue seamlessly.

Question: Is there a free demo for Publisher?


faq

You can also use these test keys to configure and test your workflow without getting charged.

Question: Is there a free demo for Publisher?


faq

Charges to your payment on file are issued monthly and reflect your usage in that cycle.

Question: When does billing start and how are invoices generated?


faq

Identity add-on services are billed immediately based on the length of term you selected.

Question: When does billing start and how are invoices generated?


faq

There are no refunds for Identity products once a certificate has been issued.

Question: When does billing start and how are invoices generated?


faq

Your Publisher billing-cycle month starts on the date you add a verified payment method, your subscriber start date.

Question: When does billing start and how are invoices generated?


faq

However, the CLI and Zap process the PDF in memory within your environment, which may create de facto limits based on your system or automation constraints.

Question: Are there rate limits or file size limits?


faq

PDF size: No imposed limit—Publisher only receives a 256-bit digest regardless of the file size.

Question: Are there rate limits or file size limits?


faq

We offer a REST API, cross-platform CLI, Web sealing for browser-based local signing, and a Zapier integration for no-code workflows and CI/CD.

Question: Can I integrate via API?


faq

Private keys are non-exportable and all signing occurs inside the HSM boundary.

Question: How do you keep cryptographic keys secure?


faq

Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored.

Question: How do you keep cryptographic keys secure?


faq

We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3.

Question: How do you keep cryptographic keys secure?


faq

(Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.) Your documents never leave your environment—we sign a cryptographic digest, not your file.

Question: How do you keep cryptographic keys secure?


PDF Validator - Trust Made Visible

Any byte-level change breaks the signature.

Question: How does your system detect tampering?


PDF Validator - Trust Made Visible

Validators compare the sealed digest and embedded trust data to detect alterations instantly.

Question: How does your system detect tampering?


faq

Question: How many API keys can I create under a single subscription?


faq

Enabling --ltv in the CLI embeds revocation and timestamp data so documents remain verifiable even after certificate expiry.

Question: What about timestamping and LTV?


faq

We support RFC 3161 timestamping and Long-Term Validation (LTV).

Question: What about timestamping and LTV?


faq

Question: What formats do you support?


faq

Documents sealed without LTV may display warnings depending on the viewer and network availability.

Question: What happens if a certificate expires or is revoked?


faq

Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded.

Question: What happens if a certificate expires or is revoked?


faq

No action is required on your side, and existing documents remain valid.

Question: What happens if a certificate expires or is revoked?


faq

Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed before the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence.

Question: What happens if a certificate expires or is revoked?


faq

Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time.

Question: What happens if a certificate expires or is revoked?


faq

We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate.

Question: What happens if a certificate expires or is revoked?


faq

If your organization requires policy enforcement such as allowed CAs, timestamping/LTV rules, or PAdES profiles, contact support to discuss enterprise options.

Question: Can I define custom validation policies?


faq

Question: Can I define custom validation policies?


faq

You can rely on the built-in behavior of PAdES-aware viewers such as Adobe Acrobat/Reader and our web-based validator for a human-readable view.

Question: Can I define custom validation policies?


faq

It reviews signature metadata such as the certificate chain, timestamping, and OCSP/CRL evidence, then shows a human-readable result.

Question: Do you provide a validator?


faq

We do not store your document or its signature metadata.

Question: Do you provide a validator?


faq

We provide a free web-based validator that checks the signature and trust data of a sealed PDF.

Question: Do you provide a validator?


faq

Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV).

Question: Do you support timestamping (RFC 3161 / LTV)?


faq

In Adobe Acrobat/Reader—and other PAdES-aware PDF viewers—recipients see a blue seal with your organization and trust details.

Question: How do recipients know a document is authentic?


faq

You can also point them to our web-based validator for a human-readable view.

Question: How do recipients know a document is authentic?


faq

Previously sealed documents remain verifiable.

Question: What happens if we stop using Trusted Signatures?


faq

A yellow triangle usually indicates missing LTV or timestamp data, or an offline revocation check.

Question: What if Acrobat shows a yellow warning?


faq

Re-seal with LTV enabled or open while online so trust data can refresh.

Question: What if Acrobat shows a yellow warning?


TS Subprocessors List

Data processed: Organization identity data (as provided by Customer for validation), certificate serials/issuer, request/response metadata.

Current Subprocessors > Certificate authority, registration authority, and trust services (Identity products)


TS Subprocessors List

EU Advanced Provider: Sectigo Limited and affiliates (CA/RA, OCSP/CRL, and RFC 3161 Time-Stamping Authority)


TS Subprocessors List

Processing location: EU/UK/US (varies by service).


TS Subprocessors List

Purpose: Organization certificate issuance, validation/revalidation, suspension/revocation; certificate status checks; trusted timestamps.


TS Subprocessors List

Safeguards: Sectigo CPS/Subscriber terms; SCCs/UK Addendum as applicable.


TS Subprocessors List

Data processed: Account/contact data, API logs, document-verification metadata (no PDFs).

Current Subprocessors > Cloud hosting & compute


TS Subprocessors List

Processing location: AWS U.S. regions (Ohio).


TS Subprocessors List


TS Subprocessors List

Purpose: Hosting of application services, databases, and storage.


TS Subprocessors List

Safeguards: ISO 27001/SOC; SCCs/UK Addendum as applicable.


TS Subprocessors List

support@trusted-signatures.com Michelle@trusted-signatures.com and Brad@trusted-signatures.com.


TS Subprocessors List

Customers may object to a new Subprocessor under the process defined in the DPA §7.4.


TS Subprocessors List

TS may add or replace Subprocessors to improve reliability, security, or functionality.


TS Subprocessors List

We will update this page to provide notice of changes.


TS Subprocessors List

Data processed: Billing contact data and transaction metadata; no full card numbers or CVV are stored by TS.

Current Subprocessors > Payment processing


TS Subprocessors List

Processing location: U.S. and global infrastructure.


TS Subprocessors List

Purpose: Payment card processing, fraud prevention, disputes/chargebacks.


TS Subprocessors List

Safeguards: PCI DSS; SCCs/UK Addendum as applicable.


TS Subprocessors List

Data Processed: Web site activity (user opt-in required)

Current Subprocessors > Public Site Analytics


TS Subprocessors List

Purpose: Public site analytics (https://trusted-signatures.com)


TS Subprocessors List

Certain providers may also act as independent controllers for their own purposes (e.g., payment processing fraud/chargebacks) or make independent trust-program decisions (e.g., CA issuance/revocation); TS is not responsible for those independent activities.


TS Subprocessors List

Subprocessors process limited personal information on TS’s behalf and are bound by data-protection and confidentiality terms.


TS Subprocessors List

This page identifies the third-party Subprocessors that Trusted Signatures (“TS”) uses to deliver the Services.


TS Subprocessors List

TS remains responsible to you for each Subprocessor’s performance of the data-protection obligations we flow down to them under our DPA (subject to the limitations in our Terms).


Trust & Security


Trust & Security

We do not ingest, store, or inspect document content or filenames.


Trust & Security

We process SHA-256 digests, timestamps, and certificate status (OCSP/CRL) required for signing/verification.


Trust & Security

2025-10-31: Initial Trust & Security page published (added HIPAA operations-only stance, AWS region, DPA/BAA/Subprocessors).


Trust & Security

Backups, redundancy, and disaster-recovery objectives for critical systems.


Trust & Security

Centralized logging and metrics via AWS CloudWatch; alerting and incident response runbooks.


Trust & Security

Code review, dependency scanning, secrets management, periodic penetration testing.


Trust & Security

Signing keys are protected by FIPS 140-3 Level 3-validated HSMs; keys are generated, stored, and used within the cryptographic boundary.


Trust & Security

SSO/MFA, role-based access (RBAC), least privilege, audited admin actions.


Trust & Security

TLS in transit; encryption at rest where applicable.


Trust & Security

Retention: security and API logs typically 12–24 months; verification metadata retained for the life of the account and a reasonable period thereafter.


Trust & Security

What we process: account/billing data, API/service logs, SHA-256 digests, certificate serials/issuer, OCSP/CRL responses, timestamp tokens.


Trust & Security

AATL (Adobe trust ecosystem) and eIDAS Advanced (AdES) for PAdES via appropriate providers/programs.

Document trust standards (validation context)


Trust & Security

ISO 32000 (PDF) and PAdES behaviors for approval vs. certification signatures, DocMDP/FieldMDP permissions, incremental updates.


Trust & Security

Viewer trust stores and configuration determine on-screen validation banners.


Trust & Security

If you believe you've found a security issue, email privacy@trusted-signatures.com with steps to reproduce.


Trust & Security

Legal notices: Michelle@trusted-signatures.com, Brad@trusted-signatures.com.


Trust & Security

Please avoid testing that could impact other users and give us reasonable time to investigate and remediate.


Trust & Security

Our cryptographic operations run inside FIPS 140-3 Level 3–validated hardware security modules (HSMs).

Security & compliance frameworks > FIPS 140-3 (cryptography).


Trust & Security

This ensures that signing keys are generated, stored, and used entirely within a tamper-resistant, validated boundary.


Trust & Security

All personal or organizational data collected for identity verification or billing is processed under GDPR lawful-use and retention principles.

Security & compliance frameworks > GDPR/CPRA (privacy).


Trust & Security


Trust & Security

Trusted Signatures is a controller for account/billing/support and a processor/service provider for limited operational data (e.g., digests, logs, certificate status).


Trust & Security

We comply with EU data-protection requirements for customer information.


Trust & Security

Because we never receive PDF content or metadata (including filenames), Publisher is safe to use with PDFs containing PHI.

Security & compliance frameworks > HIPAA/PHI (operations-only).


Trust & Security

If required, TS will execute a limited BAA covering narrowly defined operational metadata (e.g., API logs, digests, certificate status).


Trust & Security

See our HIPAA BAA Rider (Operations-Only).


Trust & Security

ISO 27001 is the international standard for managing information security.

Security & compliance frameworks > ISO 27001 (alignment).


Trust & Security

It provides a framework for how an organization protects data, controls access, and monitors risks.


Trust & Security

Trusted Signatures follows ISO 27001-aligned practices through its cloud providers and internal controls, ensuring operational security complements our product’s compliance with ISO 32000, the open standard that defines the PDF format itself.


Trust & Security

All credit-card transactions and billing data are handled securely by Stripe.

Security & compliance frameworks > PCI DSS (payments via Stripe).


Trust & Security

Trusted Signatures processes payments through Stripe, a PCI DSS Level 1–certified provider.


Trust & Security

We never store or transmit cardholder data on our own systems.


Trust & Security

Our hosting and infrastructure providers (e.g., AWS) maintain SOC 2 Type II certification for operational security, data availability, and confidentiality controls.

Security & compliance frameworks > SOC 2 (provider).


Trust & Security

Trusted Signatures inherits these assurances as part of its secure cloud deployment.


Trust & Security

Data Processing Addendum (DPA) Subprocessors HIPAA BAA Rider (Operations-Only): Available upon request Privacy Policy Terms of Service


Trust & Security

Our service operates on non-reversible SHA-256 digests and certificate status data to apply standards-based seals.


Trust & Security

Trusted Signatures ("TS") is built to minimize data exposure: we don't upload or store your PDFs.


easy

We handle the certificate, sealing profile, and verification details.

Question: Do I need deep PDF or PKI expertise?


PDF Validator - Trust Made Visible

Publisher integration options include API, CLI, Web sealing, Zapier, and Documenso.

Question: How easy is it to integrate PDF sealing into our workflow?

PDF Validator - Trust Made Visible
Documenso Integration


PDF Validator - Trust Made Visible

Verify anytime in Adobe Acrobat Reader, any PAdES-compliant PDF reader, or with our free web-based PDF Validator.

Question: How easy is it to integrate PDF sealing into our workflow?


Documenso Integration

Publisher adds a standards-based seal that shows a blue “Certified” banner in Acrobat/Reader and works alongside your existing e-signature tools to add security where you don't need signatures or it works with Documenso to enhance your workflow.

Question: Is this an e-signature workflow tool?


easy

Any stack that can call an API or shell out to our CLI (Node.js, Python, Java,.NET, shell scripts, more).

Question: What programming languages are supported?


easy

The API uses JSON over HTTPS and works with any programming language.

Question: What programming languages are supported?


secure

Because we never have access to them, it is impossible for us to leak your confidential documents.

Question: How do you keep our document content secure?

Provable Trust > Software and System Design > Signing Logic


secure

Only SHA-256 hashes are transmitted for signing, ensuring complete document privacy.

Question: How do you keep our document content secure?


secure

We never see or store your PDF documents.

Question: How do you keep our document content secure?


secure

Our focus on security from the start has made Publisher - Trusted PDf Signatures a premier product.

Question: How secure are PDF digital signatures?


secure

Our PDF signatures use enterprise-grade HSM protection with FIPS 140-3 Level 3 compliance, the same security level used by banks and government agencies.

Question: How secure are PDF digital signatures?


Documenso Integration

It adds security where you don't need signatures or it works with Documenso to enhance your workflow.

Question: Is this an e-signature workflow tool?


Documenso Integration

Publisher seals PDFs; it’s not a signer routing platform.

Question: Is this an e-signature workflow tool?


secure

This means documents sealed with Publisher are PAdES compliant.

Question: What compliance standards do you meet?


secure

We meet Adobe and EU Advanced (eIDAS) standards for PDF security and X.509 certificates.

Question: What compliance standards do you meet?


Trusted PDF sealing for every compliance level

Designed for cross-functional security/compliance review.

Choose your path > Enterprise-assisted path


Includes architecture walkthroughs, control mapping, and phased onboarding support.


Includes usage-based Publisher sealing and full docs access.


If you need your own organization shown in Acrobat trust banners, add Publisher Identity on an annual term for either AATL OrgID or EU Advanced OrgID.


One subscription, multiple paths: one Publisher subscription supports Web sealing, CLI, API, Cloud Connector, and Zapier usage.


Trusted Signatures pricing starts with usage-based Publisher sealing for teams that want to move quickly without annual platform licensing.


Web sealing pricing: browser-based sealing uses the same Publisher usage pricing as CLI and API sealing.


What you do not pay for: document upload, per-seat licensing, or a mandatory long-term contract for Publisher.


Privacy Policy

For account, billing, support, marketing, and site analytics, TS is a data controller (a “business” under U.S. state privacy laws).


Privacy Policy

For customer-submitted content and metadata processed to seal/verify PDFs (e.g., document digests), TS acts as a data processor/service provider on your instructions, per our Terms and any data processing addendum (DPA).


Privacy Policy

For payment processing, TS is the billing controller (merchant of record) deciding who is billed, for what, and when; Stripe processes payment card data on our behalf.


Privacy Policy

Stripe may also act as an independent controller for its own purposes (e.g., fraud, disputes/chargebacks, and regulatory compliance).


Privacy Policy

This Policy covers personal information we process when you visit our websites, create an account, use the Services, or interact with us.


Privacy Policy

The Services are for business use and are not directed to individuals under 18.


Privacy Policy

We do not knowingly collect personal information from children.


Privacy Policy

11. Additional disclosures for California & certain U.S. states


Privacy Policy


Privacy Policy

Categories collected align with §2; sources include you/your organization, your devices, and our service providers; purposes are in §3; disclosures are in §4.


Privacy Policy

Submit requests to privacy@trusted-signatures.com.


Privacy Policy

We act as a service provider/processor for customer content and as a business/controller for account, billing, and site interactions.


Privacy Policy

We do not sell personal information and do not share it for cross-context behavioral advertising.


Privacy Policy

You may have rights to know, delete, and correct certain personal information, and to not be discriminated against for exercising rights.


Privacy Policy

CA/RA decisions and program rules (e.g., AATL/EU trust lists) govern lifecycle outcomes.


Privacy Policy

For Publisher Identity (AATL OrgID / EU Advanced OrgID), identity data you supply is used to coordinate with CAs/RAs and related trust services for issuance, revalidation, suspension, or revocation.


Privacy Policy

If you instruct TS to attach OCSP/CRL and/or RFC 3161 timestamps, associated third-party validation metadata may be processed and retained to support verification.


Privacy Policy

TS does not upload or store your PDF documents for Publisher sealing; we may process and retain non-content document digests and verification metadata for audit and fraud-prevention.


Privacy Policy

Our websites may link to third-party sites or services.


Privacy Policy

Their privacy practices are governed by their policies.


Privacy Policy

If you do not agree, you must stop using the Services.


Privacy Policy

Material changes will be notified via the Services or by email to your account contacts and take effect on the date stated in the notice (or, if none is stated, upon posting with an updated “Last Updated” date).


Privacy Policy

We may update this Policy from time to time.


Privacy Policy

Your continued use after the effective date constitutes acceptance.


Privacy Policy

Cookies and similar technologies for essential operations, security, and analytics (see §8).


Privacy Policy

(d) Identity products (Publisher Identity).


Privacy Policy


Privacy Policy

For AATL OrgID and EU Advanced OrgID onboarding and lifecycle, we may collect organization identity data you provide (e.g., business name, addresses, registration numbers, authorized contacts, and proof documents) to coordinate with Certificate Authorities (CAs) and Registration Authorities (RAs).

For AATL OrgID and EU Advanced OrgID onboarding and lifecycle, we may collect organization identity data you provide (e.g., business name, addresses, registration numbers, authorized contacts, and proof documents) to coordinate with Certificate Authorities (CAs) and Registrati...


Privacy Policy

Messages, tickets, diagnostics, and related metadata.


Privacy Policy

Name, email address, organization name, billing contacts, subscription details, transaction metadata.


Privacy Policy

This may include your IP address, timestamps, API key identifiers, PDF digest, and requested operations.


Privacy Policy

We do not collect or store full payment card numbers or CVV; these are collected and processed by our payment provider (Stripe).


Privacy Policy

We log API requests for auditing, security, and usage tracking.


Privacy Policy

We may receive limited payment metadata (e.g., last four digits, card type, expiration month/year, tokens, transaction outcomes).


Privacy Policy

We never upload or store your PDF documents.


Privacy Policy

Where required, we process and may retain non-content metadata such as SHA-256 digests, timestamps, certificate serial numbers/issuer, validation outcomes, and signer identity fields you instruct us to apply—strictly for verification, audit, and fraud-prevention purposes.


Privacy Policy

We use information to: (a) provide, secure, and operate the Services (contract/legitimate interests); (b) authenticate and manage accounts, keys, and entitlements (contract/legitimate interests); (c) prevent abuse, fraud, and security incidents; investigate errors (legitimate interests/legal obligations); (d) issue and manage organization certificates for Identity products with CAs/RAs/TSA/OCSP/CRL services (contract/legal obligations/legitimate interests); (e) process payments and comply with tax, accounting, and regulatory requirements (legal obligations/contract); (f) provide support and communicate about updates, billing, and policy changes (contract/legal obligations); (g) improve the Services and develop features (legitimate interests); and (h) send optional product and event communications (consent where required; you may opt out).

3. How we use information (purposes & legal basis)

We use information to: (a) provide, secure, and operate the Services (contract/legitimate interests); (b) authenticate and manage accounts, keys, and entitlements (contract/legitimate interests); (c) prevent abuse, fraud, and security incidents; investigate errors (legitimate ...


Privacy Policy

A current list of core subprocessors is available on request.


Privacy Policy

(c) Trust services for signing/validation.


Privacy Policy

Cloud hosting, security/monitoring, analytics, support, and payment processing—bound by confidentiality and data-protection terms.


Privacy Policy

In a merger, acquisition, or asset transfer, in accordance with applicable law.


Privacy Policy

Stripe’s processing of payment card data is governed by its own terms and privacy notices.


Privacy Policy

To comply with laws, lawful requests, or to protect rights, safety, and the integrity of the Services.


Privacy Policy

We disclose limited information as follows: (a) Service providers/subprocessors.


Privacy Policy

We disclose necessary billing and transaction data to Stripe to process payments, prevent fraud, and handle disputes.


Privacy Policy

We do not sell or rent personal information.


Privacy Policy

Where applicable, to CAs/RAs, time-stamping authorities (TSA), and revocation/validation services (OCSP/CRL) to issue, validate, suspend, or revoke certificates and timestamps per program rules.


Privacy Policy

(a) account and billing records: up to 7 years for tax/accounting/contract compliance;


Privacy Policy

(b) security and API logs: typically 12–24 months (longer if needed for investigations, regulatory, or audit purposes);


Privacy Policy

(c) document-verification metadata (no PDFs): retained for the life of the account and a reasonable period thereafter to support audit trails and dispute resolution, unless law or program rules require a different period.


Privacy Policy

We keep personal information only as long as necessary for the purposes in this Policy or as required by law.


Privacy Policy

You may request deletion of account data; we may retain data we must keep for legal, security, or operational reasons.


Privacy Policy

API keys and sensitive metadata are stored securely with restricted access.


Privacy Policy

No system is 100% secure; we cannot guarantee absolute security.


Privacy Policy

We use industry-standard technical and organizational measures (encryption in transit/at rest where applicable, access controls, audit logging, network protections).


Privacy Policy

Depending on your location, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing.


Privacy Policy

If you are an end user of a TS customer, please direct your request to that customer; we will support them in our processor/service-provider role.


Privacy Policy

To exercise these rights, contact us at privacy@trusted-signatures.com.


Privacy Policy

You may also: (a) update account details in the dashboard or by contacting us; (b) opt out of non-essential marketing emails; (c) request a copy of personal information we hold about you; (d) where processing is based on consent, withdraw consent (this does not affect prior processing).

You may also: (a) update account details in the dashboard or by contacting us; (b) opt out of non-essential marketing emails; (c) request a copy of personal information we hold about you; (d) where processing is based on consent, withdraw consent (this does not affect prior pr...


Privacy Policy

We do not respond to “Do Not Track” signals.


Privacy Policy

We use strictly necessary cookies to operate the site and Services and may use analytics to understand usage and improve performance.


Privacy Policy

You can control cookies via browser settings; disabling cookies may affect functionality.


Privacy Policy

Privacy questions or requests: privacy@trusted-signatures.com Postal Address: Trusted Signatures, 4 Saint Albans Rd W, Hopkins, MN 55305 For legal notices, you may also contact michelle@trusted-signatures.com and brad@trusted-signatures.com


Privacy Policy

For EEA/UK/Swiss data, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) and will enter a DPA upon request.


Privacy Policy

If you access the Services from outside the U.S., you consent to transferring and processing your information in the U.S.


Privacy Policy


Privacy Policy

Capitalized terms not defined here have the meanings given in our Terms of Service.


Privacy Policy

Change summary (10/31/2025): We clarified roles (controller vs. processor), named core providers (Stripe, AWS, Sectigo, AWS CloudWatch), added retention windows, and included U.S. state privacy rights.


Privacy Policy

Effective Date: 11/30/2025 Last Updated: 10/31/2025


Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our Services.


Privacy Policy

Trusted Signatures (“Trusted Signatures,” “TS,” “we,” “our,” or “us”) is committed to protecting your privacy.


Publisher Identity

We manage issuance and key custody for lifecycle and security consistency.

Question: Can we bring our own certificate?


Publisher Identity

Switching requires new certificate issuance; we coordinate transition timing.

Question: Can we switch trust paths later?


Publisher Identity

Question: Do I need Publisher Identity if I already use Publisher sealing?


Publisher Identity

Validation timelines vary by CA/RA requirements, trust-path selection, and documentation readiness.

Question: How long does OrgID validation usually take?


Publisher Identity

We manage renewal and revocation handling.

Question: What happens if a certificate is revoked or expires?


Publisher Identity

With LTV enabled, earlier sealed files remain verifiable based on signing-time evidence.

Question: What happens if a certificate is revoked or expires?


Publisher Identity

AATL targets broad Adobe ecosystem trust globally.

Question: What’s the difference between AATL and EU Advanced OrgIDs?


Publisher Identity

EU Advanced targets workflows that reference eIDAS/EUTL policy expectations.

Question: What’s the difference between AATL and EU Advanced OrgIDs?


Publisher Identity

Accounts can support multiple organization certificates and trust paths.

Question: Can one account use multiple organization certificates?


Publisher Identity

Publisher Identity currently provides Advanced organizational seal paths (AATL or EU Advanced), not QSeal.

Question: Do you offer Qualified Electronic Seal (QSeal) support?


PDF Validator - Trust Made Visible

It validates any standards-based PDF signature, including those not sealed by Trusted Signatures.

Question: Does the Validator work with non-Trusted Signatures seals?


PDF Validator - Trust Made Visible

It checks the same standards signals Acrobat/Reader use for signed PDFs (ISO 32000/PDF; PAdES behaviors).

Question: Is this the same as Adobe Acrobat validation?


PDF Validator - Trust Made Visible

Results may vary based on local trust stores

Question: Is this the same as Adobe Acrobat validation?


PDF Validator - Trust Made Visible

We designed Publisher - Trusted PDF Sealing to remove the barriers most organizations have to securing documents: the expense and complication of managing certificates (organizational verifications), PKI management and security.

Question: My critical documents show no signature. How can I secure my documents so I can quickly see fakes or fraud attempts?

PDF Validator - Trust Made Visible
Publisher - Trusted PDF Sealing
Publisher Identity


Cloud Connector for Power Automate

The Power Automate action sends the PDF and parameters to your Cloud Connector for Azure, so the document remains inside your cloud boundary.

Question: Does the PDF leave our Azure environment?


Cloud Connector for Power Automate

Cloud Connector for Power Automate is planned alongside your Cloud Connector for Azure deployment and expected workflow volume.

Question: How is pricing structured?


Cloud Connector for Power Automate

Cloud Connector for Power Automate is designed for customers already running the Cloud Connector for Azure inside their own environment.

Question: Is Cloud Connector for Azure required?


Cloud Connector for Power Automate

The action returns the sealed PDF and related response metadata so later steps can store, email, or route the trusted document.

Question: What comes back to the flow?


Cloud Connector for Power Automate

Flows typically send the PDF payload plus API key material or references, certificate selection details, and sealing parameters required by your Azure deployment.

Question: What does the flow pass into the connector?


Publisher for Cloud Platforms

The deployment pattern is designed so your cloud-hosted service can keep PDFs local and exchange only the sealing request data required for the signing operation.

Question: Do PDFs have to leave our environment?


Publisher for Cloud Platforms

Publisher Cloud is positioned for enterprise deployments with subscription-based platform access, alongside sealing usage planning based on expected document volume.

Question: How is pricing structured?


Publisher for Cloud Platforms

Trusted Signatures still performs the managed sealing operation in its secure service.

Question: What runs in our cloud versus Trusted Signatures?


Publisher for Cloud Platforms

Your orchestration component runs in your cloud account or cluster.

Question: What runs in our cloud versus Trusted Signatures?


Publisher for Cloud Platforms

Choose Publisher Cloud when you need orchestration inside your own cloud boundary, have platform teams already operating cloud workloads, or need a deployment model suited for higher-volume document flows.

Question: When should we choose Publisher Cloud over the standard Publisher workflows?


Publisher for Cloud Platforms

Teams typically deploy with cloud functions, container services, or Kubernetes in Azure, AWS, Google Cloud, and similar enterprise environments.

Question: Which platforms are supported?


Publisher for Cloud Platforms

Teams commonly front multiple document-producing applications with one internal service pattern, then scale it across regions or clusters according to their own cloud architecture.

Question: Can one deployment serve multiple applications or regions?


Publisher - Trusted PDF Sealing

DocMDP policies can allow form fill and annotations while still blocking unauthorized content edits.

Question: Can recipients fill forms or add comments without breaking the seal?


Publisher - Trusted PDF Sealing

Question: Can we bring our own certificate? How do we show our organization as the signer?


Publisher - Trusted PDF Sealing

To display your organization as signer in Acrobat, add Publisher Identity.

Question: Can we bring our own certificate? How do we show our organization as the signer?


Publisher - Trusted PDF Sealing

Question: Do we have to upload files to Trusted Signatures to seal them?

Publisher - Trusted PDF Sealing
Cloud Connector for Power Automate


Publisher - Trusted PDF Sealing

Publisher works in place through API, CLI, Web sealing, Zapier, Cloud Connector, or Power Automate automation.

Question: Do we have to upload files to Trusted Signatures to seal them?


Publisher - Trusted PDF Sealing

Publisher is a usage-based subscription.

Question: How is pricing structured for Publisher and Identity?


Publisher - Trusted PDF Sealing

Publisher Identity (AATL or EU Advanced OrgID) is an annual add-on.

Question: How is pricing structured for Publisher and Identity?


Publisher - Trusted PDF Sealing

Publisher seals PDFs and proves integrity/origin; it is not a routing workflow for signer approvals.

Question: Is this an e-signature workflow tool?


Publisher - Trusted PDF Sealing

In compatible trust configurations, recipients can see certified trust indicators and signer details.

Question: What does Acrobat/Reader show after sealing?


Publisher - Trusted PDF Sealing

Unauthorized edits are flagged when validation fails.

Question: What does Acrobat/Reader show after sealing?


Publisher - Trusted PDF Sealing

Keys are non-exportable and held in FIPS 140-3 Level 3 HSMs; signing operations occur inside the module.

Question: Where are the signing keys kept?


Publisher - Trusted PDF Sealing

Validation is reader-native in Adobe Acrobat/Reader and other compatible PAdES viewers.

Question: Will recipients need to install anything?


Publisher - Trusted PDF Sealing

Publisher supports ISO 32000 signatures with X.509 chain data and optional RFC 3161 + OCSP/CRL embedding for long-term validation.

Question: Will sealed PDFs validate in Adobe Acrobat/Reader and downstream systems (PAdES + LTV)?


Publisher - Trusted PDF Sealing

Configure DocMDP policy to allow forms and comments while still blocking unauthorized content edits.

Question: Can recipients fill forms or add comments without breaking the seal?


Publisher - Trusted PDF Sealing

Question: How is pricing structured for Publisher and Identity?


Publisher - Trusted PDF Sealing

Question: How is pricing structured for Publisher and Identity?


Publisher - Trusted PDF Sealing

Web sealing uses the same usage pricing as CLI and API sealing.

Question: How is pricing structured for Publisher and Identity?


Terms of Service

If you do not agree, do not use the services.


Terms of Service

Maintenance windows and rate-limit adjustments may occur to ensure stability.


Terms of Service

No SLA is provided unless separately agreed.


Terms of Service

We may modify or discontinue features; for material changes, we’ll post updated Terms.


Terms of Service

Preview features may be incomplete or changed/removed at any time and are provided “as-is.”


Terms of Service

You will comply with all applicable laws, including export control and sanctions.

12. Compliance; HIPAA; export; anti-corruption


Terms of Service

You will comply with anti-bribery/anti-corruption laws.


Terms of Service

You will not use the Services in prohibited jurisdictions or for prohibited end users.


Terms of Service


Terms of Service

12.2 HIPAA; limited BAA (operational metadata only).


Terms of Service

If required, TS may execute a Business Associate Agreement (BAA) that covers only Operational Metadata processed to operate the Services (e.g., API/service logs, non-reversible document digests such as SHA-256, certificate/validation status data).


Terms of Service

In case of conflict between this §13.2 and a signed BAA, the BAA governs solely with respect to PHI in Operational Metadata within its defined scope; otherwise, these Terms apply.


Terms of Service

The BAA will expressly exclude document content (including PDFs), filenames, and content-derived metadata.


Terms of Service

The Services are not designed to receive or store PHI.


Terms of Service

You are responsible for (i) preventing PHI from being sent to the sealing endpoints or support channels; (ii) redacting PHI from diagnostics you provide; and (iii) promptly notifying TS if you believe PHI was transmitted in violation of this §13.2.


Terms of Service

You must not transmit PHI to TS in requests or content, PDF-derived metadata, or support ticket materials.


Terms of Service

Some jurisdictions do not allow certain disclaimers or limitations; to that extent, the foregoing will apply only to the fullest extent permitted by law.

14. No warranties; limitation of liability


Terms of Service

The Services are provided “as is” and “as available” to the fullest extent permitted by law.


Terms of Service

To the maximum extent permitted by law: (a) TS and its affiliates, suppliers, and service providers will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, loss of business, or loss of data, arising out of or relating to the Services, including any issuance, suspension, revocation, expiration, or invalidation of a certificate or trust-program change, even if advised of the possibility of such damages; and (b) TS’s aggregate liability for all claims relating to the Services will not exceed the amounts paid by you to TS for the Services during the twelve (12) months preceding the event giving rise to liability.

To the maximum extent permitted by law: (a) TS and its affiliates, suppliers, and service providers will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost profits, loss of business, or loss of data, arising out of or relating ...


Terms of Service

TS disclaims all warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement.


Terms of Service

Without limiting the foregoing, TS makes no guarantee regarding: (a) the legal enforceability of any signature or seal in any jurisdiction; (b) the availability, inclusion, or continued inclusion of any certificate or provider in any trust program or list; or (c) uninterrupted or error-free operation of the Services.

Without limiting the foregoing, TS makes no guarantee regarding: (a) the legal enforceability of any signature or seal in any jurisdiction; (b) the availability, inclusion, or continued inclusion of any certificate or provider in any trust program or list; or (c) uninterrupted...


Terms of Service

You will indemnify and hold TS harmless from third-party claims arising from your content, misuse of the Services, violation of laws, or misrepresentation of identity.


Terms of Service

Documents sealed prior to termination will remain valid, provided the certificate used to seal them are not revoked.


Terms of Service

Sections intended to survive (including payment obligations, confidentiality, IP, disclaimers, limitations of liability, and indemnities) will survive termination.


Terms of Service

We may suspend or terminate the Services, or your access to them, with or without notice, if we determine that: (a) you have breached these Terms or applicable CA Subscriber terms; (b) payment is overdue or your payment method fails; (c) your use poses a security, legal, compliance, or reputational risk (including suspected fraud, abuse, or credential compromise); (d) a third-party provider (including a CA, time-stamping, or revocation service) suspends, revokes, or refuses required services; (e) your use would violate export control, sanctions, or other applicable laws; or (f) continuing to provide the Services is commercially impracticable due to circumstances beyond our reasonable control.

We may suspend or terminate the Services, or your access to them, with or without notice, if we determine that: (a) you have breached these Terms or applicable CA Subscriber terms; (b) payment is overdue or your payment method fails; (c) your use poses a security, legal, compl...


Terms of Service

You may terminate at any time by closing your account.


Terms of Service

The Services may include third-party or open-source components; relevant licenses will apply as noted.


Terms of Service

TS and its licensors retain all rights in the Services.


Terms of Service

You grant TS the right to use your name and logo as a customer reference, unless you opt out via written notice.


Terms of Service

These Terms are governed by the laws of the State of Minnesota.


Terms of Service

Venue and jurisdiction lie in state or federal courts located in Hennepin County, Minnesota.


Terms of Service

2. Who we service; what we do (and don't)


Terms of Service

See §15 for warranty disclaimers and limitations.


Terms of Service

The Services are not designed to receive PHI; see §5 and §13.2.


Terms of Service

TS does not provide legal advice; you are responsible for determining the legal effect of any signature or seal in your jurisdictions.


Terms of Service

TS provides API- and CLI-based tools to apply PDF digital signatures/seals to documents that you process in your own environment.


Terms of Service

Validation results depend on the recipient’s PDF viewer trust configuration and on PDF features such as certification signatures (DocMDP), legal attestations, and incremental updates, which can affect how changes are flagged or permitted.


Terms of Service

We do not offer legal advice, notarial services, or consumer e-signature workflows.


Terms of Service


Terms of Service

We may provide notices via email to your account contacts or via the Service.


Terms of Service

You may contact us at support@trusted-signatures.com, or for legal notices at Michelle@trusted-signatures.com and Brad@trusted-signatures.com.


Terms of Service

If any provision is unenforceable, the remainder stays in effect.


Terms of Service

These Terms are the entire agreement regarding the Services.


Terms of Service

You may not assign these Terms without our consent; we may assign to an affiliate or in connection with a merger or sale.


Terms of Service

Changes will not apply retroactively unless required by law or expressly stated.


Terms of Service

If you do not agree, you must stop using the Services.


Terms of Service

Material changes will be notified via the Services or by email to your account contacts and will be effective on the date stated in the notice (or, if no date is stated, upon posting with an updated “Effective Date”).


Terms of Service

We may update these Terms from time to time.


Terms of Service

Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Terms.


Terms of Service

Test keys are for evaluation and may use self-signed or test certificates; they are not appropriate for production due to lower assurance.


Terms of Service

You are responsible for credential hygiene, including (a) key rotation, (b) secure storage, and (c) immediate revocation on suspected compromise.


Terms of Service

You are responsible for key confidentiality, rotation, and all activity under your account.


Terms of Service

You must be 18+ years of age and create an account to obtain API keys.


Terms of Service

Applies an organizational-verification (OV) seal to PDFs designed for Adobe-compatible validation in Acrobat/Reader.


Terms of Service

Publisher can attach revocation data (OCSP/CRL) and trusted timestamps (e.g., RFC 3161) and enable long-term validation (LTV), and may set certification (DocMDP) permissions to allow or restrict post-seal changes (e.g., form-fill or additional signatures) without breaking trust.


Terms of Service

Publisher does not by itself confer inclusion in any third-party trust program.


Terms of Service


Terms of Service

TS does not control recipient software behavior.


Terms of Service

Validation indicators shown to recipients (e.g., “Certified by …”) are determined by the viewer’s trust store and settings.


Terms of Service

AATL recognition depends on third-party trust-program rules and the recipient’s viewer configuration.


Terms of Service

Customer must complete CA/RA validation, keep organization information current, and comply with the CA’s Subscriber Agreement and CPS.


Terms of Service

Issuance, suspension, and revocation decisions are made by the CA and may affect downstream validation.


Terms of Service

Provides issuance and lifecycle management of organization-validated (OV) document signing certificates through a Certificate Authority (CA) recognized within the Adobe Approved Trust List (AATL) ecosystem, for use with Publisher sealing.


Terms of Service

TS does not guarantee inclusion or continued inclusion in any trust list.


Terms of Service

4.3 Publisher Identity — EU Advanced OrgID


Terms of Service

Provider decisions (issuance, suspension, revocation) may impact validation; TS does not control those decisions.


Terms of Service

Provides issuance through a Certificate Authority (CA) and lifecycle management of organization-validated (OV) certificates recognized within EU “Advanced” trust paths (i.e., via EUTL-listed providers) for use with Publisher sealing.


Terms of Service

Qualified (QES) certificates are not available.


Terms of Service

Trust recognition depends on the relevant EU trust framework and recipient configuration.


Terms of Service

TS implements industry-standard PDF signing constructs consistent with ISO 32000 (PDF) and PAdES behaviors, including approval vs. certification signatures, DocMDP/FieldMDP permission dictionaries, inclusion of OCSP/CRL revocation data and RFC 3161 timestamps where available, and support for incremental updates and LTV to the extent supported by the chosen certificate, timestamp, and recipient software.

TS implements industry-standard PDF signing constructs consistent with ISO 32000 (PDF) and PAdES behaviors, including approval vs. certification signatures, DocMDP/FieldMDP permission dictionaries, inclusion of OCSP/CRL revocation data and RFC 3161 timestamps where available, ...


Terms of Service

Accurate identity & key stewardship (Identity products).

4.5 Dependencies, Disclaimers, and Customer Responsibilities


Terms of Service

Availability, inclusion in trust programs (e.g., AATL, EU trust lists), and validation banners are outside TS’s control.


Terms of Service

Because validation depends on recipient software and trust stores, indicators and permissions enforcement (e.g., for DocMDP) may vary by viewer and configuration.


Terms of Service

Certificates, timestamps, and revocation information are provided by third parties.


Terms of Service

Customer must provide accurate organization data, respond to CA/RA requests, protect credentials/keys, and request revocation if data becomes inaccurate or credentials are compromised.


Terms of Service


Terms of Service

Validation outcomes depend on recipient trust settings and applicable standards behavior (e.g., certification signatures, DocMDP/FieldMDP permissions, legal attestations, and incremental updates).


Terms of Service

If you choose optional hosted features now or later, we will process only what is necessary and minimize retention.


Terms of Service

Neither the customer, TS, nor our vendors can access the private keys associated with those certificates, even through direct access to the physical hardware in which the keys are stored.


Terms of Service

The Services are not designed to receive or store protected health information (PHI).


Terms of Service

TS does not require uploads of your PDFs to provide Publisher sealing.


Terms of Service

TS may process limited operational metadata (e.g., API/service logs, document digests such as SHA-256, certificate serials/issuer, validation outcomes) necessary to operate the Services; such processing does not include document content.


Terms of Service

With respect to our Publisher Identity products, TS will create and maintain the private keys for customer OV certificates inside Hardware Security Modules (HSMs).


Terms of Service

You must not transmit PHI to TS in: (a) PDFs or other document content; (b) content-derived metadata; (c) support tickets or attachments; or (d) free-form request fields.


Terms of Service

You represent and warrant that you (a) have all rights and permissions to process, sign, and/or seal the documents you submit; and (b) will comply with all applicable laws.


Terms of Service

You will not: (a) use the Services for any unlawful, deceptive, or fraudulent purpose; (b) interfere with, disrupt, or reverse-engineer the Services; (c) disclose or permit use of API keys outside your organization; (d) misrepresent your or any organization’s identity; or(e) exceed rate limits or otherwise abuse shared resources; (f) transmit or include PHI in sealing requests, filenames, or support communications, except for limited operational metadata processed by TS solely to operate the Services as described in §13.2.

You will not: (a) use the Services for any unlawful, deceptive, or fraudulent purpose; (b) interfere with, disrupt, or reverse-engineer the Services; (c) disclose or permit use of API keys outside your organization; (d) misrepresent your or any organization’s identity; or(e) e...


Terms of Service

CA operations, issuance criteria, audits, and lifecycle decisions (issuance, suspension, revocation) are governed by the CA’s Certification Practice Statement and Subscriber Agreement, which are incorporated by reference.

7.1 Third-party providers; policy control


Terms of Service

Trusted Signatures (“TS”) uses third-party Certificate Authorities (CAs) and related trust services (e.g., OCSP/CRL revocation, RFC 3161 time-stamping).


Terms of Service

Inclusion in trust programs (e.g., Adobe trust ecosystem/AATL, EU trust lists) and any addition or removal from such lists are outside TS’s control.


Terms of Service

Validation indicators (e.g., “Certified by …”, warnings) depend on recipient software, local trust stores, and configuration; outcomes may vary across viewers.


Terms of Service

You are responsible for (a) monitoring the status and suitability of any certificate you use; (b) providing accurate organization data and completing CA/RA validation; (c) keeping contacts current; (d) complying with applicable CA Subscriber terms; and (e) promptly requesting revocation and ceasing use if certificate data becomes inaccurate, is suspected compromised, or validation requirements change; and (f) determining whether your intended use of digital signatures/seals satisfies applicable legal or regulatory requirements in the jurisdictions where you operate or send documents.

You are responsible for (a) monitoring the status and suitability of any certificate you use; (b) providing accurate organization data and completing CA/RA validation; (c) keeping contacts current; (d) complying with applicable CA Subscriber terms; and (e) promptly requesting ...


Terms of Service

If a certificate expires, is suspended, is revoked, or becomes otherwise invalid (including due to trust-list changes), the Services may fail to produce a verifiable signature for recipients, or previously sealed PDFs may validate differently over time (e.g., loss of LTV if revocation/timestamp data cannot be refreshed).

If a certificate expires, is suspended, is revoked, or becomes otherwise invalid (including due to trust-list changes), the Services may fail to produce a verifiable signature for recipients, or previously sealed PDFs may validate differently over time (e.g., loss of LTV if re...


Terms of Service

TS is not responsible for such outcomes.


Terms of Service

Refunds or credits are not provided for Certificate Authority or trust-program actions (including issuance delays, suspensions, revocations, removals, or policy changes), viewer/trust-store variance, or other third-party decisions or events that affect validation, and are separate from the limitations in §15.

Refunds or credits are not provided for Certificate Authority or trust-program actions (including issuance delays, suspensions, revocations, removals, or policy changes), viewer/trust-store variance, or other third-party decisions or events that affect validation, and are sepa...


Terms of Service

Do not include PHI in sealing requests or support materials; see §13.2.

7.6 Mitigation guidance (non-contractual)


Terms of Service

To reduce disruption, (i) maintain current contacts with the CA, (ii) monitor certificate status, (iii) maintain and test key-compromise procedures, and (iv) include OCSP/CRL data and RFC 3161 timestamps to support long-term validation where available.


Terms of Service

7.7 Additional duties for Publisher Identity (AATL OrgID / EU Advanced OrgID)


Terms of Service

Maintain current, accurate organization information and authorized contacts with the CA/RA; (b) Validation cooperation.


Terms of Service

Promptly request revocation and cease use if credential compromise is suspected or organization data becomes inaccurate.


Terms of Service

Qualified Electronic Signature (QES) certificates are not provided.


Terms of Service

Respond promptly to CA/RA challenges and provide required evidence for issuance or revalidation; (c) Use restrictions.


Terms of Service

The following duties apply when you purchase Identity products and are in addition to this Section 7: (a) Accurate information & contacts.


Terms of Service

You acknowledge that issuance, suspension, and revocation decisions are made by the CA/RA and may affect downstream validation; TS is not responsible for those decisions; and (f) Scope note.


Terms of Service

Certification signatures can enforce DocMDP permissions (e.g., “no changes,” “form-fill & signatures,” etc.) and legal content attestations; incremental updates allow additional signatures without invalidating earlier ones.

8. Validation variance & standards notice


Terms of Service

Different viewers may surface these checks differently depending on their trust configuration.


Terms of Service

PDF supports approval and certification signatures.


Terms of Service

Late or failed payments may result in suspension.


Terms of Service

Usage is billed via your on-file payment method under your plan.


Terms of Service

You authorize us (and our processor) to charge fees and applicable taxes.


Terms of Service

By using our services, you agree to these terms.


Terms of Service

Change summary (10/31/2025): We clarified certificate/trust-program rules (including no refunds for CA/trust-list actions), expanded customer security/legal-use responsibilities, refined termination triggers, and standardized warranty/limitation terms.


Terms of Service


Terms of Service

Welcome to Trusted Signatures ("TS","we","our").