Question: Can we avoid uploading documents to a vendor?

Answer: Yes, if you choose a model designed for that. Trusted Signatures emphasizes digest-only signing rather than full-document upload, and the cloud-connector paths are specifically oriented around keeping document handling in your environment.

Yes, if you choose a model designed for that. Trusted Signatures emphasizes digest-only signing rather than full-document upload, and the cloud-connector paths are specifically oriented around keeping document handling in your environment.


Question: Do we need AATL immediately?

Answer: Usually not on day one. Many teams should first validate the workflow, the verification experience, and the internal business case before moving into a more specific trust-path decision. When trust-path requirements are already clear, that should be part of the rollout conversation early.

Usually not on day one. Many teams should first validate the workflow, the verification experience, and the internal business case before moving into a more specific trust-path decision. When trust-path requirements are already clear, that should be part of the rollout convers...


Question: Do we need our own certificate?

Answer: Not always. Some teams need organization-specific identity or policy-specific trust paths, while others first need to prove the workflow and recipient experience. Start with the trust outcome you need, then decide how much certificate ownership is actually required.

Not always. Some teams need organization-specific identity or policy-specific trust paths, while others first need to prove the workflow and recipient experience. Start with the trust outcome you need, then decide how much certificate ownership is actually required.


Question: How should we evaluate recipient verification experience?

Answer: Open the finished PDF in Acrobat/Reader and review what a real recipient sees: signer identity, trust indicators, tamper status, and any warnings. A backend that looks correct to engineers but produces a confusing recipient experience is usually the wrong choice.

Open the finished PDF in Acrobat/Reader and review what a real recipient sees: signer identity, trust indicators, tamper status, and any warnings. A backend that looks correct to engineers but produces a confusing recipient experience is usually the wrong choice.


Question: Is this the same as e-signature?

Answer: No. PDF sealing focuses on document integrity, provenance, and tamper evidence. E-signature platforms focus on signer routing, approvals, and ceremony. Some workflows need both, but they are not interchangeable decisions.

No. PDF sealing focuses on document integrity, provenance, and tamper evidence. E-signature platforms focus on signer routing, approvals, and ceremony. Some workflows need both, but they are not interchangeable decisions.


Question: When should we build vs buy PDF sealing?

Answer: Build more yourself when document trust is strategic enough to justify owning the infrastructure and long-term maintenance burden. Buy when you need a working, reader-verifiable result faster and do not want PKI, timestamp, revocation, and verification behavior to become another platform responsibility.

Build more yourself when document trust is strategic enough to justify owning the infrastructure and long-term maintenance burden. Buy when you need a working, reader-verifiable result faster and do not want PKI, timestamp, revocation, and verification behavior to become anoth...


Question: Are there minimums or long-term commitments?

Answer: Not for Publisher - Trusted PDF Sealing which is pay-as-you-go - no seat licenses, no monthly service fees, and no long-term commitments. Cancel anytime. Publisher Identity Add-ons offer annual options and are non-transferable and non-refundable after issuance.

Publisher - Trusted PDF Sealing
Publisher Identity

Not for Publisher - Trusted PDF Sealing which is pay-as-you-go - no seat licenses, no monthly service fees, and no long-term commitments. Cancel anytime. Publisher Identity Add-ons offer annual options and are non-transferable and non-refundable after issuance.


Question: Are you responsible for Certificate Authority or trust-program decisions?

Answer: Certificate Authorities and trust programs (e.g., AATL, EUTL) make independent issuance/revocation and inclusion decisions. TS does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions. See Terms §7 and §15: Terms

Certificate Authorities and trust programs (e.g., AATL, EUTL) make independent issuance/revocation and inclusion decisions. TS does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions. See Terms §7 and §15...


Question: Can I define custom validation policies?

Answer: Not at this time. You can rely on the built-in behavior of PAdES-aware viewers (e.g., Adobe Acrobat/Reader) and our web-based validator for a human-readable view. If your organization requires policy enforcement (e.g., allowed CAs, timestamping/LTV rules, PAdES profiles), contact support to discuss enterprise options.

Not at this time. You can rely on the built-in behavior of PAdES-aware viewers (e.g., Adobe Acrobat/Reader) and our web-based validator for a human-readable view. If your organization requires policy enforcement (e.g., allowed CAs, timestamping/LTV rules, PAdES profiles), cont...


Question: Can I white-label this for clients?

Answer: Yes—white-label and reseller programs are available. Contact support@trusted-signatures.com.

Yes—white-label and reseller programs are available. Contact support@trusted-signatures.com.


Question: Can you help with certificate procurement?

Answer: Yes—we work with multiple CAs and will guide you to the right option.

Yes—we work with multiple CAs and will guide you to the right option.


Question: Do you comply with PCI DSS?

Answer: Yes. Trusted Signatures processes payments through Stripe, a PCI DSS Level 1–certified provider. We never store or transmit cardholder data on our own systems. Our focus is on securing your digital documents, not your payment credentials.

Yes. Trusted Signatures processes payments through Stripe, a PCI DSS Level 1–certified provider. We never store or transmit cardholder data on our own systems. Our focus is on securing your digital documents, not your payment credentials.


Question: Do you have a DPA?

Answer: Yes. Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance. Find it here: Data Processing Addendum

Yes. Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance. Find it here: Data Processing Addendum


Question: Do you have SOC 2?

Answer: Our cloud provider (AWS) maintains SOC 2 Type II and related certifications. We complement this with internal controls (MFA/RBAC, monitoring, SDLC, incident response). Summary: Trust and Security

Our cloud provider (AWS) maintains SOC 2 Type II and related certifications. We complement this with internal controls (MFA/RBAC, monitoring, SDLC, incident response). Summary: Trust and Security


Question: Do you provide a validator?

Answer: Yes. We provide a free web-based validator that checks the signature and trust data of a sealed PDF. It reviews signature metadata (certificate chain, timestamping, OCSP/CRL) and shows a human-readable result. We do not store your document or its signature metadata.

Yes. We provide a free web-based validator that checks the signature and trust data of a sealed PDF. It reviews signature metadata (certificate chain, timestamping, OCSP/CRL) and shows a human-readable result. We do not store your document or its signature metadata.


Question: Do you support HIPAA? Can you sign a BAA?

Answer: The Service is not designed to receive PHI. Customers must not send PHI in PDFs, filenames, or support materials. If required, we can execute a limited BAA covering narrowly defined operational metadata (e.g., logs, digests, certificate status), expressly excluding document content. Overview: Trust and Security Contact us for more details.

The Service is not designed to receive PHI. Customers must not send PHI in PDFs, filenames, or support materials. If required, we can execute a limited BAA covering narrowly defined operational metadata (e.g., logs, digests, certificate status), expressly excluding document co...


Question: Do you support timestamping (RFC 3161 / LTV)?

Answer: Yes. Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV). Enable --ltv in the CLI to embed timestamp and revocation data for long-term verification. Review CLI documentation

Yes. Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV). Enable --ltv in the CLI to embed timestamp and revocation data for long-term verification. Review CLI documentation


Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?

Answer: We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services. Qualified Electronic Seals (QSeal) are not available

We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services. Qualified Electronic Seals (QSeal) are not available


Question: How do I authenticate API requests?

Answer: Use your API key ID and generate an HMAC with your API key with each request as described in the API documentation (header-based authentication). The Zap and CLI do this for you automatically. Rotate API keys regularly and scope them per environment. You can limit keys so they only may be used from your network and expire up to a maximum of one year after creation.

Use your API key ID and generate an HMAC with your API key with each request as described in the API documentation (header-based authentication). The Zap and CLI do this for you automatically. Rotate API keys regularly and scope them per environment. You can limit keys so they...


Question: How do I get support?

Answer: Email or chat via Matrix, our support portal. See our support page for details.

Email or chat via Matrix, our support portal. See our support page for details.


Question: How do we report a security issue?

Answer: Email privacy@trusted-signatures.com with steps to reproduce. Legal notices: Michelle@trusted-signatures.com and Brad@trusted-signatures.com Our security posture and responsible disclosure notes: Trust and Security

Email privacy@trusted-signatures.com with steps to reproduce. Legal notices: Michelle@trusted-signatures.com and Brad@trusted-signatures.com Our security posture and responsible disclosure notes: Trust and Security


Question: How do you keep cryptographic keys secure?

Answer: We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. _(Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.)_ Your documents never leave your environment—we sign a cryptographic digest, not your file.

We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual con...


Question: How is pricing structured?

Answer: Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID)—AATL or EU Advanced—is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service. Use our pricing calculator for an estimate or to learn more about Identity Add-on pricing.

Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID)—AATL or EU Advanced—is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service. Use our pricing calculator for an estimate or to learn more about Iden...


Question: How is Publisher usage measured?

Answer: Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier. We don't count pages, signer fields, or downloads. Copying or distributing a sealed PDF doesn't affect usage. If a PDF changes and you seal the updated file, that’s a new sealing operation.

Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier. We don't count pages, signer fields, or downloads. Copying or distributing a sealed PDF doesn't affect usage. If a PDF changes and you seal the updated file, t...


Question: Is there a free demo for Publisher?

Answer: Yes. We offer a free test version of Publisher to try sealing in minutes. Just create an account and go to the Publisher page. It’s not billed, no credit card is required, and it isn't a “free trial.” You can also use these test keys to configure and test your workflow without getting charged. When you’re ready, add a payment method and continue seamlessly.

Yes. We offer a free test version of Publisher to try sealing in minutes. Just create an account and go to the Publisher page. It’s not billed, no credit card is required, and it isn't a “free trial.” You can also use these test keys to configure and test your workflow without...


Question: What about timestamping and LTV?

Answer: We support RFC 3161 timestamping and Long-Term Validation (LTV). Enabling --ltv in the CLI embeds revocation/timestamp data so documents remain verifiable even after certificate expiry.

We support RFC 3161 timestamping and Long-Term Validation (LTV). Enabling --ltv in the CLI embeds revocation/timestamp data so documents remain verifiable even after certificate expiry.


Question: What data do you retain?

Answer: Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service. Current retention windows are published in our Privacy Policy

Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service. Current retention windows are published in our Privacy Policy


Question: What encryption and key protections do you use?

Answer: TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch. Signing key material is protected by FIPS 140–validated HSMs (Level 3 where applicable). Controls: Trust and Security

TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch. Signing key material is protected by FIPS 140–validated HSMs (Level 3 where applicable). Controls: Trust and Security


Question: What happens if a certificate expires or is revoked?

Answer: Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate. No action is required on your side, and existing documents remain valid. Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed _before_ the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence. Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time. Documents sealed without LTV may display warnings depending on the viewer and network availability.

Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certifica...


Question: What if Acrobat shows a yellow warning?

Answer: A yellow triangle usually indicates missing LTV/timestamp data or an offline revocation check. Re-seal with LTV enabled or open while online so trust data can refresh.

A yellow triangle usually indicates missing LTV/timestamp data or an offline revocation check. Re-seal with LTV enabled or open while online so trust data can refresh.


Question: What integration options are available?

Answer: We offer three ways to integrate: - CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs - REST API: Call from any language; our docs include sample requests and responses - REST API: Call from any language; our docs include sample requests and responses - CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs - Web sealing: Seal PDFs directly in the browser without uploading documents to Trusted Signatures - Zapier integration: No-code workflows; trigger sealing from tools you already use - Cloud Connector: Keep orchestration in your Azure, AWS, GCP, or Kubernetes environment - Power Automate: Trigger sealing from Microsoft workflows through Cloud Connector for Azure Official SDKs: We don't offer SDKs, and they’re not on our roadmap right now. You should use a PDF SDK (available for any number of languages) to apply the signature and DSS into your PDF, or use our CLI.

We offer three ways to integrate: - CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs - REST API: Call from any language; our docs include sample requests and responses - REST API: Call from any language; our docs include sample requests...


Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID

Answer: An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader. EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority. What recipients see: - In Acrobat/Reader (and other PAdES-aware viewers), recipients see the blue certified signature indicator with _your organization_ listed as the signer. See Pricing to learn more about Identity.

An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader. EU Advanced OrgID is an annual add-on that issues your...


Question: When does billing start and how are invoices generated?

Answer: Your Publisher billing-cycle month starts on the date you add a verified payment method (your “subscriber” start date). Charges to your payment on file are issued monthly and reflect your usage in that cycle. Your Identity add-on services are billed immediately based on the length of term you selected. There are no refunds for Identity products once a certificate has been issued.

Your Publisher billing-cycle month starts on the date you add a verified payment method (your “subscriber” start date). Charges to your payment on file are issued monthly and reflect your usage in that cycle. Your Identity add-on services are billed immediately based on the le...


Question: Where can I see your subprocessors?

Answer: We maintain a live Subprocessor List with vendor purposes, regions, and safeguards. Updates to that page constitute notice under our DPA. Subprocessors

We maintain a live Subprocessor List with vendor purposes, regions, and safeguards. Updates to that page constitute notice under our DPA. Subprocessors


Question: Are you responsible for Certificate Authority or trust-program decisions?

Answer: Certificate Authorities and trust programs such as AATL and EUTL make independent issuance, revocation, and inclusion decisions. Trusted Signatures does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions. See Terms.

Certificate Authorities and trust programs such as AATL and EUTL make independent issuance, revocation, and inclusion decisions. Trusted Signatures does not control those decisions; our Terms clarify risk allocation and no refunds/credits for third-party trust-program actions....


Question: Do you comply with PCI DSS?

Answer: Yes. Trusted Signatures processes payments through Stripe, a PCI DSS Level 1-certified provider. We never store or transmit cardholder data on our own systems. Our focus is on securing your digital documents, not your payment credentials.

Yes. Trusted Signatures processes payments through Stripe, a PCI DSS Level 1-certified provider. We never store or transmit cardholder data on our own systems. Our focus is on securing your digital documents, not your payment credentials.


Question: Do you have a DPA?

Answer: Yes. Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance. Find it here: Data Processing Addendum.

Yes. Our Data Processing Addendum (DPA) defines roles, security measures, transfers (SCCs/UK addendum), and subprocessor governance. Find it here: Data Processing Addendum.


Question: Do you have SOC 2?

Answer: Our cloud provider (AWS) maintains SOC 2 Type II and related certifications. We complement this with internal controls including MFA/RBAC, monitoring, SDLC, and incident response. Summary: Trust and Security.

Our cloud provider (AWS) maintains SOC 2 Type II and related certifications. We complement this with internal controls including MFA/RBAC, monitoring, SDLC, and incident response. Summary: Trust and Security.


Question: Do you store our PDFs?

Answer: No. Trusted Signatures does not ingest or store document content or filenames. Our service operates on non-reversible SHA-256 digests and certificate status data (OCSP/CRL, timestamps). Details: Trust and Security

No. Trusted Signatures does not ingest or store document content or filenames. Our service operates on non-reversible SHA-256 digests and certificate status data (OCSP/CRL, timestamps). Details: Trust and Security


Question: Do you support HIPAA? Can you sign a BAA?

Answer: The Service is not designed to receive PHI. Customers must not send PHI in PDFs, filenames, or support materials. If required, we can execute a limited BAA covering narrowly defined operational metadata such as logs, digests, and certificate status, expressly excluding document content. Overview: Trust and Security. Contact us for more details.

The Service is not designed to receive PHI. Customers must not send PHI in PDFs, filenames, or support materials. If required, we can execute a limited BAA covering narrowly defined operational metadata such as logs, digests, and certificate status, expressly excluding documen...


Question: Does Publisher Identity - EU Advanced OrgID meet Qualified seals standards?

Answer: We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services. Qualified Electronic Seals (QSeal) are not available.

We support Advanced Electronic Seals (AdES) with Publisher and Publisher Identity - EU Advanced Org ID services. Qualified Electronic Seals (QSeal) are not available.


Question: How do we report a security issue?

Answer: Email privacy@trusted-signatures.com with steps to reproduce. Legal notices: michelle@trusted-signatures.com and brad@trusted-signatures.com. Our security posture and responsible disclosure notes are in Trust and Security.

Email privacy@trusted-signatures.com with steps to reproduce. Legal notices: michelle@trusted-signatures.com and brad@trusted-signatures.com. Our security posture and responsible disclosure notes are in Trust and Security.


Question: What data do you retain?

Answer: Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service. Current retention windows are published in our Privacy Policy.

Account/billing data, API/service logs, SHA-256 digests, and certificate/validation status data necessary to operate the Service. Current retention windows are published in our Privacy Policy.


Question: What encryption and key protections do you use?

Answer: TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch. Signing key material is protected by FIPS 140-validated HSMs (Level 3 where applicable). Controls: Trust and Security

TLS in transit; encryption at rest where applicable; SSO/MFA and RBAC for access control; audit logging via AWS CloudWatch. Signing key material is protected by FIPS 140-validated HSMs (Level 3 where applicable). Controls: Trust and Security


Question: What’s the difference between AATL OrgID and EU Advanced OrgID?

Answer: AATL OrgID uses a CA recognized on Adobe’s AATL for global Acrobat/Reader trust. EU Advanced OrgID uses an EUTL-listed provider aligned to eIDAS Advanced (AdES) for PAdES. Many recipients will see both validate in Acrobat; on-screen banners depend on the viewer’s trust store and configuration. See validation context in Trust and Security. Contact us for more details.

AATL OrgID uses a CA recognized on Adobe’s AATL for global Acrobat/Reader trust. EU Advanced OrgID uses an EUTL-listed provider aligned to eIDAS Advanced (AdES) for PAdES. Many recipients will see both validate in Acrobat; on-screen banners depend on the viewer’s trust store a...


Question: Where are you hosted?

Answer: We run on AWS U.S. (Central). See hosting and regional details here: Trust and Security.

We run on AWS U.S. (Central). See hosting and regional details here: Trust and Security.


Question: Where can I see your subprocessors?

Answer: We maintain a live Subprocessor List with vendor purposes, regions, and safeguards. Updates to that page constitute notice under our DPA. Subprocessors.

We maintain a live Subprocessor List with vendor purposes, regions, and safeguards. Updates to that page constitute notice under our DPA. Subprocessors.


Question: Can I white-label this for clients?

Answer: Yes. White-label and reseller programs are available. Contact support@trusted-signatures.com.

Yes. White-label and reseller programs are available. Contact support@trusted-signatures.com.


Question: Can you help with certificate procurement?

Answer: Yes. We work with multiple CAs and will guide you to the right option.

Yes. We work with multiple CAs and will guide you to the right option.


Question: How do I get support?

Answer: Email or chat via Matrix using our support portal. See our support page for details.

Email or chat via Matrix using our support portal. See our support page for details.


Question: How is using an Identity add-on different from Publisher - Trusted PDF Sealing?

Answer: Publisher sealing uses our default certificate (OrgID). Identity add-ons put your organization’s identity on the seal while keeping the same API/CLI/Web sealing/Zapier integration. Trust path note: PDFs sealed using Publisher, without an Identity add-on, support eIDAS Advanced electronic seals (AdES) and validate in Acrobat/Reader and other PAdES-aware viewers.

Publisher sealing uses our default certificate (OrgID). Identity add-ons put your organization’s identity on the seal while keeping the same API/CLI/Web sealing/Zapier integration. Trust path note: PDFs sealed using Publisher, without an Identity add-on, support eIDAS Advanced...


Question: What is Publisher Identity - AATL OrgID and EU Advanced OrgID

Answer: An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader. EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority. What recipients see: - In Acrobat/Reader (and other PAdES-aware viewers), recipients see the blue certified signature indicator with your organization listed as the signer. See Pricing to learn more about Identity.

An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader. EU Advanced OrgID is an annual add-on that issues your...


Question: What is Publisher — Trusted PDF Sealing?

Answer: Publisher applies an organizational cryptographic seal to your PDFs so recipients can confirm origin and detect any tampering directly in Adobe Acrobat/Reader and other PAdES-aware viewers. Your documents never leave your environment—we sign a cryptographic digest, not your file. What recipients see: - A certificate-based signature that validates in Acrobat/Reader (blue ceritified experience). - Clear signer/certificate details; optional restrictions on what can change after sealing - Document is tamper-evident with clear signer details. Built-in assurances: - PAdES-compliant sealing with Long-Term Validation (LTV) options (configurable) - RFC 3161 timestamping plus embedded OCSP/CRL data for offline verification (configurable) - Non-exportable keys protected by FIPS 140-2/140-3 Level 3 HSMs - DocMDP/Certification profiles to limit post-seal edits (e.g., form-fill only) How it fits your workflow: - Integrate via API, CLI, Web sealing, or Zapier; no uploads required and browser-based sealing keeps the PDF on the local device - Ideal for invoices, statements, reports, and any PDF that must be provably authentic outside an e-signature flow See Pricing to learn more about our pay-as-you-go, no license fees model and use an estimator to predict your costs.

Publisher applies an organizational cryptographic seal to your PDFs so recipients can confirm origin and detect any tampering directly in Adobe Acrobat/Reader and other PAdES-aware viewers. Your documents never leave your environment—we sign a cryptographic digest, not your fi...


Question: Who is Trusted Signatures?

Answer: Trusted Signatures is the document-trust layer that connects cybersecurity controls to legal rigor and financial protection. We apply PKI-based, standards-compliant PDF seals that are tamper-evident and auditable, so critical files hold up in reviews, audits, and cash-flow processes. (Built on ISO 32000 PDF signatures with DocMDP permissions, legal attestation, timestamping, OCSP/CRL, and version-comparison capabilities.) Our mission: Make verifiable documents the default for business — simple, affordable, and ubiquitous.

Trusted Signatures is the document-trust layer that connects cybersecurity controls to legal rigor and financial protection. We apply PKI-based, standards-compliant PDF seals that are tamper-evident and auditable, so critical files hold up in reviews, audits, and cash-flow pro...


Question: Can I use my own certificate?

Answer: No. Neither Adobe nor the EU permits keys generated outside our HSMs.

FAQ > Integration & Developer Experience

No. Neither Adobe nor the EU permits keys generated outside our HSMs.


Question: Do you have audit logs and a sandbox?

Answer: Testing/demos: You can create demo API keys against a self-signed certificate we provide so you can test your implementation without incurring usage charges; behavior mirrors production. Audit & usage visibility: We maintain internal audit logs of sealing operations for security and billing. Once subscribed, you can access a customer-facing usage report in your account. If you need event-level exports, contact us.

FAQ > Integration & Developer Experience

Testing/demos: You can create demo API keys against a self-signed certificate we provide so you can test your implementation without incurring usage charges; behavior mirrors production. Audit & usage visibility: We maintain internal audit logs of sealing operations for securi...


Question: Do you offer API versioning and deprecation notices?

Answer: Yes. We version the API and provide deprecation notices with advance timelines in the docs and changelog.

FAQ > Integration & Developer Experience

Yes. We version the API and provide deprecation notices with advance timelines in the docs and changelog.


Question: How do I authenticate API requests?

Answer: Use your API key ID and generate an HMAC with your API key for each request as described in the API documentation. The Zap and CLI do this for you automatically. Rotate API keys regularly and scope them per environment. You can limit keys so they may only be used from your network and expire up to a maximum of one year after creation.

FAQ > Integration & Developer Experience

Use your API key ID and generate an HMAC with your API key for each request as described in the API documentation. The Zap and CLI do this for you automatically. Rotate API keys regularly and scope them per environment. You can limit keys so they may only be used from your net...


Question: How do I get started?

Answer: Grab the API documentation, CLI documentation, and sample code to seal your first PDF in minutes. You can create a test API key to test without billing.

FAQ > Integration & Developer Experience

Grab the API documentation, CLI documentation, and sample code to seal your first PDF in minutes. You can create a test API key to test without billing.


Question: What integration options are available?

Answer: We offer six main ways to integrate: - REST API: Call from any language; our docs include sample requests and responses - CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs - Web sealing: Seal PDFs directly in the browser without uploading documents to Trusted Signatures - Zapier integration: No-code workflows; trigger sealing from tools you already use - Cloud Connector: Keep orchestration in your Azure, AWS, GCP, or Kubernetes environment - Power Automate: Trigger sealing from Microsoft workflows through Cloud Connector for Azure Official SDKs: We don't offer SDKs, and they’re not on our roadmap right now. You should use a PDF SDK (available for any number of languages) to apply the signature and DSS into your PDF, or use our CLI.

FAQ > Integration & Developer Experience

We offer six main ways to integrate: - REST API: Call from any language; our docs include sample requests and responses - CLI: Cross-platform command-line tool for sealing in scripts, CI/CD, and back-office jobs - Web sealing: Seal PDFs directly in the browser without uploadin...


Question: Where can I check service status and incident history?

Answer: Contact Support if you have questions or are experiencing a service outage.

FAQ > Integration & Developer Experience

Contact Support if you have questions or are experiencing a service outage.


Question: Are there minimums or long-term commitments?

Answer: Not for Publisher - Trusted PDF Sealing, which is pay-as-you-go with no seat licenses, no monthly service fees, and no long-term commitments. Cancel anytime. Publisher Identity add-ons offer annual options and are non-transferable and non-refundable after issuance.

Publisher - Trusted PDF Sealing
Publisher Identity

Not for Publisher - Trusted PDF Sealing, which is pay-as-you-go with no seat licenses, no monthly service fees, and no long-term commitments. Cancel anytime. Publisher Identity add-ons offer annual options and are non-transferable and non-refundable after issuance.


Question: Are there taxes or additional fees?

Answer: Applicable taxes may be added based on your billing location. The pricing calculator provides estimates and may not include taxes.

Applicable taxes may be added based on your billing location. The pricing calculator provides estimates and may not include taxes.


Question: Can I switch trust paths later?

Answer: Once a Publisher Identity OrgId (AATL or EU Advanced) is issued there is no refund. If you have multiple workflows you can add Identity services or use a single add-on with Publisher’s Trusted Signatures OrgID by creating and assigning keys. Contact Support for more.

Once a Publisher Identity OrgId (AATL or EU Advanced) is issued there is no refund. If you have multiple workflows you can add Identity services or use a single add-on with Publisher’s Trusted Signatures OrgID by creating and assigning keys. Contact Support for more.


Question: Do you offer volume discounts?

Answer: Yes. Volume tiers are applied automatically based on your Publisher usage within each billing-cycle month. Your tier resets at the start of each new cycle. We offer multi-year rate discounts for Identity products.

Yes. Volume tiers are applied automatically based on your Publisher usage within each billing-cycle month. Your tier resets at the start of each new cycle. We offer multi-year rate discounts for Identity products.


Question: How is pricing structured?

Answer: Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID), whether AATL or EU Advanced, is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service. Use our pricing calculator for an estimate or to learn more about Identity add-on pricing.

Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID), whether AATL or EU Advanced, is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service. Use our pricing calculator for an estimate or to learn more ...


Question: How is Publisher usage measured?

Answer: Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier. We do not count pages, signer fields, or downloads. Copying or distributing a sealed PDF does not affect usage. If a PDF changes and you seal the updated file, that is a new sealing operation.

Usage is measured by successful sealing operations on individual PDFs initiated via Web sealing, CLI, API, or Zapier. We do not count pages, signer fields, or downloads. Copying or distributing a sealed PDF does not affect usage. If a PDF changes and you seal the updated file,...


Question: Is there a free demo for Publisher?

Answer: Yes. We offer a free test version of Publisher to try sealing in minutes. Just create an account and go to the Publisher page. It is not billed, no credit card is required, and it is not a free trial. You can also use these test keys to configure and test your workflow without getting charged. When you are ready, add a payment method and continue seamlessly.

Yes. We offer a free test version of Publisher to try sealing in minutes. Just create an account and go to the Publisher page. It is not billed, no credit card is required, and it is not a free trial. You can also use these test keys to configure and test your workflow without...


Question: When does billing start and how are invoices generated?

Answer: Your Publisher billing-cycle month starts on the date you add a verified payment method, your subscriber start date. Charges to your payment on file are issued monthly and reflect your usage in that cycle. Identity add-on services are billed immediately based on the length of term you selected. There are no refunds for Identity products once a certificate has been issued.

Your Publisher billing-cycle month starts on the date you add a verified payment method, your subscriber start date. Charges to your payment on file are issued monthly and reflect your usage in that cycle. Identity add-on services are billed immediately based on the length of ...


Question: Are there rate limits or file size limits?

Answer: PDF size: No imposed limit—Publisher only receives a 256-bit digest regardless of the file size. However, the CLI and Zap process the PDF in memory within your environment, which may create de facto limits based on your system or automation constraints. Rate limiting: None currently on API keys; we may introduce fair-use rate limits at any time to protect service stability.

PDF size: No imposed limit—Publisher only receives a 256-bit digest regardless of the file size. However, the CLI and Zap process the PDF in memory within your environment, which may create de facto limits based on your system or automation constraints. Rate limiting: None cur...


Question: Can I integrate via API?

Answer: Yes. We offer a REST API, cross-platform CLI, Web sealing for browser-based local signing, and a Zapier integration for no-code workflows and CI/CD.

Yes. We offer a REST API, cross-platform CLI, Web sealing for browser-based local signing, and a Zapier integration for no-code workflows and CI/CD.


Question: How do you keep cryptographic keys secure?

Answer: We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. (Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.) Your documents never leave your environment—we sign a cryptographic digest, not your file.

We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual con...


Question: How does your system detect tampering?

Answer: Any byte-level change breaks the signature. Validators compare the sealed digest and embedded trust data to detect alterations instantly.

Any byte-level change breaks the signature. Validators compare the sealed digest and embedded trust data to detect alterations instantly.


Question: How many API keys can I create under a single subscription?

Answer: There is currently no limit.


Question: What about timestamping and LTV?

Answer: We support RFC 3161 timestamping and Long-Term Validation (LTV). Enabling --ltv in the CLI embeds revocation and timestamp data so documents remain verifiable even after certificate expiry.

We support RFC 3161 timestamping and Long-Term Validation (LTV). Enabling --ltv in the CLI embeds revocation and timestamp data so documents remain verifiable even after certificate expiry.


Question: What formats do you support?

Answer: PDF today. XML/JSON and other formats are on our roadmap. Contact us if you have questions about future services.

PDF today. XML/JSON and other formats are on our roadmap. Contact us if you have questions about future services.


Question: What happens if a certificate expires or is revoked?

Answer: Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate. No action is required on your side, and existing documents remain valid. Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed before the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence. Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time. Documents sealed without LTV may display warnings depending on the viewer and network availability.

Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certifica...


Question: Can I define custom validation policies?

Answer: Not at this time. You can rely on the built-in behavior of PAdES-aware viewers such as Adobe Acrobat/Reader and our web-based validator for a human-readable view. If your organization requires policy enforcement such as allowed CAs, timestamping/LTV rules, or PAdES profiles, contact support to discuss enterprise options.

Not at this time. You can rely on the built-in behavior of PAdES-aware viewers such as Adobe Acrobat/Reader and our web-based validator for a human-readable view. If your organization requires policy enforcement such as allowed CAs, timestamping/LTV rules, or PAdES profiles, c...


Question: Do you provide a validator?

Answer: Yes. We provide a free web-based validator that checks the signature and trust data of a sealed PDF. It reviews signature metadata such as the certificate chain, timestamping, and OCSP/CRL evidence, then shows a human-readable result. We do not store your document or its signature metadata.

Yes. We provide a free web-based validator that checks the signature and trust data of a sealed PDF. It reviews signature metadata such as the certificate chain, timestamping, and OCSP/CRL evidence, then shows a human-readable result. We do not store your document or its signa...


Question: Do you support timestamping (RFC 3161 / LTV)?

Answer: Yes. Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV). Enable --ltv in the CLI to embed timestamp and revocation data for long-term verification. Review the CLI documentation.

Yes. Publisher supports RFC 3161 timestamping and Long-Term Validation (LTV). Enable --ltv in the CLI to embed timestamp and revocation data for long-term verification. Review the CLI documentation.


Question: How do recipients know a document is authentic?

Answer: In Adobe Acrobat/Reader—and other PAdES-aware PDF viewers—recipients see a blue seal with your organization and trust details. You can also point them to our web-based validator for a human-readable view.

In Adobe Acrobat/Reader—and other PAdES-aware PDF viewers—recipients see a blue seal with your organization and trust details. You can also point them to our web-based validator for a human-readable view.


Question: What happens if we stop using Trusted Signatures?

Answer: Previously sealed documents remain verifiable. No change to their trust status.

Previously sealed documents remain verifiable. No change to their trust status.


Question: What if Acrobat shows a yellow warning?

Answer: A yellow triangle usually indicates missing LTV or timestamp data, or an offline revocation check. Re-seal with LTV enabled or open while online so trust data can refresh.

A yellow triangle usually indicates missing LTV or timestamp data, or an offline revocation check. Re-seal with LTV enabled or open while online so trust data can refresh.


Question: Do I need deep PDF or PKI expertise?

Answer: No. We handle the certificate, sealing profile, and verification details.

No. We handle the certificate, sealing profile, and verification details.


Question: How easy is it to integrate PDF sealing into our workflow?

Answer: Publisher integration options include API, CLI, Web sealing, Zapier, and Documenso. Verify anytime in Adobe Acrobat Reader, any PAdES-compliant PDF reader, or with our free web-based PDF Validator.

PDF Validator - Trust Made Visible
Documenso Integration

Publisher integration options include API, CLI, Web sealing, Zapier, and Documenso. Verify anytime in Adobe Acrobat Reader, any PAdES-compliant PDF reader, or with our free web-based PDF Validator.


Question: Is this an e-signature workflow tool?

Answer: No. Publisher adds a standards-based seal that shows a blue “Certified” banner in Acrobat/Reader and works alongside your existing e-signature tools to add security where you don't need signatures or it works with Documenso to enhance your workflow.

No. Publisher adds a standards-based seal that shows a blue “Certified” banner in Acrobat/Reader and works alongside your existing e-signature tools to add security where you don't need signatures or it works with Documenso to enhance your workflow.


Question: What programming languages are supported?

Answer: Any stack that can call an API or shell out to our CLI (Node.js, Python, Java,.NET, shell scripts, more). The API uses JSON over HTTPS and works with any programming language.

Any stack that can call an API or shell out to our CLI (Node.js, Python, Java,.NET, shell scripts, more). The API uses JSON over HTTPS and works with any programming language.


Question: How do you keep our document content secure?

Answer: We never see or store your PDF documents. Only SHA-256 hashes are transmitted for signing, ensuring complete document privacy. Because we never have access to them, it is impossible for us to leak your confidential documents.

Provable Trust > Software and System Design > Signing Logic

We never see or store your PDF documents. Only SHA-256 hashes are transmitted for signing, ensuring complete document privacy. Because we never have access to them, it is impossible for us to leak your confidential documents.


Question: How secure are PDF digital signatures?

Answer: Our PDF signatures use enterprise-grade HSM protection with FIPS 140-3 Level 3 compliance, the same security level used by banks and government agencies. Our focus on security from the start has made Publisher - Trusted PDf Signatures a premier product.

Provable Trust > Software and System Design > Signing Logic

Our PDF signatures use enterprise-grade HSM protection with FIPS 140-3 Level 3 compliance, the same security level used by banks and government agencies. Our focus on security from the start has made Publisher - Trusted PDf Signatures a premier product.


Question: Is this an e-signature workflow tool?

Answer: No. Publisher seals PDFs; it’s not a signer routing platform. It adds security where you don't need signatures or it works with Documenso to enhance your workflow.

Provable Trust > Software and System Design > Signing Logic

No. Publisher seals PDFs; it’s not a signer routing platform. It adds security where you don't need signatures or it works with Documenso to enhance your workflow.


Question: What compliance standards do you meet?

Answer: We meet Adobe and EU Advanced (eIDAS) standards for PDF security and X.509 certificates. This means documents sealed with Publisher are PAdES compliant.

Provable Trust > Software and System Design > Signing Logic

We meet Adobe and EU Advanced (eIDAS) standards for PDF security and X.509 certificates. This means documents sealed with Publisher are PAdES compliant.


Question: Can we bring our own certificate?

Answer: No. We manage issuance and key custody for lifecycle and security consistency.

No. We manage issuance and key custody for lifecycle and security consistency.


Question: Can we switch trust paths later?

Answer: Yes. Switching requires new certificate issuance; we coordinate transition timing.

Yes. Switching requires new certificate issuance; we coordinate transition timing.


Question: Do I need Publisher Identity if I already use Publisher sealing?

Answer: No. Publisher sealing works by itself. Add Identity when you need your organization shown as signer.

No. Publisher sealing works by itself. Add Identity when you need your organization shown as signer.


Question: How long does OrgID validation usually take?

Answer: Validation timelines vary by CA/RA requirements, trust-path selection, and documentation readiness.

Validation timelines vary by CA/RA requirements, trust-path selection, and documentation readiness.


Question: What happens if a certificate is revoked or expires?

Answer: We manage renewal and revocation handling. With LTV enabled, earlier sealed files remain verifiable based on signing-time evidence.

We manage renewal and revocation handling. With LTV enabled, earlier sealed files remain verifiable based on signing-time evidence.


Question: What’s the difference between AATL and EU Advanced OrgIDs?

Answer: AATL targets broad Adobe ecosystem trust globally. EU Advanced targets workflows that reference eIDAS/EUTL policy expectations.

AATL targets broad Adobe ecosystem trust globally. EU Advanced targets workflows that reference eIDAS/EUTL policy expectations.


Question: Can one account use multiple organization certificates?

Answer: Yes. Accounts can support multiple organization certificates and trust paths. Contact us to plan mapping for teams, brands, or subsidiaries.

Yes. Accounts can support multiple organization certificates and trust paths. Contact us to plan mapping for teams, brands, or subsidiaries.


Question: Do you offer Qualified Electronic Seal (QSeal) support?

Answer: No. Publisher Identity currently provides Advanced organizational seal paths (AATL or EU Advanced), not QSeal.

No. Publisher Identity currently provides Advanced organizational seal paths (AATL or EU Advanced), not QSeal.


Question: Does the Validator work with non-Trusted Signatures seals?

Answer: Yes. It validates any standards-based PDF signature, including those not sealed by Trusted Signatures.

Yes. It validates any standards-based PDF signature, including those not sealed by Trusted Signatures.


Question: Is it free?

Answer: Yes, our web Validator is free. If you are interested in automating validation checks in your workflows using CLI, API, Web sealing, Zapier, or Documenso integrations, contact us to learn more about our Validator roadmap.

PDF Validator - Trust Made Visible
Documenso Integration

Yes, our web Validator is free. If you are interested in automating validation checks in your workflows using CLI, API, Web sealing, Zapier, or Documenso integrations, contact us to learn more about our Validator roadmap.


Question: Is this the same as Adobe Acrobat validation?

Answer: It checks the same standards signals Acrobat/Reader use for signed PDFs (ISO 32000/PDF; PAdES behaviors). Results may vary based on local trust stores

It checks the same standards signals Acrobat/Reader use for signed PDFs (ISO 32000/PDF; PAdES behaviors). Results may vary based on local trust stores


Question: My critical documents show no signature. How can I secure my documents so I can quickly see fakes or fraud attempts?

Answer: We designed Publisher - Trusted PDF Sealing to remove the barriers most organizations have to securing documents: the expense and complication of managing certificates (organizational verifications), PKI management and security. This is the most affordable, easiest to implement solution on the market. Add Publisher Identity and your organization’s name appears in the Certified banner so your recipients can trust what you send them came from you, unaltered.

PDF Validator - Trust Made Visible
Publisher - Trusted PDF Sealing
Publisher Identity

We designed Publisher - Trusted PDF Sealing to remove the barriers most organizations have to securing documents: the expense and complication of managing certificates (organizational verifications), PKI management and security. This is the most affordable, easiest to implemen...


Question: Does the PDF leave our Azure environment?

Answer: No. The Power Automate action sends the PDF and parameters to your Cloud Connector for Azure, so the document remains inside your cloud boundary.

No. The Power Automate action sends the PDF and parameters to your Cloud Connector for Azure, so the document remains inside your cloud boundary.


Question: How is pricing structured?

Answer: Cloud Connector for Power Automate is planned alongside your Cloud Connector for Azure deployment and expected workflow volume.

Cloud Connector for Power Automate is planned alongside your Cloud Connector for Azure deployment and expected workflow volume.


Question: Is Cloud Connector for Azure required?

Answer: Yes. Cloud Connector for Power Automate is designed for customers already running the Cloud Connector for Azure inside their own environment.

Yes. Cloud Connector for Power Automate is designed for customers already running the Cloud Connector for Azure inside their own environment.


Question: What comes back to the flow?

Answer: The action returns the sealed PDF and related response metadata so later steps can store, email, or route the trusted document.

The action returns the sealed PDF and related response metadata so later steps can store, email, or route the trusted document.


Question: What does the flow pass into the connector?

Answer: Flows typically send the PDF payload plus API key material or references, certificate selection details, and sealing parameters required by your Azure deployment.

Flows typically send the PDF payload plus API key material or references, certificate selection details, and sealing parameters required by your Azure deployment.


Question: When should we use this instead of direct API integration?

Answer: Use it when business or operations teams already automate document handling in Power Automate and want sealing available as a native workflow step.

Use it when business or operations teams already automate document handling in Power Automate and want sealing available as a native workflow step.


Question: Do PDFs have to leave our environment?

Answer: No. The deployment pattern is designed so your cloud-hosted service can keep PDFs local and exchange only the sealing request data required for the signing operation.

No. The deployment pattern is designed so your cloud-hosted service can keep PDFs local and exchange only the sealing request data required for the signing operation.


Question: How do credentials and secrets work?

Answer: Use your cloud's native secret-management controls to hold API credentials and restrict access to the service that submits sealing requests.

Use your cloud's native secret-management controls to hold API credentials and restrict access to the service that submits sealing requests.


Question: How is pricing structured?

Answer: Publisher Cloud is positioned for enterprise deployments with subscription-based platform access, alongside sealing usage planning based on expected document volume.

Publisher Cloud is positioned for enterprise deployments with subscription-based platform access, alongside sealing usage planning based on expected document volume.


Question: What runs in our cloud versus Trusted Signatures?

Answer: Your orchestration component runs in your cloud account or cluster. Trusted Signatures still performs the managed sealing operation in its secure service.

Your orchestration component runs in your cloud account or cluster. Trusted Signatures still performs the managed sealing operation in its secure service.


Question: When should we choose Publisher Cloud over the standard Publisher workflows?

Answer: Choose Publisher Cloud when you need orchestration inside your own cloud boundary, have platform teams already operating cloud workloads, or need a deployment model suited for higher-volume document flows.

Choose Publisher Cloud when you need orchestration inside your own cloud boundary, have platform teams already operating cloud workloads, or need a deployment model suited for higher-volume document flows.


Question: Which platforms are supported?

Answer: Teams typically deploy with cloud functions, container services, or Kubernetes in Azure, AWS, Google Cloud, and similar enterprise environments.

Teams typically deploy with cloud functions, container services, or Kubernetes in Azure, AWS, Google Cloud, and similar enterprise environments.


Question: Can one deployment serve multiple applications or regions?

Answer: Yes. Teams commonly front multiple document-producing applications with one internal service pattern, then scale it across regions or clusters according to their own cloud architecture.

Yes. Teams commonly front multiple document-producing applications with one internal service pattern, then scale it across regions or clusters according to their own cloud architecture.


Question: Can recipients fill forms or add comments without breaking the seal?

Answer: Yes. DocMDP policies can allow form fill and annotations while still blocking unauthorized content edits.

Yes. DocMDP policies can allow form fill and annotations while still blocking unauthorized content edits.


Question: Can we bring our own certificate? How do we show our organization as the signer?

Answer: BYO certificates are not supported. To display your organization as signer in Acrobat, add Publisher Identity.

Publisher - Trusted PDF Sealing
Publisher Identity

BYO certificates are not supported. To display your organization as signer in Acrobat, add Publisher Identity.


Question: Do we have to upload files to Trusted Signatures to seal them?

Answer: No. Files stay in your environment. Publisher works in place through API, CLI, Web sealing, Zapier, Cloud Connector, or Power Automate automation.

Publisher - Trusted PDF Sealing
Cloud Connector for Power Automate

No. Files stay in your environment. Publisher works in place through API, CLI, Web sealing, Zapier, Cloud Connector, or Power Automate automation.


Question: How can we preview what sealed vs. unsealed looks like before buying?

Answer: Use the free PDF Validator to compare trust and integrity signals before rollout.

Publisher - Trusted PDF Sealing
PDF Validator - Trust Made Visible

Use the free PDF Validator to compare trust and integrity signals before rollout.


Question: How is pricing structured for Publisher and Identity?

Answer: Publisher is a usage-based subscription. Publisher Identity (AATL or EU Advanced OrgID) is an annual add-on.

Publisher - Trusted PDF Sealing
Publisher Identity

Publisher is a usage-based subscription. Publisher Identity (AATL or EU Advanced OrgID) is an annual add-on.


Question: Is this an e-signature workflow tool?

Answer: No. Publisher seals PDFs and proves integrity/origin; it is not a routing workflow for signer approvals.

No. Publisher seals PDFs and proves integrity/origin; it is not a routing workflow for signer approvals.


Question: What does Acrobat/Reader show after sealing?

Answer: In compatible trust configurations, recipients can see certified trust indicators and signer details. Unauthorized edits are flagged when validation fails.

In compatible trust configurations, recipients can see certified trust indicators and signer details. Unauthorized edits are flagged when validation fails.


Question: Where are the signing keys kept?

Answer: Keys are non-exportable and held in FIPS 140-3 Level 3 HSMs; signing operations occur inside the module.

Keys are non-exportable and held in FIPS 140-3 Level 3 HSMs; signing operations occur inside the module.


Question: Will recipients need to install anything?

Answer: No. Validation is reader-native in Adobe Acrobat/Reader and other compatible PAdES viewers.

No. Validation is reader-native in Adobe Acrobat/Reader and other compatible PAdES viewers.


Question: Will sealed PDFs validate in Adobe Acrobat/Reader and downstream systems (PAdES + LTV)?

Answer: Yes. Publisher supports ISO 32000 signatures with X.509 chain data and optional RFC 3161 + OCSP/CRL embedding for long-term validation.

Yes. Publisher supports ISO 32000 signatures with X.509 chain data and optional RFC 3161 + OCSP/CRL embedding for long-term validation.


Question: Can recipients fill forms or add comments without breaking the seal?

Answer: Yes. Configure DocMDP policy to allow forms and comments while still blocking unauthorized content edits.

Yes. Configure DocMDP policy to allow forms and comments while still blocking unauthorized content edits.


Question: How is pricing structured for Publisher and Identity?

Answer: Publisher is a usage-based subscription. Web sealing uses the same usage pricing as CLI and API sealing. Publisher Identity (AATL or EU Advanced OrgID) is an annual add-on.

Publisher - Trusted PDF Sealing
Publisher Identity

Publisher is a usage-based subscription. Web sealing uses the same usage pricing as CLI and API sealing. Publisher Identity (AATL or EU Advanced OrgID) is an annual add-on.