Electronic signature
One signature system for everyone you sign with.
Employees, customers and suppliers sign through the same engine, with the same evidence and the same archive. Advanced by default, qualified when the law asks for it, and still verifiable in ten years.
Who signs
Four audiences. One system behind them.
Signing did not grow out of HR and get bolted onto sales. The same sealing, the same identity checks and the same evidence trail serve every document you send out for signature.
Employees
Watched by HR
Signing is a step inside onboarding and offboarding, not a separate errand. The checklist does not advance until the document is signed, and it advances by itself when it is.
Typically
- Employment contracts
- Annexes and pay changes
- NDAs and confidentiality
- Equipment and policy acknowledgements
Customers
Watched by Sales
A customer signs from the client portal, or from a link in their inbox with no account at all. Quotes, orders and contracts are signed as the record they already are, so the signature is attached to the deal rather than to a loose PDF.
Typically
- Quotes and proposals
- Sales orders
- Service contracts
- Any PDF you upload
Suppliers
Watched by Payables
The supplier portal mirrors the customer one. Purchase orders and supplier agreements are signed against the purchasing record, and signing can be switched off per company if you do not want it offered.
Typically
- Purchase orders
- Framework agreements
- Supplier NDAs
- Onboarding paperwork
Your own signatories
Watched by Compliance
Most documents are signed twice. Your side countersigns from inside aicroo, already authenticated, with a second identity check at the moment of signing — and the document waits, visibly, until they do.
Typically
- Countersignature on contracts
- Multiple signers in order
- Delegated signing
- Anything the first party already signed
eIDAS levels
Advanced by default. Qualified when it matters.
European law recognises three levels of electronic signature, and they are not interchangeable. All three are built, and the level required is set per document rather than assumed.
Watched by
Tax Adviser
Click-to-accept, for low-stakes consents where a full identity check would be friction with no benefit.
How it works here
Recorded in the same evidence trail as every other tier.
The default. Identity is bound to the signature, the signer is in sole control, and any later change to the document is detectable.
How it works here
A fresh ECDSA P-256 key is issued for that one signature, used, and destroyed. Sole control is proven by the identity and evidence trail, not by keys left lying around.
The tier that carries the same legal weight as a handwritten signature across the EU. It needs a qualified certificate, which only a trust service provider can issue.
How it works here
The signer uses their own certificate — DNIe, FNMT or another — through AutoFirma on their machine. The certificate is then checked against the EU Trust List before the signature is accepted.
The flow
What actually happens when someone signs.
Five steps, each of which leaves something behind. The value of an electronic signature is not the image on the page — it is what you can prove about the moment it was made.
The request goes out
An email carries a single-use link. Only its fingerprint is stored — the link itself is shown once and never kept, so nobody can re-issue it from the database.
The signer proves who they are
A code to their email, or their aicroo session plus a fresh code, or their qualified certificate. Attempts are counted and the code expires on a clock.
They read it, then consent
Opening the document is itself recorded, so "I never saw it" is answerable. Consent is a separate, deliberate act — and declining is a first-class outcome, not a dead end.
The document is sealed
The PDF is signed to PAdES, timestamped by a time-stamping authority, and the proof needed to validate it later is embedded inside the file itself.
The original is kept, untouched
The unsigned file is never overwritten, and its fingerprint is taken before anything happens to it. Swapping the document after the fact does not go unnoticed.
Evidence
A trail that can be checked, not just trusted.
Every step is written to an append-only record, and each entry is chained to the one before it. Removing or altering an entry breaks the chain, and a broken chain is something the system reports rather than something you discover in a dispute.
Watched by
Compliance
What is recorded
- When the link was issued and when the email was delivered
- Every code requested, verified or failed
- The moment the document was opened
- The consent itself, as its own act
- How the signer was identified — email code, session, or certificate
- IP address, browser and country at the moment of signing
- The timestamp returned by the time-stamping authority
- Every later validation run against the file
Long-term validity
A signature that outlives its certificate.
Most electronic signatures are verifiable on the day they are made and quietly stop being verifiable later, when the certificate expires or the algorithm ages. Documents are sealed to the long-term level by default and lifted to archival as they age.
B-B
Signed
The signature and its certificate chain, inside the PDF.
B-T
Timestamped
Proof of when, from an independent authority rather than from us.
B-LT
Long-term
The default. Everything needed to validate it travels inside the file, so it still verifies after the certificate expires.
B-LTA
Archival
Timestamps re-applied over the years, so the file survives the ageing of the cryptography itself.
Employment contracts, framework agreements and NDAs are read years after they are signed — usually at the exact moment someone is disputing them.
Watched, not filed
The signature that never came back is the expensive one.
An unsigned contract does not announce itself. RR. HH. watches the whole estate on a schedule and raises what has gone quiet.
Watched by
HR
- A link that is about to expire, checked every four hours because it expires on a clock, not on a working day
- A request that expired with nobody having signed it
- A signature your own side has left waiting to be countersigned
- An internal signer who started and never finished
- A document sealed but never upgraded to long-term validity
- An archival timestamp that is overdue for renewal
- An evidence trail that no longer adds up — raised as critical, because an append-only log that turned out not to be is the one failure that matters
Guardrails
What it will not do.
The AI Crew never signs
It watches signatures and tells you what is stuck, expiring or unverifiable. It cannot request one, cannot sign one and cannot approve one on your behalf.
The portal never sees the crypto
What a customer or supplier can read is scoped to their own documents, and never includes link fingerprints, codes, storage paths or signature bytes — not in the screen, and not in the API behind it.
A signature is written once
The signature record is created by one guarded operation and cannot be created twice for the same request. There is no edit path, for anyone.
See it sign something.
The fastest way to judge a signature system is to watch one document go out, come back sealed, and then be verified in front of you.