What wesign.now is certified for, and what it isn't.
eIDAS (EU Regulation 910/2014)
By default a signature on wesign.now is a simple electronic signature (SES). With SMS verification turned on, it is designed to meet the requirements of an advanced electronic signature (AES, eIDAS Art. 26). Under eIDAS Art. 25(1), an electronic signature may not be denied legal effect or admissibility as evidence just because it is electronic or not qualified; what it proves in a dispute is for the court to weigh. We do not issue qualified electronic signatures (QES).
ZertES (Switzerland)
The Swiss federal e-signature law. ZertES (Art. 2) defines simple, advanced, regulated and qualified electronic signatures. Ours are simple, or designed to meet the requirements of an advanced signature when SMS verification is on; with the PAdES-B seal and, when the time-stamping authority answers, an RFC 3161 time stamp, they are evidence a Swiss court weighs freely. Only a qualified electronic signature equals a handwritten one (Art. 14 para. 2bis OR), and we do not issue qualified signatures.
Signer identity: not verified
wesign.now holds no certification or accreditation for identifying people, and it does not check identity documents. A simple signature shows that whoever signed had the link sent to the email address (or phone number) the sender entered; an advanced signature adds access to the phone number that received the one-time SMS code. Neither shows who the person is: checking that is the sender's responsibility, and as far as the law allows NC Labs GmbH is not liable for impersonation or unauthorised access to an inbox or phone.
Time stamps and our seal certificate
For every completed document we request an RFC 3161 time stamp from an independent time-stamping authority: currently DigiCert, with freetsa.org as the fallback (neither is an eIDAS-qualified authority). If neither answers, the document is still sealed, without a time stamp. The seal and the time stamp show that the file has not changed and when it existed in that form; they do not show who signed it. The PAdES seal is made with our own X.509 certificate, which is self-signed, not a qualified certificate. Every certificate we have ever sealed with is published with its serial, SHA-256 fingerprint, validity and PEM in one public file, so you can compare it with the certificate in any signed PDF (in Adobe Acrobat: Signature Panel, then Certificate Details), or let the public verifier do it.
UK ECA 2000
Under section 7 of the Electronic Communications Act 2000, an electronic signature is admissible in evidence in legal proceedings on any question about the authenticity or integrity of the document it belongs to. Admissible is not the same as proven: whether the person named actually signed is for the court to decide on all the evidence. Some documents need a particular form, for example a deed that must be signed in front of a witness.
US ESIGN Act / UETA
Under the federal ESIGN Act and the state laws based on the Uniform Electronic Transactions Act (UETA, adopted in almost every state), a signature or contract may not be denied legal effect just because it is electronic. Who signed is a question of proof: under UETA a signature is attributed to a person if it was their act, which can be shown in any way. Some documents are excluded or need another form, for example wills, testamentary trusts and many family-law matters; wesign.now is not meant for them.
SOC 2 / ISO 27001
We are not currently SOC 2 Type II or ISO 27001 certified — that's a deliberate scoping decision for an early-stage product. The underlying infrastructure (Vercel + Supabase) carries SOC 2 Type II and ISO 27001 certifications, and our code follows OWASP-aligned practices. Expected certification dates will be published here when committed.
GDPR & data residency
Each workspace picks where its documents (the PDF files) are stored: the EU (default), Switzerland, the UK or the US. Account data and audit events are kept in one database. Our DPA is available on request — contact support@wesign.now.
Have a question this page didn’t answer? Email support@wesign.now — our DPA, security overview, and infosec answers are available on request.