We check access to an inbox or a phone — not who a person is.

Email link (default — SES)

We send the signing link to the email address the sender entered (or by SMS, to the phone number they entered). Whoever opens the link can sign: they type or draw their name and sign. The signature shows that the person who signed had that link at that moment, normally because they could read that inbox. It does not show who they are. Under eIDAS and ZertES this is a simple electronic signature (SES). Use it where you already know the signer and their address.

SMS one-time code (AES)

Turn on SMS verification when sending. The signer then receives a 6-digit code by SMS at the phone number the sender entered and must enter it before they can sign (or, if the sender chooses, before the document opens). This also shows that whoever signed had access to that phone number at that moment. It is designed to meet the requirements of an advanced electronic signature (AES) under eIDAS and ZertES, but it still does not prove who held the phone: a SIM swap, a transferred number, a shared, lost or stolen phone, or malware can put the code in someone else's hands. The codes are included in your plan, within its monthly SMS allowance; there is no price per SMS.

Links you deliver, and shared links

If you copy a signing link, take it from the API or open signing inside your own website or app (embedded signing), you deliver the link, and we cannot tell who received it. On a document or form a workspace shares through a link, whoever has the link can sign, under the name and email address they enter; whether that address is confirmed depends on how the workspace set up the link.

What the audit trail records

Every signature, at either level, records: the email address recorded for the signer, the masked IP addresses used during viewing and signing, the browser's user-agent string, the signing time from our server clock, and — when an SMS code was entered — the masked phone number. Once the document is complete, we request an RFC 3161 time stamp over the signed file from an independent authority; when it answers, the time stamp is kept with our records and shown on the audit certificate. The full event log is exported as a PDF audit certificate. It records how each signer was reached and what happened through their link, not who the person was.

What the sender is responsible for

Checking who each signer is and whether they may sign (for a company, for example), with means outside wesign.now where the document needs it: a known contact, an identity document, a call-back. Choosing SES or AES for each document. Entering email addresses and phone numbers that belong to the intended signer personally, not a shared mailbox or a phone others use. Handing links you deliver yourself only to the intended signer.

• Signer identity in our terms

What the signer is responsible for

Keeping their email account and phone secure: a strong password and two-step sign-in for email, a screen lock and a SIM PIN on the phone. Not forwarding a signing link and not sharing an SMS code, because anyone who has them can sign in the signer's name. Telling the sender at once if a document shows a signature they did not make.

Impersonation and hacked accounts

As far as the law allows, NC Labs GmbH is not liable when someone other than the intended signer signs — through impersonation, unauthorised access to an email account, phone or phone number (a SIM swap, for example), a lost or stolen device, or a forwarded link or code. This applies to simple and advanced signatures and to every other signature on wesign.now. The sending workspace answers for third-party claims arising from it. Our liability for intent and gross negligence is not limited.

• The clause in our terms

Qualified signatures: not offered

We do not issue qualified electronic signatures (QES), and we do not identify signers the way a qualified trust service provider does, with an identity document or an eID. If a document needs a qualified signature, use a qualified trust service provider.