Frequently asked questions

Two separate things happen when you sign here. First your signature image is drawn on the page — that's the part you can see, and on its own it's decoration anyone could paste. Then a PAdES cryptographic signature (ETSI EN 319 142, RSA-3072 with SHA-256) is embedded, covering every byte of the file including that image.

That second part is what matters: if anyone changes one character afterwards, a PDF reader reports the signature as broken. We test that in the failing direction on every build — sign, edit the signed file, require verification to fail.

Not yet, and we'd rather tell you than let you find out. Adobe will show the signature as present and the document as unmodified, but the signer's identity as "validity unknown".

The green tick requires the signing certificate to chain to a root in Adobe's trust list (the AATL) or the EU Trusted List. Ours is issued by a certificate authority Binteca generated itself, so no public trust store knows it. The signature and the tamper-evidence are real; the public trust chain is the part that isn't there yet. See Standards.

For most ordinary agreements, yes. The ECT Act 25 of 2002, s13(1)–(2), recognises an electronic signature where no particular form is prescribed, provided the method identifies the person and is reliable. A signature made here — with the audit trail behind it — is intended to meet that.

It is not an "advanced electronic signature" under s37. That requires a face-to-face-verified certificate from a provider accredited by the South African Accreditation Authority. Some documents are required by statute to carry one. For those, this product is not sufficient, and we will not tell you otherwise.

Structurally it is an advanced electronic signature: uniquely linked to you, created under your control, and linked to the document so later change is detectable. It is not a qualified electronic signature — that needs a qualified certificate from an EU-listed trust provider and a qualified signature-creation device. Only a qualified signature carries the automatic equivalence to a handwritten one.

No — it's the wrong kind of certificate, not merely an untrusted one. Let's Encrypt issues TLS certificates for domains (extended key usage serverAuth). A document-signing certificate certifies a person or organisation (documentSigning), after identity vetting Let's Encrypt deliberately doesn't do, from an authority on the AATL or EU list. Let's Encrypt is on neither. It does secure the connection to this site; that's a different job.

Open it in Adobe Acrobat/Reader and open the signature panel: it will say whether the document has been modified since signing. Or open the document's certificate of completion on your dashboard — it re-reads the signature from the file on disk and re-validates it while you watch, rather than repeating what our log says.

60 minutes from upload, then they are deleted — the original and the signed copy both. A background job removes them, and every page that would show a document re-checks expiry first, so an expired file is refused even in the gap between sweeps. Download what you need before the timer runs out; the workspace shows minutes remaining.

The certificate of completion: the document's SHA-256 digest before and after signing, and the audit trail — who signed, when (UTC), and from which IP address. It contains no document content. That is what makes a signature evidentially useful later without us holding your paperwork.

No. Signing happens in-process on Binteca infrastructure. Nothing is sent to a third-party signing, storage, OCR or analytics service. There are no trackers on the site. See Privacy & POPIA for the complete list of what is collected — it is short.

Yes. Delete my account and all data on the dashboard removes your account, signature images, documents and audit records — files first, then database rows. It is the POPIA s24 / GDPR art.17 right to erasure, and it is immediate and irreversible.

Because it's part of what makes the audit trail worth anything. A signature's value later is in what can be shown about the circumstances it was made in. It is disclosed on the privacy page and kept with the audit record only.

Sign on plain paper with a dark pen, photograph it, upload it under Your marks. The paper, its shadows and the lighting are removed automatically and the ink recoloured to a natural blue-black. Choose Emblem instead for a logo or stamp, which keeps its colours. Full steps in the user guide.

Yes. Drag with one finger, resize with the corner handle. It is checked at a 375px-wide viewport — an iPhone SE — with no horizontal scrolling on any page.

PDF only, up to 25 MB. Signature and emblem images can be any common image format up to 12 MB.

A document is sealed once. To sign again, upload a fresh copy. There is no multi-party signing flow today — each account signs its own uploads.

After your password is accepted, a 6-digit code is emailed to you. It is valid for 10 minutes, allows 5 attempts, and can be re-sent after 60 seconds. You can also sign in with the code alone by leaving the password blank.

Yes — upload, sign, status and download, authenticated with an API key you create on the dashboard (shown once). Send it as X-API-Key or Authorization: Bearer. Endpoints are listed in the user guide.

30 documents a month, unlimited signature marks, PAdES sealing, phone and desktop signing, and the certificate of completion. No card, no invite, nothing to cancel.

No. Nothing is billed automatically. We'll say what changes before anything is charged, and accounts created during beta keep working. Current tiers are on the pricing page.

The pricing page describes the tiers as planned. This FAQ and the user guide describe what the product does today, checked against the running code. Where they differ, the guide is the one to trust.