No, they do not. Once you create your company’s Workspace in Legito, you can start electronically signing your documents within a few minutes. Due to security reasons, users who can activate the signing process must be registered under your company’s Workspace. Individuals who will be signing documents using Legito Sign do not need Legito accounts.

Unlike Advanced Electronic Signatures (AdES), or Qualified Electronic Signatures (QES), Legito Sign doesn’t require the issuing of a certificate for each signing individual.

Biometric data are stored in ISO/IEC 19794-7 biometric interchange XML.

• The encrypted key with encrypted biometric data is combined in the following format:
  [2B] [Key] [Biometry]
• 2B – 2 bytes in network byte order (big-endian), which determine the length of RSA-encrypted key in bytes
• RSA – encrypted key
• AES – encrypted biometric data

This data is encoded into readable text using Base64.

Each biometric signature in the finalized executed PDF document is signed separately according to PDF ISO 32000, Adobe.PPKLite filter, adbe.pkcs7.detached subfilter. Each biometric signature includes a bitmap with visible Base64 and encoded biometric data in the key (Biometrics).

Yes, of course. Please, go to the People section in your Smart Document Workspace, open the User permissions settings for the particular user and check or uncheck the Can activate signing process permissions as appropriate.

The security and validity of PDF documents signed with Legito BioSign will not be affected if you stop using your Smart Document Workspace.

You always have the option to download biometrically signed PDF documents and store them elsewhere.

If a dispute over a biometric signature arises after you stop using your Legito Smart Document Workspace, the only Legito software you will need will be the decryption tool which Legito offers free of charge, along with the tool’s source codes (open source).

Legito will attach a private key to the decryption tool to allow decryption of the biometrical data.

Regulations:

Electronic signatures, are regulated as follows:

• In the EU by eIDAS – Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC.
• In the USA by the ESIGN Act – The Electronic Signatures in Global and National Commerce Act (E-Sign Act) (2000),, and UETA – The Uniform Electronic Transactions Act (1999).

The main difference between the EU and the USA is that the laws in the USA do not distinguish different types (levels) of electronic signatures. The EU law distinguishes between Electronic Signatures, Advanced Electronic Signatures (AdES) and Qualified Electronic Signatures (QES).

Similar acts have been passed around the world, making digital signatures a legal and reliable way to execute contracts and other documents. Electronic signatures are legally valid, binding, and enforceable in almost every developed country in the world.

For EU customers, according to the eIDAS regulation, Legito (as a privately held company) is classified as a non-qualified trust service provider, and Legito Sign falls under the description of (simple) electronic signatures. As per the eIDAS regulation, Legito shall take appropriate technical and organizational measures to manage the risks posed to the security of the trust services they provide. Having regard to the latest technological developments, those measures shall ensure that the level of security is commensurate to the degree of risk. In particular, measures shall be taken to prevent and minimize the impact of security incidents and inform stakeholders of the adverse effects of any such incidents. Also, Legito shall, without undue delay but in any event within 24 hours after having become aware of it, notify the supervisory body and, where applicable, other relevant bodies, such as the competent national body for information security or the data protection authority, of any breach of security or loss of integrity that has a significant impact on the trust service provided or on the personal data maintained therein.

Legito Sign can only be used in the private sector. It shouldn’t be used in any capacity with state or public authorities, including courts.

After all electronic signatures have been attached to a document, the PDF document with signatures is encrypted to ensure that neither the document nor the signatures can be altered. The executed PDF document is then automatically sent to all signatories and uploaded to the specified document record in your Workspace.

As with any other PDF file, you simply download the file from your Smart Document Workspace, and then upload to another space as needed. Such PDF files will be considered original documents, and in rare cases, could be used by a Forensic Document Examiner in a dispute over a biometrical signature.

Legito does not recommend printing / exporting / saving a biometrically signed PDF document to simple (non-biometrical) PDF.

If you haven’t created your Workspace in Legito yet, please create one.