Security
Document Integrity
RootSign cryptographically seals every completed document using a digital signature standard (PAdES). This means:
- Tamper-evidence. Once a document is signed, any modification — even a single character — will cause standard PDF readers (Adobe Acrobat, etc.) to flag the signature as invalid.
- Self-contained proof. Each signed PDF embeds a full audit trail: every signer's name, email, IP address, and timestamp for each step in the signing process (link accessed, document viewed, consent given, signed). This travels with the file, so the proof doesn't depend on RootSign's servers.
- Document hash. A SHA-256 cryptographic hash of the original document is recorded, allowing independent verification that the content matches what was originally sent for signing.
On certificate trust: RootSign signs documents with its own certificate rather than one issued by a paid, publicly-trusted certificate authority. This means PDF readers will typically show the signature as "valid, but issuer not verified" rather than a fully green-checked trusted signature. This distinction matters only for verifying who sealed the document — it does not affect tamper-evidence. Any alteration after signing will still be detected and flagged, regardless of certificate trust status.