Rethinking complex signature workflows: automated, secure and eIDAS-compliant

Depending on the type of signature, electronic signatures offer a high level of protection against forgery and tampering. In the case of advanced electronic signatures (FES) and qualified electronic signatures (QES) in particular, cryptographic methods ensure that subsequent changes to the signed document can be detected.

With sproof, signature processes are also documented through a tamper-proof audit trail. This allows important information about the signature process to be recorded in a traceable and verifiable manner.

As soon as a document is digitally signed via sproof, a cryptographic hash value is applied to its content.

• Subsequent changes: If even a single character, decimal place, or image in the PDF is changed after signing, the seal is invalidated.
• Result: Any standard validation tool (e.g., Adobe Acrobat or the free sproof Validator) immediately reports that the document has been modified and that the signature is invalid.

The Austrian Signature Act (SigG) originally established the legal framework for electronic signatures in Austria. However, it was repealed on June 30, 2016. Since July 1, 2016, electronic signatures have been governed in particular by the directly applicable eIDAS Regulation of the European Union and the Austrian Signature and Trust Services Act (SVG). The SVG supplements the European eIDAS requirements at the national level and regulates, among other things, electronic signatures, electronic seals, time stamps, and the requirements for trust services and their providers.

The European legal framework distinguishes between different levels of electronic signatures: the simple electronic signature (EES), the advanced electronic signature (FES), and the qualified electronic signature (QES). The type of signature required depends, in particular, on the specific use case and the legal or contractual requirements.

In Austria, ID Austria plays a central role in this context, as it enables secure digital identification and qualified electronic signatures. sproof has directly integrated ID Austria and also supports numerous other European eIDs for digital identification and signature processes.

An advanced electronic signature (AES) is suitable for documents with heightened liability, proof, or security requirements. It is uniquely associated with the signatory, enables the signatory’s identification, and makes any subsequent changes to the document detectable. Typical use cases include contracts, permits, personnel records, or business agreements for which a qualified electronic signature is not legally required. However, the appropriate type of signature always depends on the specific document and the applicable formal requirements. You can learn more about the differences between EES, FES, and QES in our overview of all e-signature standards.

A simple electronic signature (EES) is suitable for documents and processes involving low legal or financial risk, where there is no legal requirement for the document to be in writing. Typical examples include internal approvals, confirmations, minutes, quotes, or simple agreements. It enables quick and straightforward signing but offers only limited assurance regarding the unambiguous identification of the signatory. The appropriate type of signature should therefore always be determined based on the specific use case. You can find an overview of EES, FES, and QES in our comparison of e-signature standards.

Yes. Interested companies can try sproof sign for free for 14 days. In addition, sproof’s experts are happy to provide personalized advice and show how the platform can be optimally integrated into existing business processes. Try sproof sign now →

Many companies want to ensure that personal data is processed exclusively within the European Union and is subject to European data protection regulations. sproof processes data exclusively in the EU and relies on European infrastructure.

For many companies, the U.S. CLOUD Act is an important factor in selecting a software provider. Under certain conditions, the law may require U.S. companies or companies with ties to the U.S. to hand over data in response to a government order—regardless of whether that data is stored in the U.S. or abroad. That is why many organizations today examine not only the location where their data is stored, but also the company’s headquarters, the cloud infrastructure used, and the applicable jurisdiction. sproof relies exclusively on a European infrastructure. Data processing takes place within the European Union and is subject to European law. This helps companies meet high standards for data protection, compliance, and digital sovereignty.

Yes. DocuSign supports electronic signatures in accordance with the eIDAS Regulation. However, it is important to note that eIDAS compliance does not specify where data is processed or stored. Companies should therefore also verify in which jurisdiction their data is processed, which cloud infrastructure is used, and which data protection and compliance requirements are met. sproof supports all eIDAS-compliant signature types and processes data exclusively within the European Union on European infrastructure.

Yes. In addition to international providers, there are several European e-signature platforms. Anyone who places particular importance on data protection, digital sovereignty, and eIDAS compliance should include European solutions in their comparison. sproof is an Austrian provider that has developed its platform specifically to meet the needs of European companies.

The audit trail provides a complete, admissible-in-court history of the entire signature process. It documents when and by whom the document was viewed, approved, and signed, including the verification method used (e.g., two-factor authentication or qualified eID). This log serves as primary evidence during audits or legal disputes that the signature was properly created.

Yes. When multiple people sign a document one after another (sequential workflow), the PDF contains a history of what are known as revision states. A validation tool (e.g., sproof Validate) validates each signature individually against the state of the document that existed at the time of each signature.

Standard signatures often can no longer be validated correctly after the underlying certificate expires (usually after 2 to 3 years). sproof sign therefore consistently uses the LTV (Long-Term Validation) standard. In this process, revocation information (such as CRL or OCSP lists) is embedded directly into the document at the time of signing. This allows the validity of the signature to be verified in an audit-proof manner—even decades later—and independently of the issuer.