eSignPh
Verify Document
Trust & Technical Standards • Version 2026.1

Security & Legal Compliance

eSignPh is engineered with a defense-in-depth architecture that pairs cryptographic data integrity with legal enforceability. Explore how our platform protects documents, verifies signatures, and adheres to statutory regulations.

Cryptographic Seal

Dual SHA-256 hashes and digital signature service seals verify that the executed file is untouched.

Legal Audit Trail

Dedicated Certificate of Completion with signer IP addresses, UTC timestamps, and user agents.

QR Verification

Dynamic high-density QR code enables instant visual verification through any camera or browser.

1. Statutory Admissibility (Republic Act No. 8792)

In the Philippines, the foundational legislation for electronic transactions is the Electronic Commerce Act of 2000 (Republic Act No. 8792). Section 8 provides that:

"An electronic signature on the electronic document shall be equivalent to the signature of a person on a written document if that signature is proved by showing that a prescribed method is used for establishing the identity of the signer and indicating the signer's approval of the information contained within the document."

Furthermore, under the Supreme Court Rules on Electronic Evidence (A.M. No. 01-7-01-SC), electronically signed documents enjoy the presumption of validity when accompanied by a reliable method of identity verification and an immutable audit record.

2. Dual SHA-256 Cryptographic Integrity

eSignPh maintains cryptographic evidence from the second an author uploads a document until the final recipient completes their signature:

Step A: Ingestion Digest. When a PDF, DOCX, or image file is received, the platform computes its initial SHA-256 cryptographic digest. This establishes the immutable baseline of the original un-altered document.
Step B: Execution Compilation. All participant signatures, text fields, and dates are stamped at exact normalized coordinates.
Step C: Final Sealed Digest. Once all participants complete their steps, a final SHA-256 digest is generated. This digest is embedded in our database, stamped into the certificate, and recorded with the digital signature service.

3. Digital Signature Service (DSS) Integration

In addition to biometric and graphical electronic signatures, eSignPh integrates with remote Digital Signature Services (such as OVCODE DSS v2) to apply a digital cryptographic seal backed by PKI public/private key pairs. This digital seal locks the PDF structure, ensuring that any subsequent modification by unauthorized third parties triggers standard PDF reader tamper warnings.

4. Tamper-Evident Certificate of Completion

Every completed envelope includes a dedicated legal audit page permanently appended to the document. This Certificate of Completion serves as standalone legal evidence in dispute resolution proceedings and contains:

  • Document Identifier: Unique alphanumeric envelope tracking code and UUID.
  • Original SHA-256 Hash: Checksum of the initial file uploaded by the sender.
  • Final Sealed SHA-256 Hash: Checksum of the compiled document after all signatures.
  • Participant Audit Ledger: Chronological table detailing signer names, emails, signature modalities, exact timestamps (UTC), and recorded IP addresses.
  • High-Density Verification QR Code: Direct verification URL enabling any auditor or recipient to verify file authenticity without needing an account.

5. Cloud Storage & Transport Encryption

Documents are encrypted both in transit and at rest:

  • Transport Security: All client-to-server traffic is forced over TLS 1.3/TLS 1.2 using modern cryptographic cipher suites.
  • Storage Encryption: Uploaded originals and sealed envelopes stored in Azure Blob Storage utilize AES-256 server-side encryption.
  • Tokenized Delegation: Signers do not share session credentials. Each participant receives a high-entropy 256-bit URL token that expires automatically once signed or voided.

6. Independent Public Verification

Transparency is central to the eSignPh philosophy. Anyone possessing an eSignPh-signed PDF may verify its authenticity independently:

  1. Navigate to the Verification Portal or click Verify Document in the top header.
  2. Upload the executed PDF file.
  3. The engine computes the SHA-256 digest in real time and matches it against our immutable ledger. If the document has been altered by even one pixel or byte, verification fails immediately.