Touch2Sign Policy Library
← All policies

eIDAS Compliance Guide

Version 1.0 · Approved · Owner: Legal

Download .md →

eIDAS Compliance Guide — Touch2Sign

Version: 1.0 · Last updated: July 2026

Audience: Customers, sales, support, engineering

Disclaimer: Technical and operational guidance only — not legal advice. Obtain qualified counsel for jurisdiction-specific validity.

1. What eIDAS means for Touch2Sign

Touch2Sign supports electronic signatures aligned with Regulation (EU) No 910/2014 (eIDAS) and UK electronic signature law. Touch2Sign is a software platform, not a qualified trust service provider (QTSP). QES is delivered via eID Easy (QTSP).

2. Signature levels — when to use each

Level eIDAS term Touch2Sign Typical use
SES Simple Electronic Signature Draw/type signature, email link Low-risk agreements, internal approvals
AES Advanced Electronic Signature OneID bank IDV + device binding Contracts, tenancy, B2B agreements
QES Qualified Electronic Signature eID Easy (national eID, itsme, etc.) Ireland deeds, high-assurance, regulated flows

Rules of thumb

  • Do not use SES for Ireland deeds or documents requiring QES by law.
  • Use AES when identity assurance is needed but QES is not mandated.
  • Use QES for Ireland property/deed workflows and when counsel or regulation requires qualified signatures.
  • UK deeds (eWitness): Platform supports remote witnessing under LP(MP)A-style workflows — legal validity memo pending from counsel.

3. Evidence Touch2Sign produces

Artifact Contents
SCCR (Completion & Compliance Report) Signature level, IDV method, timeline, hashes
Audit trail Event log with timestamps, parties, IP (where captured)
ERSD log Signer disclosure acceptance
Witness Trail Report eWitness attestation and witness identity
PAdES / ASiC-E QES embedding (Ireland flows via eID Easy)

Default retention: 7 years for completed documents (configurable by customer within limits).

4. Customer responsibilities

Customers (as data controllers) must:

  1. Choose the correct signature level for document type and jurisdiction
  2. Provide privacy notices to signers and witnesses
  3. Confirm legal validity of e-signatures for their use case
  4. Not upload prohibited content (wills where wet ink required, etc. without legal advice)
  5. Configure IDV appropriate to risk
  6. Instruct Touch2Sign on retention and erasure for processor data

See also: Terms of Service · DPA

5. Touch2Sign responsibilities

  • Provide SES, AES, and QES-capable workflows
  • Maintain audit trails and integrity hashing
  • Use qualified trust services for QES (eID Easy)
  • Notify customers of sub-processor changes
  • Implement security measures per DPA
  • Not warrant validity in every court — customer must assess fit

6. eWitness (deed witnessing)

UK (England & Wales)

  • Witness portal with SMS OTP and attestation declarations
  • Witness Trail Report for evidence file
  • Marketing: “Designed for deed execution workflows under LP(MP)A 1989” — not “guaranteed valid in all cases”

Ireland

  • Signer QES on deed PDF via eID Easy
  • Witness QES in ASiC-E container
  • Document remains on Touch2Sign; only hash sent to QTSP

Pending: External legal opinions for UK remote witnessing and Ireland QES chain.

7. Approved vs prohibited claims

✅ Approved ❌ Avoid
eIDAS-aligned eIDAS certified
Supports SES, AES, QES Legally valid in all circumstances
Designed for eIDAS workflows ISO 27001 certified (until certified)
Evidence package for audit Guaranteed court acceptance
QES via qualified trust service partner Touch2Sign is a QTSP

8. Support escalation

Question Route
Which level for my document? Customer legal counsel; Touch2Sign support can explain product capabilities only
Ireland deed setup support@touch2sign.com + eWitness docs
Enterprise due diligence legal@touch2sign.com — provide ROPA, DPIA, DPA

9. Related documents

Questions: security@touch2sign.com · privacy@touch2sign.com