Get started

Legal recognition · 7 jurisdictions

Legal recognition of electronic signatures

How eSignature.llc fits the law in every country we operate in. We cover the statute, the tiers each jurisdiction recognises, exactly which tier we deliver, what we deliberately do not offer, and the evidence chain shipped with every signed PDF.

Thailand

ประเทศไทย / Thailand

Statute

Electronic Transactions Act B.E. 2544 (2001), as amended by B.E. 2562 (2019)

Section 9 establishes general validity of electronic signatures. Section 26 sets the higher bar of a Reliable Electronic Signature.

Tiers recognised

  • General Electronic Signature (Section 9)

    We provide

    Any data attached to or logically associated with a message, used to identify the signer and indicate approval of its content.

  • Reliable Electronic Signature (Section 26)

    We provide

    Signature creation data uniquely linked to the signer, under their sole control, with any post-signing alteration detectable.

  • Digital Signature with Certificate (Section 28)

    Not offered

    Signature backed by a certificate issued by a Thai-licensed Certification Authority — typically used by government agencies and regulated industries.

What we provide

We deliver the Section 9 General Electronic Signature out of the box. For Section 26 (Reliable) we satisfy uniqueness via per-user accounts and one-time email tokens, sole-control via authenticated device + selfie + GPS at the moment of signing, and tamper-detection via SHA-256 hashing and an append-only AuditLog. The signed PDF is sealed by pdf-lib and any post-execution byte change invalidates the public verify URL.

What we do not provide

We do not currently issue Section 28 Digital Signatures backed by a Thai-licensed CA. For agreements that legally require a CA-issued certificate (e.g. some government procurement), use a separately certified service.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

ETDA — Electronic Transactions Development Agency

No licence is required to provide Section 9 / Section 26 e-signature services. ETDA licensing applies only to Certification Authorities under Section 28.

Singapore

Singapore / 新加坡

Statute

Electronic Transactions Act 2010 (revised 2021), Cap. 88

Part 3 confirms that contracts shall not be denied legal effect solely because they are in electronic form. Part 4 introduces the Secure Electronic Signature, presumed reliable.

Tiers recognised

  • Electronic Signature

    We provide

    Any electronic method used to identify a person and indicate intent — broadly enforceable for ordinary commercial contracts.

  • Secure Electronic Signature

    We provide

    An e-signature that, through a prescribed security procedure, is uniquely linked to the signer, capable of identifying them, created under their sole control, and tied to the document such that any change is detectable.

What we provide

We deliver the standard Electronic Signature for all ETA-eligible documents. We meet the Secure Electronic Signature criteria via authenticated session + email-bound recipient link + sole-control device evidence + SHA-256 document hash baked into the audit trail.

What we do not provide

We are not (yet) an IMDA-accredited Certification Authority and do not issue Singapore-government Sing-Pass digital signatures. The ETA First Schedule excludes wills, negotiable instruments, indentures, declarations of trust, powers of attorney for property, and contracts for sale or conveyance of immovable property — those still need wet-ink or specialised forms.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

IMDA — Infocomm Media Development Authority

Providing Electronic / Secure Electronic Signatures does not require IMDA accreditation. Accreditation only applies to Certification Authorities issuing digital certificates.

United States

United States of America

Statute

ESIGN Act 2000 (15 U.S.C. §§ 7001–7031) + UETA (adopted by 49 states, D.C., Puerto Rico, U.S. Virgin Islands)

ESIGN at federal level + UETA at state level (New York instead has its own Electronic Signatures and Records Act). Both establish that a signature, contract, or record may not be denied legal effect solely because it is in electronic form.

Tiers recognised

  • Electronic Signature

    We provide

    An electronic sound, symbol, or process attached to or logically associated with a contract, executed by a person with the intent to sign.

  • Digital Signature with PKI

    Not offered

    Higher-assurance signatures using public-key cryptography and a third-party certificate authority — common for federal agencies via FIPS 186 / NIST 800-63.

What we provide

We provide ESIGN- and UETA-compliant Electronic Signatures: clear consumer-disclosure flow, attribution via authenticated email link, intent via explicit click-to-sign + drawn signature image, association of the signature to the record via embedded signature stamp, and a retainable retrievable copy (the stamped PDF + Certificate of Completion).

What we do not provide

We do not issue PKI / X.509 digital signature certificates and we are not a NIST 800-63 IAL2/IAL3 identity proofer. ESIGN/UETA carve-outs (wills, codicils, testamentary trusts, family-law matters, court orders, Article 3 / 4 / 4A / 9 of the UCC, certain notices of cancellation) still require their statutory forms.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

NIST (technical guidance) + State Attorneys General (consumer enforcement) + sector regulators (CFPB, FDA Part 11, IRS for tax records)

No federal licensing or registration is required to operate an e-signature service. Sector-specific obligations (HIPAA, FDA 21 CFR Part 11, FINRA) apply only when handling those record types.

Estonia (EU)

Eesti / Estonia — European Union

Statute

eIDAS Regulation (EU) No 910/2014 + Estonian Electronic Identification and Trust Services for Electronic Transactions Act (E-ITSETA)

eIDAS is directly applicable in all EU member states. It defines three tiers and bars discrimination against an electronic signature solely on the ground that it is electronic or non-qualified.

Tiers recognised

  • Simple Electronic Signature (SES)

    We provide

    Data in electronic form attached to or logically associated with other data, used by the signer to sign.

  • Advanced Electronic Signature (AdES)

    We provide

    Uniquely linked to the signer, capable of identifying them, created under their sole control, and linked to the data such that any change is detectable.

  • Qualified Electronic Signature (QES)

    Not offered

    An AdES created by a Qualified Signature Creation Device, based on a qualified certificate from an EU-listed Qualified Trust Service Provider. Only QES is legally equivalent to a wet-ink signature across all member states. In Estonia: ID-card, Mobile-ID, Smart-ID.

What we provide

We provide SES for every signature, and meet the AdES bar through authenticated user accounts (sole-control), email-tied invitations (uniqueness), the embedded selfie + IP + lat/long (identification), and SHA-256 hashing + append-only AuditLog (tamper-detection).

What we do not provide

We are not a Qualified Trust Service Provider listed on the EU Trusted List, so we do not issue Qualified Electronic Signatures. For Estonian QES, signers should use ID-card, Mobile-ID or Smart-ID (state-issued) and we accept those as an external attestation alongside our evidence chain.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

RIA — Information System Authority (Estonian national supervisory body for trust services under eIDAS)

No registration is needed to provide non-qualified (SES / AdES) services. Only Qualified Trust Service Providers must apply for and maintain RIA approval and EU Trusted List inclusion.

India

भारत / India

Statute

Information Technology Act 2000, as amended by the IT (Amendment) Act 2008, plus the IT (Use of electronic records and digital signatures) Rules

Section 3 covers Digital Signatures (asymmetric crypto + DSC). Section 3A, added in 2008, recognises Electronic Signatures more broadly under the Second Schedule.

Tiers recognised

  • Electronic Signature (Section 3A)

    Not offered

    Any technique notified by the Central Government in the Second Schedule. Currently includes Aadhaar-based eSign and biometric / OTP-authenticated methods via licensed eSign Service Providers.

  • Digital Signature Certificate (DSC, Section 3)

    Not offered

    Asymmetric-crypto signature using a private key on a USB token, issued by a CCA-licensed Certifying Authority (e.g. eMudhra, Sify, NSDL).

  • Plain electronic acceptance (general contract law)

    We provide

    Under the Indian Contract Act 1872, electronic acceptance is generally enforceable for ordinary commercial contracts where the IT Act doesn't mandate a Schedule-1 carve-out form.

What we provide

We deliver enforceable electronic acceptance under general Indian contract law for most B2B and B2C agreements (MSAs, SOWs, NDAs, employment, vendor onboarding) — backed by our standard evidence chain. The audit trail meets Section 65B of the Indian Evidence Act for admissibility of electronic records.

What we do not provide

We do not currently offer Aadhaar eSign, nor DSC USB-token signing. Documents that the IT Act First Schedule excludes — wills, trusts, powers of attorney, real-estate sale deeds, negotiable instruments — still need their statutory paper / DSC forms.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

CCA — Controller of Certifying Authorities (under MeitY)

No CCA licence is required to provide non-DSC electronic signature services. CCA licensing applies only to Certifying Authorities issuing DSCs and to empanelled eSign Service Providers under Section 3A.

United Kingdom

United Kingdom / Great Britain & Northern Ireland

Statute

Electronic Communications Act 2000 + UK eIDAS Regulation (post-Brexit retained EU law, as amended) + Law Commission report on Electronic Execution of Documents (2019)

Section 7 ECA establishes admissibility of electronic signatures in legal proceedings. Post-Brexit, the EU eIDAS Regulation continues to apply as retained UK law.

Tiers recognised

  • Simple Electronic Signature

    We provide

    Any electronic data attached to or logically associated with other electronic data and used by a signatory to sign.

  • Advanced Electronic Signature

    We provide

    Uniquely linked to the signer, capable of identifying them, created under their sole control, with tamper detection.

  • Qualified Electronic Signature

    Not offered

    AdES created with a qualified certificate from a UK Trust Service Provider on the UK Trusted List.

What we provide

We deliver Simple and Advanced Electronic Signatures. The Law Commission (2019) confirmed that an electronic signature is capable in law of executing a deed, provided witnessing requirements are observed where applicable. Our audit trail and verification page provide the evidence courts expect under the Civil Evidence Act 1995.

What we do not provide

We are not a UK-Trusted-List Qualified Trust Service Provider, so we do not issue Qualified Electronic Signatures. Wills, statutory declarations, and certain Land Registry transactions still require wet ink or specialised forms.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

ICO (data protection) + DSIT — Department for Science, Innovation and Technology (trust services oversight)

No licensing required for Simple or Advanced services. Only Qualified Trust Service Providers register with DSIT for inclusion on the UK Trusted List.

Australia

Australia / Commonwealth of Australia

Statute

Electronic Transactions Act 1999 (Cth) + state mirror Acts (e.g. ETA NSW 2000, ETA Vic 2000)

Sections 8–10 establish that a transaction is not invalid because it took place by electronic communication, and set the conditions under which an e-signature meets a legal signature requirement.

Tiers recognised

  • Electronic Signature meeting Section 10 ETA

    We provide

    A method used to identify the signer and indicate their intention; reliable as appropriate for the purpose; and consented to by the recipient (consent can be implied from conduct).

  • Cryptographic / PKI signature

    Not offered

    Asymmetric-crypto digital signatures used for high-assurance contexts (e.g. some Commonwealth procurement or banking).

What we provide

We provide Section 10 Electronic Signatures with the identification, intention and reliability the Act requires. Recipient consent is captured explicitly in-product. The Corporations Act 2001 amendments (s.110A, made permanent in 2022) confirm that company documents, including deeds, may be signed electronically.

What we do not provide

We do not issue PKI digital signatures. Wills, powers of attorney, statutory declarations, and certain land-titles documents are excluded from the ETA and continue to require wet-ink or jurisdiction-specific forms.

Court evidence shipped with every signed PDF

  • Signer email (single-use invitation token)
  • IP address (server-recorded)
  • Server-side timestamp (UTC)
  • Latitude / longitude to 6 decimal places
  • Identity selfie (live capture at signing)
  • SHA-256 hash chain over the audit log
  • Append-only audit log of every lifecycle event
  • Public verify URL + QR code on every page

Regulator

Digital Transformation Agency (Commonwealth) + state Attorney-General departments

There is no licensing scheme for general e-signature providers in Australia. Specific industries (financial services under ASIC, healthcare under HPA) may have additional record-keeping requirements.

Evidence chain

Evidence we capture for every signature

The strongest legal argument is the record itself. Every executed PDF travels with this evidence bundle, baked into the file and cross-referenced to an append-only audit log on our servers.

Signer identity

  • Email address (verified via secure invitation link, single-use per request)
  • Optional photo-ID upload
  • Optional AI face-match between the photo-ID and the live selfie taken at signing time

Intent

  • Explicit click-to-sign action — required, never inferred
  • Drawn or typed signature image stored as a vector / raster artefact and embedded into the PDF
  • Per-document acceptance prompt before any signature is captured

Where & when

  • Latitude and longitude captured to 6 decimal places (~11 cm precision)
  • GPS accuracy radius (metres) recorded alongside the coordinates
  • Server-recorded timestamp (UTC) — independent of the client clock
  • Reverse-geocoded human-readable address stamped onto the signature block

Device

  • IP address (recorded server-side, not asserted by the client)
  • User-agent string (browser, OS, mobile / desktop)
  • Selfie photo at the moment of signing — embedded as a small thumbnail beneath the signature on the executed PDF

Tamper-detection

  • SHA-256 hash of the original document, recorded at upload time
  • Hash chain across audit-log entries — any record alteration breaks the chain
  • Public verification URL printed as a QR code on every page of the executed PDF
  • Brand footer with hyperlink on every page so a reader can verify in one tap

Process

  • Append-only AuditLog table — entries are never updated or deleted
  • Lifecycle events recorded: DOCUMENT_VIEWED → DOCUMENT_SIGNED → COUNTER_SIGN_INITIATED → SIGNED_PDF_GENERATED → COMPLETION_EMAILS_SENT
  • Each event records actor, timestamp, IP and (where relevant) coordinates
  • Certificate of Completion PDF auto-generated with the full timeline

Privacy posture

PDPA · GDPR · CCPA / CPRA — what we honour

We treat signer data as the document owner's lawful evidence — collected for a defined purpose, retained for the contract's useful life, and erasable on request to the extent compatible with ongoing legal obligations.

Data residency
Document files and audit logs are stored in our EU-region primary database and on EU-located object storage. Cross-border transfers (e.g. when an APAC signer authenticates) rely on Standard Contractual Clauses under GDPR Chapter V.
Right of erasure / deletion on request
Signers may request deletion of their personal data via support@esignature.llc. We will erase identifiers from the audit log (selfie, IP, GPS) while preserving an anonymised proof-of-execution where the document owner has a legitimate interest in retaining the executed agreement.
Breach notification
In the event of a personal-data breach, affected data controllers (document owners) are notified within 72 hours of detection, in line with GDPR Art. 33 and Thai PDPA Sec. 37(4). Notice includes the nature of the breach, categories and approximate number of data subjects, and the measures taken.
DPO contact
Until a dedicated Data Protection Officer is appointed, all privacy correspondence (subject access requests, erasure requests, opt-out under CCPA, breach notifications) reaches the responsible team via support@esignature.llc.

Disclaimer. This page is informational, not legal advice. Specific use cases — including wills, codicils and testamentary trusts; real-estate sale deeds and powers of attorney; court filings; negotiable instruments; and government procurement requiring a CA-issued certificate — may require additional formalities under local law. If your transaction sits outside the ordinary commercial-contracts envelope, consult qualified counsel in the relevant jurisdiction before you rely on the e-signature alone.

Have a use-case question? We'll point you at the right tier.