EU Compliant PDF Signature Tool: Qualified Signatures at Flat Rate Pricing

What Is an eIDAS Qualified Electronic Signature?

The eIDAS Regulation (EU 910/2014) defines three levels of electronic signature security. Most online platforms offer simple or advanced signatures. DocuSeal, deployed on Opsily, supports qualified electronic signatures.

A qualified signature uses a qualified certificate issued by a Trust Service Provider. It creates a permanent, cryptographic binding between the signer, the document, and the timestamp. The signature cannot be repudiated after signing. If a contract is signed with a qualified signature and later disputed in court, the signature itself is legally presumed valid. The burden of proof shifts to the challenger.

Simple vs Advanced vs Qualified

Simple Signature (biometric, SMS, password)

• Lowest legal weight
• Acceptable for internal workflows
• Can be challenged in court

Advanced Signature (certified by a Trust Service Provider)

• Medium legal weight
• Acceptable for most commercial contracts
• Harder to challenge in court

Qualified Signature (cryptographically bound to qualified certificate)

• Highest legal weight
• Legally equivalent to a handwritten signature
• Cannot be challenged on basis of signature validity

GDPR Article 28 and Your Contracts

When you process customer or employee data (names, emails, signatures), you are a data controller. When you sign a contract involving personal data, GDPR Article 28 requires a Data Processing Agreement with any subprocessor handling that data.

Opsily signs DPAs as a processor. Your signature platform itself (DocuSeal) processes signer names, email addresses, timestamps, and cryptographic data. Opsily ensures this data remains in the EU, is encrypted at rest, and is never transferred to US cloud providers.

DocuSign's US-based infrastructure creates GDPR risk: even with an EU subsidiary, customer data transits US servers, exposing you to potential CLOUD Act demands.

eIDAS Article 25 Compliance

Article 25 of eIDAS requires qualified signatures to be issued by a Trust Service Provider. DocuSeal integrates with qualified timestamp authorities (QTSPs) in the EU. Every signature is timestamped and cryptographically validated. This timestamp is permanent and cannot be altered after signing, creating an immutable record.

When contracts are legally challenged years later, the eIDAS infrastructure proves: the signer was who they claimed to be, the document was signed on a specific date and time, the document has not been altered since signing, and the signature provider was legally authorized.

For regulated industries (finance, insurance, real estate), qualified signatures are increasingly mandatory. For unregulated industries, they're insurance against future disputes.

Cost and Risk Math

DocuSign charges per signature. A company with 50 signers, each signing 2 contracts monthly, pays 25 to 75 euros monthly in signature fees alone, plus the base subscription. Over 12 months: 1,560 to 4,680 euros. On Opsily, you pay one flat hosting fee for unlimited signings, 360 euros yearly.

The vendor lock-in risk is real: if DocuSign raises prices, changes policy, or gets acquired, you cannot easily migrate archived contracts. DocuSeal on Opsily gives you export-friendly archives and the ability to self-host if Opsily's prices shift.