Skip to main content

How much proof does your document need?

Not every document deserves the same level of identity checking. A practical ladder, from a link in an inbox to a verified identity document, and how to decide where each of your documents sits.

Author
Lamine Diallo
Category
Basics
Read time
4 min read
Published

There is a question people ask early and answer badly: how secure does the signature need to be? The bad answers are “as secure as possible”, which makes routine paperwork miserable, and “it does not matter”, which is fine right up until it matters enormously.

The good answer is a question back. What would it cost you if the other side stood up and said I never signed that?

Everything follows from there.

The ladder

Strength of proof is not one switch. It is a series of steps, each one making it harder for a signer to credibly deny what they did.

Step one: they received the link. The signature is tied to an email address or phone number you sent it to. To deny it, the signer has to claim someone else had access to their inbox. That is a real argument, but it is an argument they have to make, and it exposes them to obvious follow-up questions.

Step two: they proved control of a phone. A one-time code is sent by SMS and they type it back. Now denial requires that someone had both their inbox and their handset. This is a large step up for a small amount of friction, roughly fifteen seconds, and it is the right default for anything commercial.

Step three: they produced a document. The signer uploads an identity document or a mandate, which is attached to the signing record. Denial now means explaining why their ID was in the file.

Each step costs the signer a little time and buys you a lot of ground. The skill is not in climbing as high as possible. It is in matching the step to the document.

A vocabulary you will run into

Read anything on this subject published in Europe and you will meet three terms: simple, advanced and qualified electronic signature, often shortened to SES, AES and QES. They come from European regulation, where they are legal categories with defined technical requirements and defined effects in court.

They are useful shorthand for the ladder above, and it is worth recognising them because vendors and international counterparties use them constantly. But be careful with two things.

First, those categories are creatures of European law and do not import themselves into Guinean law. A vendor telling you a signature is “eIDAS qualified” is telling you something real about its technical construction and about how it would be treated in the European Union. That is not the same statement as how it would be treated here.

Second, the vocabulary encourages a shopping-list mentality, where people ask for the highest tier without asking what they are buying. Under our law, what matters is whether the signer can be identified and the document’s integrity guaranteed. The three-tier vocabulary is one way of describing how thoroughly you did the first of those. It is not the test itself.

Deciding, in practice

Sort your documents by one criterion: how badly a repudiation would hurt.

Low. Internal approvals, leave requests, acknowledgement of a policy, routine forms between people who see each other weekly. A link is enough. Adding friction here is how you teach an organisation to hate the tool.

Medium. Client agreements, supplier contracts, quotes above a threshold you set, employment paperwork. Turn on the SMS code. This is where most commercial documents live, and it should be your default rather than something you switch on for special occasions.

High. Anything with a large sum, a long duration, a counterparty you have not worked with before, or a transfer of something you cannot easily get back. Require an identity document alongside the code. Accept the friction; the friction is proportionate to what you would be arguing about.

The threshold between medium and high should be a written number, decided once. If it lives in someone’s judgement it will drift, and it will drift in the direction of whatever is fastest that afternoon.

What proof does not fix

A stronger identity check does not make the terms fairer, does not confirm the signer had authority to bind their organisation, and does not tell you whether the document says what you think it says.

It answers exactly one question — was it really them — and it answers it well. Keep it in its lane and it is one of the most useful controls you have.

Where the law sits

Guinean law recognises electronic writing and signature as evidence where the signer can be identified and the document’s integrity is guaranteed. Integrity is handled the same way at every step of the ladder: the sealed document is either intact or visibly not. Identification is what the ladder varies, and climbing it makes the identification harder to dispute.

General information, not legal advice. If a specific document carries a specific formal requirement, ask a lawyer before you decide how to sign it.


Pricing shows which plan includes the SMS challenge and supporting-document upload, in Guinean francs.

Related articles

  • Basics

    A scanned signature is not an electronic signature

    Print, sign, scan, email. It is how most contracts still move, and it produces a document that proves almost nothing. Here is exactly what is missing, and what replaces it.

    • basics
    • evidence

    Lamine Diallo

    Founder, CEO & CTO

  • Basics

    Nine things people get wrong about electronic signature

    The objections that come up in every first meeting, and what is actually true. Some of the myths are wrong, some are half right, and one of them is right more often than vendors admit.

    • basics
    • myths

    Lamine Diallo

    Founder, CEO & CTO

  • Basics

    How an electronic signature actually works

    Not a picture of your name pasted onto a PDF. Here is what happens between the moment you open a link and the moment a signed document exists.

    • basics
    • how-it-works

    Lamine Diallo

    Founder, CEO & CTO