A valid digital signature alone is not enough

A digitally signed contract is returned. The signature is valid, the timestamp is correct, and the document hasn't been altered since it was signed. Is everything okay? Not necessarily.

This is because a technically valid digital signature initially only indicates who signed a document and how, and whether the signature is technically valid. It does not automatically indicate whether that person was legally authorized to represent the company in question—or whether, for example, a second signature would have been required.

That’s why, especially in B2B onboarding, two levels must align: the technical verification of the document and the business verification of signing authority.

What a valid digital signature really confirms

The technical verification focuses on the signed document itself. Swisscom’s Document Validator can verify, among other things, who signed the document, what type of signature was used, whether the signature is valid, whether the timestamp is valid, and whether the document has been altered since it was signed.

This answers a key question: Is the returned document technically trustworthy?

This verification is important—but it does not yet answer the second question, which is crucial for a B2B contract.

Why signing authority must also be verified

A person who signs a document is not automatically authorized to represent a company on their own. Depending on the company, different signing rules may apply. For example, a person may only sign jointly with a second authorized signatory.

This is exactly where the Business Identity Validator comes into play. It provides information on the authorized signatories on file for the company and the signing rules. These can be cross-checked with the actual signatories identified during onboarding.

This creates a clear division of responsibilities:

Document Validator:
Who signed, and is the document technically valid?
Business Identity Validator:
Was this person authorized to sign on behalf of this specific company?

Only when both answers are considered together can it be determined whether a digitally signed contract also complies with the stored representation rules.

Individual signature or collective signature?

A simple example illustrates the difference:

A contract is digitally signed by Person A. The signature is technically valid, the timestamp is correct, and the document is unaltered. Person A is also, in principle, authorized to sign.

However, the company requires a collective signature by two authorized persons. A second authorized person would also have had to sign.

The signature verification alone would not fully address this business deficiency. Only a comparison with the company’s signing rules reveals that the existing signature is insufficient.

Two checks for a reliable B2B contract

Digital onboarding is therefore not just about verifying the technical validity of a signature. The connection between the document and the company is crucial:

Who actually signed? Is the signature valid? Was the document altered? And was the signatory authorized to represent the company in this manner?

The Business Identity Validator and the Document Validator provide two separate but combinable levels of verification for this purpose. One provides information on the company’s identity, authorized signatories, and signing rules. The other verifies the actual signed document and the signature information it contains.

Integrating signature and authorization verification into onboarding

Both services can be integrated into existing digital processes via APIs. This allows the relevant checks to take place directly during B2B onboarding: from identifying the company and selecting authorized signers to validating the returned document.

This does not mean that every process must use both services in the same way. The validators have a modular design and can be used individually or in combination, depending on the existing system landscape and verification requirements. This also aligns with the product architecture: the individual functions are available via separate endpoints.

A valid digital signature builds trust in the signed document. For a B2B contract, however, a second form of trust is also required: the certainty that the person who signed was actually authorized to represent the company.

Read our white paper on automating B2B onboarding checks to learn more about how you can automate standard checks so your subject-matter experts can focus specifically on exceptions.

Customer success stories

Customer success stories

A valid digital signature alone is not enough

A digitally signed contract is returned. The signature is valid, the timestamp is correct, and the document hasn't been altered since it was signed. Is everything okay? Not necessarily.

What a valid digital signature really confirms

Why signing authority must also be verified

Individual signature or collective signature?

Two checks for a reliable B2B contract

Integrating signature and authorization verification into onboarding

Latest Blog articles

A valid digital signature alone is...

The true cost of manual back-office...

FAQ: 5 questions before you change...

The cost of discontinuity in digital...