Login
Get started

DocuNinja Compliance

Learn how DocuNinja aligns with international regulations and standards such as GDPR, eIDAS (Qualified Electronic Signatures), SOC 2, HIPAA, UETA, and the ESIGN Act to protect your data and  digital transactions.

What is UETA and the ESIGN Act?

The Uniform Electronic Transactions Act (UETA) and the Electronic Signature in Global and National Commerce Act (ESIGN Act) are pivotal U.S. laws that establish the legal validity of electronic signatures and records. Both statutes ensure that electronic documents and signatures are as legally binding as their traditional counterparts.

Legal Validity of Electronic Signatures and Records

Both laws establish that electronic signatures and records are equivalent to handwritten signatures and paper records, making them legally enforceable in commerce and legal transactions.

Authentication and Control

Electronic signatures must be created with control under the signer’s sole possession or accessible only to the signer (e.g., via secure methods like passwords or digital certificates), ensuring authenticity and integrity.

Consent and Intent to Use Electronic Signatures

They require that all parties intentionally agree to conduct transactions electronically and demonstrate clear intent to sign electronically, ensuring mutual consent.

Retention and Accessibility of Records

Records and signatures must be retained in a manner that allows them to be accessible and reproducible for later reference, ensuring long-term validity and enforceability.

How does DocuNinja comply with UETA and the ESIGN Act?

Authentication

Signers are authenticated ensuring the validity and trustworthiness of electronic signatures.

Record Retention
All digital records are securely stored enabling easy access and retrieval when necessary.
Audit Trail
Audit trail is maintained, featuring comprehensive logs through the entire signing process.
  • The ESIGN Act (federal law) and UETA (model state law) establish that electronic signatures and records have the same legal validity as traditional paper signatures and documents, facilitating electronic commerce and communication.
  • Yes. Both laws ensure that electronic signatures are valid and enforceable if they meet certain requirements, such as intent to sign and proper consent.
  • No. The laws do not specify a particular technology; any electronic signature that demonstrates intent to sign and can be verified is generally valid.
  • Any legally binding document, including contracts, agreements, disclosures, consent forms, and more, provided both parties consent to electronic signing.
  • They must show clear intent to sign, be associated with the record, and be under the signer’s control or authentication process.
  • Yes. If both parties agree, they can specify that certain documents or transactions require wet-ink signatures. Also, certain documents (like wills or court orders) may have specific legal restrictions.
  • No. As long as the records are accessible, retained, and capable of being accurately reproduced for later reference, the format is generally flexible.
  • These laws apply only within the US. For international transactions, parties should check the legal requirements in other jurisdictions.
  • Using secure methods like encryption, secure authentication, and digital certificates can enhance legal enforceability but are not strictly required.
  • Yes. An electronic signature can be as simple as typing your name, clicking “I accept,” or using a stylus or finger on a touchscreen, as long as it indicates intent.
  • Yes. A scanned image of a handwritten signature attached to an electronic record can qualify as an electronic signature if it demonstrates intent to sign.
  • An electronic record is any electronic data maintained or transmitted, while an electronic signature is an electronic process attached to or logically associated with a record that indicates the signer’s acceptance.

What is eIDAS?

The UETA and the ESIGN Act are key U.S. laws that confirm the legal validity of electronic signatures and records. Both laws ensure that digital documents and signatures are just as legally binding as traditional paper-based ones.

Electronic Signatures

Qualified Electronic Signatures (QES) offering the highest standard of trust, legally equivalent to handwritten signatures across the EU.

Qualified Trust Service Providers (QTSPs)

Only signatures created using certificates issued by certified QTSPs are considered qualified. These providers must meet strict security and operational standards.

Cross-Border Recognition

eIDAS ensures that electronic IDs and signatures issued in one EU member state are recognized and accepted across all member states, facilitating seamless cross-border digital transactions.

Signature Creation and Validation Requirements

The regulation specifies technical and security standards for signature creation devices and validation processes, ensuring high levels of security, trust, and interoperability.

How does DocuNinja comply with eIDAS simple signature?

Signer Intent

The signing intent is linked to the signer identity and ensures that the signer willingly participates in the transaction.
Data Integrity
The signature is linked to the signed data in such a way that any subsequent changes to the data can be detected.
Safe Transactions
Every online action is secure and legally recognized as per eIDAS simple signature standard.

A QES is an advanced electronic signature created using a secure signature creation device and based on a qualified certificate issued by a trusted certificate authority. It holds the same legal weight as a handwritten signature throughout the European Union.

A signing certificate verifies the identity of the signer and confirms the authenticity of the signature. For a digital signature to be classified as qualified under eIDAS, it must be supported by a certificate issued by an authorized trusted service provider (TSP).
A TSP is a certified entity authorized under EU standards to issue qualified certificates and provide trust services, such as timestamping and signature validation.
Yes, Invoice Ninja / DocuNinja works with DigiCert, a Qualified Trust Service Provider (QTSP) or electronic seals and timestamps that comply with EU Regulations. 

It cryptographically links the signature to the signer’s identity and the signed document, offering high assurance that the signature is genuine and has not been altered. This makes it legally binding across all EU member states.

No. To meet eIDAS requirements and produce a qualified signature, your software must support signatures created with a qualified certificate issued by a recognized trust service provider and comply with relevant technical standards.
  • Simple Signatures: Minimal security, basic electronic signatures.
  • Advanced Signatures: Linked to the signer, capable of identifying them, created with secure methods.
  • Qualified Signatures: The highest level, meeting strict EU standards, supported by qualified certificates and secure signature creation devices.

No. Only for a Qualified Electronic Signature (QES). Other types (Simple or Advanced) do not automatically have the same legal standing but can still be valid for certain purposes.

You can verify it through the trust service provider’s validation services, which check the validity of the certificate and the integrity of the signature.

Costs vary depending on the provider and the validity period of the certificate. It typically involves an initial setup fee and annual renewal charges.

Qualified signatures are often required for legally sensitive transactions, such as signing cross-border contracts, official documents, or when high legal assurance is needed.

In Europe, especially under the EU eIDAS Regulation, having a client (signer) certificate is fairly common for certain types of businesses and government interactions, but its usage varies depending on the context and industry.
  • Business-to-Government (B2G) interactions: Many government services and official portals require or accept Qualified Electronic Signatures (QES), which rely on the signer’s qualified certificate. For example, submitting official documents, tax filings, or tenders online often requires a trusted digital identity.
  • Private sector: While more organizations are adopting eIDAS-compliant certificates, widespread use among regular small or medium businesses for everyday transactions is still growing but not yet universal.
  • Large enterprises and public institutions are more likely to routinely use qualified certificates for secure communications, digital signing, and authentication.
  • Yes, increasingly so. Several EU countries have implemented or are rolling out national eID schemes (eIDAS-based), allowing citizens and businesses to authenticate securely across various government portals. Examples include Germany’s BildungsID, Estonia’s ID card, and Austria’s Handy-Signature.

1. Identify Your Needs:

  • Do you need signatures for legal documents?
  • Do you want to authenticate on government portals?
  • Clarify your use case to choose the right provider.

2. Choose a Qualified Trust Service Provider (QTSP):

  • EU Trusted List: EIDAS Trusted List — official list of qualified trust service providers approved across the EU.
  • Check reviews or recommendations for customer support and device options.

3. Prepare Required Documentation:

  • Business registration documents
  • Proof of identity (for individuals or authorized representatives)
  • Any other documents requested by the provider

4. Complete Identity Verification:

  • Many providers offer remote verification via video calls, app-based identity checks, or in-person visits.

5. Obtain and Install Your Certificate:

  • Receive your qualified certificate on a secure device (smart card, USB token, or secure mobile app).
  • Follow the provider’s instructions to activate and use the certificate.

6. Integrate and Use:

  • Use the device for signing documents, accessing eIDAS-compliant portals, or authenticating securely.

What is GDPR?

GDPR is a set of European laws designed to protect your personal data and give you more control over how your information is collected and stored online. It ensures that companies like ours handle your data responsibly and securely, and gives you rights such as accessing or deleting your information. Our goal is to protect your privacy and make sure you feel confident using our services.

How does DocuNinja comply with GDPR?

Data Protection and Privacy 

We are committed to protecting your personal data. You have rights including access, correction, deletion (“right to be forgotten”) and data portability.

Lawful Data Processing

We only collect and use your data based on clear legal grounds, such as your consent and contractual necessity ensuring transparency and fairness.

Ensuring Data Security

We  implement strong security measures such as encryption, access controls, and regular audits—to keep your data safe.

Comprehensive Compliance Standards

At DocuNinja, we are committed to upholding international compliance standards to safeguard your data and electronic transactions. Our dedication to meeting SOC 2, HIPAA, and Qualified Electronic Signatures (QES) under the eIDAS regulation demonstrates our unwavering focus on security, privacy, and the legal validity of your digital documents.

SOC 2 Compliant eSignature

Strict security, privacy, and data protection standards set by the SOC 2 audit framework, ensuring your digital signatures are safe, trustworthy, and provider-neutral.

HIPAA Compliant eSignature

Privacy and security requirements of the Health Insurance Portability and Accountability Act (HIPAA), ensuring protected health information (PHI) is securely handled during digital signing.

21 CFR Part 11 Compliance

Requirement that e-signatures used in FDA-regulated industries meet strict standards for data integrity, security, and auditability equivalence to paper-based documentation.

Commitment to Compliance and Security

At DocuNinja, we understand how vital it is to follow international standards and regulations. Our dedication to compliance with GDPR, eIDAS (including Qualified Electronic Signatures), SOC 2, HIPAA, UETA, and the ESIGN Act reflects our commitment to delivering the highest levels of security, privacy, and reliability in all electronic transactions.

Create a Free Account