Legal Validity

1. What supports the proof

Every signing act on Quathos Sign produces evidence that does not depend on our word alone:

• A SHA-256 hash of the document, computed before and after each signature, so any later change to the file is detectable.
• This platform's own cryptographic signature (Ed25519) over the full evidence dossier — authentication method, consent text accepted, IP address, device, and timestamps.
• A trusted timestamp (RFC 3161) from a third-party Timestamping Authority, when one is configured for your account — an independent record of when the act happened, not only our server clock.
• An append-only, hash-chained audit trail, periodically anchored with a signature kept outside the database — designed to resist not just accidental edits, but tampering by someone with direct database access.
• Public verification: anyone holding the document, or its verification code, can check its integrity at /verify without trusting our word for it.

2. What level of signature this is

Quathos Sign issues simple, advanced and qualified (ICP-Brasil certificate) electronic signatures. Validity is recognized under the law that applies to your transaction — see the "Assurance levels" and "United States" paragraphs in section 5 of our Terms of Use for how that plays out by legal regime. We do not anchor this page to one country's statute: this product serves signers and senders everywhere, and a page centered on a single jurisdiction's law would be misleading for everyone else.

3. What this is not

Unless the envelope was signed at the qualified (ICP-Brasil) level, this is not a qualified electronic signature made with the signer's own certificate. It does not replace a legal requirement for public form, witnesses, or a notary where local law demands one. And it is not a legal opinion on whether your specific document can be signed electronically — that determination depends on facts about your transaction that we do not have.

4. Proof of existence

Besides signatures, the platform records proofs of existence: the SHA-256 digest of a file, registered at an instant measured in UTC by our server clock at the request of an organization, and sealed with the platform keys published at /public/platform-key (Ed25519 and ML-DSA-87, both required). Anyone holding the file or the verification code can verify it at /verify. What it shows is that content with that digest existed at that instant. It does not attest authorship or the content of the file, which we never store, and the date comes from our clock, not from an accredited time authority. Whether that record is enough for your purpose is a question about your transaction, not about the mechanism.

5. How to verify it yourself

Do not take our description on faith. Use the verification code printed on the signed document, or the file itself, at /verify to confirm its integrity independently — a counterparty, an expert, or a court can do the same without relying on Quathos Sign as a witness.

6. What we will not claim

We will not say a signature "is valid in any court" or "replaces a notary" — no signing platform can promise that, and claiming it would be the opposite of the honesty this page is for. Every claim above comes with the mechanism that backs it, so you — or your own counsel — can verify it rather than take our word for it.