ezSign¶
ezSign is the {{ product_name }} product for electronically signing documents and checking signatures, covering both the EU eIDAS framework and the Swiss ZertES framework. Your organization installs the on-prem part; {{ product_name }} runs the central services it connects to.
What this section covers
The parts of ezSign¶
ezSign has one part you use directly and three central services that work behind the scenes:
| Part | Where it runs | What it is for |
|---|---|---|
| ezSign | In your organization's network | The signing portal you use to sign documents, track them, and download the signed files. Administrators also manage access here. |
| Signing Service | Central ({{ product_name }}) | Applies the electronic signature - behind the scenes. |
| Key Management | Central ({{ product_name }}) | Keeps your signing keys safe on secure hardware - behind the scenes. |
| Validator | Central ({{ product_name }}) | Checks whether a signed document is valid, for EU and Swiss signatures. |
How you reach ezSign
You reach ezSign at a normal web address for your organization (for example
https://ezsign.<your-company>), like any other internal web app. The central services work behind
the scenes - you don't connect to them directly.
Using ezSign¶
ezSign has two areas, each on its own web address:
| Area | Who uses it | What it is for |
|---|---|---|
| Operator area | People who sign documents | Upload documents, follow signing progress, download the signed files. |
| Administration area | Administrators | Manage who is allowed to sign, set up signing profiles, and run first-time setup. |
Keeping them separate lets your organization restrict administration to trusted staff.
What you can do
- Sign PDF documents - upload a file and get back a signed version.
- Track your documents - see what is in progress and what is finished.
- Download signed files - retrieve the completed, signed documents.
- (Administrators) manage access - decide which groups can sign, and with which profile.
Signing in - you sign in with your organization's single sign-on, the same login you use for other company systems. Administrators and operators sign in separately.
How it fits together¶
The one part you use - ezSign - runs in your network. The central services do the signing and the checking behind the scenes. Your document never leaves your network; only a fingerprint is sent out.
At a glance¶
The clearest way to picture it: ezSign runs in your network and connects out to the central services.
flowchart LR
subgraph FE["In your organization's network"]
WebApp["ezSign"]
end
subgraph BE["Central services (AlpinePKI)"]
direction TB
Signing["Signing Service"]
Keys["Key Management"]
Validator["Validator<br/><i>(independent)</i>"]
end
WebApp --> Signing
WebApp --> KeysFigure: ezSign runs in your network and connects to the central Signing Service and Key Management. The Validator is a separate service you use to check signed documents.
How signing works¶
Only a fingerprint of your document is sent out - the document itself stays in your network:
sequenceDiagram
actor You as You
participant WebApp as ezSign (your network)
participant Signing as Signing Service
participant Keys as Key Management
You->>WebApp: 1. Upload document
WebApp->>Signing: 2. Send fingerprint only
Signing->>Keys: 3. Sign with your key
Keys-->>Signing: 4. Signature
Signing-->>WebApp: 5. Signature
WebApp-->>You: 6. Signed documentHow checking works¶
Checking a signed document is separate - you can use the Validator on its own:
sequenceDiagram
actor You as You / your app
participant Validator as Validator
You->>Validator: 1. Upload signed document
Validator-->>You: 2. Result (valid? EU or Swiss?)What your organization needs¶
- A single sign-on so your people can log in to ezSign.
- An email server so ezSign can send notifications.
- The software and central-service access from {{ product_name }} - the on-prem part is installed by your IT team, and the central services are run for you.
Where to start¶
| If you want to… | Go to |
|---|---|
| Sign, track, and download documents | ezSign |
| Set ezSign up for the first time | ezSign - Initialization |
| Decide who may sign, and with which keys | Groups |
| Change how administrators sign in | Admin OpenID |
| Switch operator sign-in on, or change it | Operator OpenID |
| Decide how a signature is made | Key profiles |
| Generate a signing key and import its certificate | Keys & certificates |
| Turn on email notifications, or fix them | Email notifications |
| Understand how documents get signed | Signing Service |
| Check whether a signed document is valid | Validator |
FAQ¶
Is ezSign one app or several?
There is one part you use - ezSign, the signing portal in your network. Behind it are three central services run by {{ product_name }}: the Signing Service, Key Management, and the Validator.
What is the difference between signing and checking?
Signing creates an electronic signature on your document (done by ezSign together with the Signing Service and Key Management). Checking - done by the Validator - tells you whether an already-signed document is valid. You can check a document without signing anything.
Do my documents ever leave my network?
No. Only a secure fingerprint of each document is sent out to be signed; the document itself stays in your organization's network.
How do I sign in?
With your organization's single sign-on - the same login you use for other company systems. If you cannot sign in, ask your administrator whether your account has been given access.
Why are there two areas?
The operator area (for signing) and the administration area (for managing access and setup) are on separate web addresses so administration can be limited to trusted staff.