How does Sealique seal and audit signed documents?
Every sealed PDF gets a platform certification seal and one PAdES digital signature per signer, its fingerprint is stored, and every step is written to a hash-chained audit log.
This page describes what actually happens when a document is sealed, in the order the code does it, so that auditors, procurement teams and developers can judge the evidence for themselves. Sealique makes no claim it cannot show on the verification page: there is no external timestamp authority and no qualified trust service provider; the seal is issued by the platform's own Root CA and the signing time is the server's time, recorded in the audit log.
Verify a sealed PDF Verify a signed document
Key facts
- Sealing applies a platform certification signature (DocMDP) first, then one PAdES approval signature per signer, from identities issued under the Sealique Root CA.
- The sealed file's SHA-256 fingerprint, a fingerprint of every page and a hash of every page's text are stored and compared on verification.
- Every event on a document (sent, opened, consented, one-time code, signed, sealed) is written to an audit log where each entry carries the hash of the previous one.
- Before signing, each signer accepts two consent statements (intent to sign, electronic records); an e-mail one-time code can be required per document.
- Verification is online only: scan the QR code, type the verification ID or upload the PDF; the sealed copy and the certificate of completion are downloadable by the document's holders only.
What happens when a document is sealed?
Once every signer has signed, Sealique renders the final PDF with the signature blocks and page marks, embeds the verification ID in the document metadata, and computes a fingerprint of every page. It then applies the platform certification signature, which locks the document against changes other than form filling, followed by one PAdES approval signature per signer as incremental updates. If any signature fails, nothing is stored and the document stays in its previous state: sealing fails closed.
The sealed file's SHA-256 hash and a hash of every page's text are stored with the verification record, together with the head of the audit chain at that moment. A certificate of completion, itself PAdES-signed by the platform, is generated and stored as a separate PDF.
Who issues the signing certificates?
The Sealique Root CA, a private certificate authority whose key material is encrypted at rest with a key that is separate from the application secret. The root issues a platform identity (the seal) and one identity per signer, guests included, re-issued before expiry and revocable. Sealique is not an accredited or qualified trust service provider; where a law or counterparty requires a qualified certificate, that certificate must come from such a provider.
How is the audit log protected?
Each document has its own chain of events. Every entry stores a sequence number, the hash of the previous entry and its own hash computed over the action, actor, time, IP address, user agent, device evidence and metadata. Entries cannot be edited or deleted through the application, and the chain can be re-verified at any time; the certificate of completion prints the chain head that existed when the document was sealed.
How is the signer identified?
Each signer receives a personal link at their own e-mail address. Before signing they must accept the intent-to-sign and electronic-records statements, whose text and hash are stored with their IP address and user agent. When the sender switches on the one-time code, a six-digit code is e-mailed and must be entered before the document can be signed; attempts are limited and throttled. The browser's language, client hints and a client fingerprint are recorded as device evidence.
How does verification work, and what is public?
The public verification page accepts a QR code scan, a typed verification ID or an uploaded PDF. It validates every PAdES signature against the platform's trust roots, compares the file's fingerprint with the stored one and classifies the result: authentic, modified after sealing, tampered, flattened copy, unsigned or unknown. The page shows the signers' names, titles and organisations with masked e-mail addresses. Downloading the sealed PDF or the certificate of completion requires being a holder of the document: the sender, a signer or someone it was shared with.
Where are documents stored and who can read them?
Documents live in private storage, never on a public link; transport is HTTPS only. Only the owner, the signers and the people the owner shares with can open a document, and platform administrators never see document contents. Sealed documents are never deleted outright: deletion archives the working copies while the sealed PDF, the certificate and the audit chain are retained as evidence. Every account holder and Sealique accept the same Data Protection Agreement.
What Security and trust includes
- Platform certification seal plus PAdES signature per signer
- Fail-closed sealing: no partial seals
- Hash-chained, append-only audit log per document
- Consent statements and optional e-mail one-time code
- Device evidence: IP address, user agent, client hints
- Online verification with public result and private downloads
Questions people ask
Does Sealique use a trusted timestamp authority?
No. The signing time is the server's time, recorded in the audit log and in the signature; no external timestamp authority is used.
Is the Sealique Root CA recognised by governments?
No. It is a private certificate authority; the signatures are verifiable online by anyone, but they are not qualified signatures under eIDAS or a national accreditation.
Can an administrator change a sealed document or its audit log?
No. Sealed files are stored read-only, audit entries are hash-chained and refuse edits, and administrators never see document contents.
What does the one-time code add?
Proof that the signer controlled the e-mail address at signing time; the code is hashed, expires after a few minutes and attempts are limited.
Why can I not download the sealed PDF from the verification page?
The verification result is public; the document itself is private to its holders, so the download appears only when you are signed in as one of them.