Identity governance and data sovereignty in digital signing

Question 1: Where is data processed?

The GDPR requires additional safeguards for transfers to third countries, so many organisations prefer processing exclusively in the EU or Germany. Ask about data-centre locations, backups and sub-processors – including support and monitoring.

DE-CODA SIGN is operated in a German data centre with ISO 27001 based on IT-Grundschutz. ISO 27001 describes a certifiable information security management system.

Question 2: Who can access documents?

Clarify how roles and permissions are assigned, whether documents are stored encrypted and how long they remain on the platform after completion. Retention and deletion rules should match your own obligations, and you should be able to export signed documents fully into your archive.

Under the GDPR you need a data processing agreement (Article 28) with the provider describing technical and organisational measures.

Question 3: How is identity verified?

Identity verification determines a signature's evidential value. An SES often relies on email verification; an AES adds a second factor. For a QES, eIDAS requires verification by a qualified trust service provider – for example via online ID or video identification.

Under eIDAS 2, European Digital Identity Wallets (EUDI Wallets) are expected to become an identification method. National implementation is still in preparation.

Question 4: What evidence is produced?

A robust audit trail records every step – sending, opening, authentication, signing and completion – each time-stamped. With AES and QES the signature is cryptographically bound to the document; any later change is detected on validation.

Make sure audit reports can be exported and signatures can be validated with standard tools.

Roles and responsibilities

Data sovereignty is not just an IT task. Define who owns the signing platform, who maintains templates and who grants permissions. A small working group from the business unit, IT, data protection and legal works well.

The data protection officer should review the processing agreement and update the record of processing activities. For particularly sensitive data, such as health or HR data, a data protection impact assessment may be appropriate. IT handles integration with identity management, single sign-on and archive systems.

Also define a leaver process: access must be revoked promptly, open transactions handed over and personal certificates revoked. Regular permission reviews – for example every six months – ensure only active, authorised people can access documents.

Provider selection checklist

• Processing in Germany or the EU, including backups. • Data processing agreement and list of sub-processors. • Evidence of information security, e.g. ISO 27001. • Role, permission and deletion concept. • Support for every signature level you need. • Exportable audit trail and standards-based signatures. • Contacts in your language and time zone.

Frequently asked questions