Security with technical precision
RPSIGN combines security controls already incorporated into the platform with an evidence architecture prepared for different electronic-signature modalities. On this page, we distinguish existing administrative controls, resources that depend on the modality used, and integrations that require specific implementation, a contracted provider or technical validation.
Technical controls and record integrity
Security is built in layers. No single mechanism eliminates every risk; the goal is to reduce exposure, restrict access, preserve context and enable inconsistencies to be detected.
Chained cryptographic ledger
Relevant events are recorded in an organization-specific ledger and linked through SHA-256 digests. Changes incompatible with the expected sequence can be detected by checking the chain. Chaining by itself does not prevent an actor with full control of storage from attempting to recalculate records and hashes.
Authenticated checkpoints
The ledger state may be summarized in versioned HMAC-SHA-256 authenticated checkpoints. HMAC strengthens verification of checkpoint integrity and authenticity, but it is not a digital signature or a time stamp issued by a Time-Stamping Authority.
Versioned policies and immutable documents
Policies are versioned to preserve the set of rules associated with each operation. Documents and versions are modeled to remain immutable, preventing a later version from silently replacing content previously recorded.
Robust administrative authentication
Administrative accounts use mandatory MFA/TOTP, recovery codes, sessions protected by opaque tokens, rotation and revocation, as well as deny-by-default RBAC access control and organization-level isolation. These controls protect platform administration and are not equivalent to authenticating or identifying a signer.
Evidence architecture
The platform was structured to associate events, policies, document versions and technical evidence with the corresponding workflow. What is actually available in each operation depends on the modality used, the controls activated and the integrations technically validated and enabled for that workflow.
Privacy in the architecture
The platform design uses purpose, necessity, minimization, access control, defined retention and organization-level segregation as design criteria. Resources involving sensitive data require additional assessment of risk, proportionality and safeguards.
Ledger, checkpoints and external anchoring
Hash chaining can detect incompatibilities in the chain, but by itself does not provide absolute resistance to a total compromise of the database and application keys. Authenticated checkpoints add another verification layer. To increase resistance to full environmental compromise, the architecture contemplates anchoring to an independent external destination; that destination must be defined and operational before it is presented as an active production control.
Signature without a digital certificate
An electronic signature without an ICP-Brasil certificate may bring together different evidence of authorship, expression of intent and integrity. Legal classification depends on the technical set actually used in each operation — not merely on the number of verification steps.
Layers that may compose a workflow
- verification by email, SMS or WhatsApp;
- CPF validation and document validation;
- geolocation, when authorized by the device;
- technical device and session data;
- selfie, facial biometrics and liveness detection;
- date-and-time records and event history;
- verification of document integrity and its versions.
What combining evidence means
Each layer depends on the selected modality, technical availability, the applicable policy and, where necessary, a contracted and technically validated provider. Using two codes, for example, does not automatically make a signature advanced.
A signature without an ICP-Brasil certificate is not a qualified electronic signature. Its evidentiary weight arises from the evidence actually collected, demonstrable integrity, the relationship between the parties and the circumstances of the concrete case.
Biometrics require their own controls
When this modality is adopted
Biometric workflows may involve document validation, selfie, liveness detection, facial comparison, technical scores and review procedures. The exact composition depends on the provider, purpose and policy defined for the operation.
Biometrics should not be treated as infallible. False positives, false negatives, capture quality and environmental conditions need to be considered, with a review mechanism where necessary.
Sensitive personal data
Biometric data linked to a natural person are sensitive personal data. Adopting this resource requires analysis of necessity, adequacy, proportionality, risks, security, transparency, retention and data-subject rights. It is not correct to assume that only a “result” will be stored: the final architecture and provider may involve images, documents, templates, scores and review records.
Simple, advanced and qualified signatures
Brazilian Law No. 14,063/2020 classifies electronic signatures into three levels for the purposes provided in that law. This taxonomy is also useful for explaining technical differences, but whether a signature is admissible in a concrete operation depends on the applicable law, the recipient and the requirements of the act.
| Level | Characteristics | Essential requirements | Validation method |
|---|---|---|---|
| Simple | Allows the signer to be identified and electronic data to be associated with other electronic data used by that signer to sign. | Identification and association of the data with the electronic act, subject to the rules applicable to the operation. | Examination of the mechanism used, the context and the available evidence. |
| Advanced | Requires unique association with the signer, a high level of confidence in the signer’s control of signature-creation data and the ability to detect subsequent modification of the associated data. | The technical set must satisfy the legal characteristics; multiple authentication channels alone are not enough for classification. | Verification of evidence of authorship, control, integrity and linkage to the signer. |
| Qualified | Uses a digital certificate within ICP-Brasil. | Use of a digital certificate within ICP-Brasil, subject to the applicable technical and regulatory requirements. | Cryptographic validation, certification chain, revocation status, signature policy and other applicable ICP-Brasil requirements. |
What a qualified signature does not solve by itself
Under Article 10, paragraph 1, of Provisional Measure No. 2,200-2/2001, documents produced through a certification process made available by ICP-Brasil carry a presumption relating to statements attributed to the signers. That presumption does not automatically prove the material truth of every statement in the document, cure legal incapacity, an unlawful object or a defect of consent, dispense with a special form required by law, guarantee automatic acceptance in every system or, by itself, turn any document into an enforceable instrument.
Qualified signature and Electronic Seal
The RPSIGN architecture contemplates future integration with ICP-Brasil mechanisms, respecting the distinction between the signer’s personal signature and an electronic seal issued to a legal entity.
Qualified signature of the signer
When integrated, each signer will use their own ICP-Brasil certificate. The interoperability design considers A1 software/file certificates during the regulatory transition period, A3/A4 certificates intended for natural persons in token, smart card or another modality admitted by ICP-Brasil, cloud-held certificates when admitted by ICP-Brasil and the contracted provider, and PAdES-ICP-Brasil signatures for PDF documents.
Validation should consider the certification chain, revocation status, signature policy and, where contracted, a time stamp issued by an accredited Time-Stamping Authority. Compatibility should also be checked using the ITI VALIDAR service.
ICP-Brasil Electronic Seal
The Electronic Seal is intended for legal entities and is designed to prove the origin and integrity of electronic documents linked to the organization. It does not represent a personal signature or an expression of intent by a natural person.
Documents, evidence certificates or reports automatically produced by the platform may, when the integration is adopted, use an ICP-Brasil Electronic Seal to strengthen proof of organizational origin and integrity.
ICP-Brasil regulatory transition
According to regulations and guidance currently published by the ITI, A1 certificates may be used until March 2, 2029. From March 3, 2029, types A1, A2 and S1 through S4 cease to be usable. A3 and A4 signing certificates are intended exclusively for natural persons, while software (SE-S) and hardware (SE-H) Electronic Seal certificates are intended for legal entities.
Legal references for electronic documents
Freedom of form — Brazilian Civil Code, Articles 107 and 108
Article 107 establishes, as a rule, that the validity of an expression of intent does not depend on a special form unless the law expressly requires one. Article 108 is an example of a situation in which a public deed is essential for certain real-estate transactions.
An electronic expression of intent may be used when the law and the nature of the act allow that form, subject to the applicable specific formalities.
Provisional Measure No. 2,200-2/2001 — authorship and integrity
Article 10, paragraph 1, provides for a presumption regarding statements contained in electronic documents produced through a certification process made available by ICP-Brasil, in relation to the signers. Paragraph 2 preserves the use of other means of proving authorship and integrity, including without an ICP-Brasil certificate, when admitted by the parties or accepted by the person to whom the document is presented.
Brazilian Code of Civil Procedure, Article 105 — powers of attorney
The Brazilian Code of Civil Procedure allows a power of attorney to be digitally signed in accordance with the law. The appropriate modality should consider the instrument, the powers granted and any legal, judicial or destination-system requirements.
Special powers, such as admitting facts, acknowledging the merits of a claim, settling, withdrawing, waiving a right, receiving funds, giving a release, entering into a commitment and signing a declaration of financial hardship, must be set out in a specific clause.
Brazilian Code of Civil Procedure, Article 784, paragraph 4 — extrajudicial enforceable instrument
For enforceable instruments constituted or certified electronically, the law allows any electronic-signature modality provided by law and permits witnesses to be dispensed with when integrity is verified by a signature provider.
This rule does not automatically turn every electronic contract into an enforceable instrument. The obligation must satisfy the other legal requirements, integrity must be demonstrable and concrete application may be reviewed by a court. The RPSIGN architecture should not be confused with a claim that the platform already performs, operationally, every legal and technical function of a signature provider.
Platform evidence, digital certificate and seal
| Term | Purpose | Limits |
|---|---|---|
| RPSIGN Completion Certificate | Evidence document contemplated to gather technical information from a completed workflow, according to the modality and controls actually used. | It is not an ICP-Brasil digital certificate, notarization of a signature, notarial authentication or automatic proof of the material truth of statements. |
| RPSIGN Audit Report | Technical report contemplated to gather events, evidence and verifications available in the workflow. | It is not an independent audit, notarial authentication or, by itself, a time stamp issued by an accredited Time-Stamping Authority. |
| Electronic signature without ICP-Brasil | Modality based on electronic data and evidence of authorship, expression of intent and integrity, according to the means actually used. | It is not an ICP-Brasil qualified signature and does not automatically receive the presumption provided by Article 10, paragraph 1, of Provisional Measure No. 2,200-2/2001. |
| Qualified electronic signature | Signature that uses a digital certificate within ICP-Brasil. | Integration with ICP-Brasil certificates and signing components depends on appropriate implementation, interoperability and technical validation. |
| ICP-Brasil Electronic Seal | Certificate intended for a legal entity to prove the origin and integrity of an electronic document. | It is not the representative’s personal signature and does not replace an expression of intent by a natural person where such expression is legally required. |
Two validation layers
Independent ICP-Brasil validation
When there is an ICP-Brasil signature, validation should be independent of the RPSIGN interface and should consider the signature format, including PAdES for PDF, the certificate chain, revocation status, signature policy and a time stamp where one exists.
The ITI VALIDAR service is a public reference for checking compatible electronic signatures.
RPSIGN validation
The architecture contemplates its own verification by code, QR Code or PDF upload, including recalculation of the hash, comparison with the registered document, verification of the ledger and, where external anchoring is operational, checking the corresponding checkpoint.
Signature and integrity validation demonstrates technical aspects of the document and workflow; it does not, by itself, prove the material truth of every statement contained in the document.
Data protection and responsibilities
RPSIGN adopts purpose, adequacy, necessity, minimization, security, transparency, access control, defined retention and exercise of data-subject rights as design criteria. Controller and processor responsibilities must be determined according to the concrete operation and the relationship between the user organization, the platform and any providers.
Data such as IP address, device information and geolocation should only be collected when contemplated for the modality, technically available, necessary for the purpose and processed according to the applicable policy. Geolocation also depends on device permissions and capabilities.
View Privacy pageBiometrics and Article 11 of the LGPD
Biometric data are sensitive personal data. The legal basis in Article 11, II, “g”, of the LGPD may apply to fraud prevention and the security of the data subject in identification and authentication processes, provided that the legal requirements are present in the concrete operation and the data subject’s fundamental rights and freedoms are preserved. This legal basis should not be treated as automatic.
The ANPD continues to include biometric data among relevant topics in its regulatory agenda and highlights specific risks associated with biometrics and facial recognition.
Official sources and technical review
This page uses as regulatory and technical references the Brazilian Presidency’s Legislation Portal, the National Institute of Information Technology (ITI), the VALIDAR/ITI service and the Brazilian National Data Protection Authority (ANPD).
Last technical and regulatory review: August 17, 2026.
The information is institutional and explanatory in nature. The validity, admissibility, required form and evidentiary weight of a document depend on the applicable law, the content of the act, the signature modality actually used, the available evidence and, where appropriate, the assessment of the recipient or the Judiciary.