RPSIGN Terms of Use

These Terms govern the institutional website and the private RPSIGN platform. The platform organises documents, versions, participants, policies, events, authentication and technical evidence connected with authorised electronic-signature workflows. Operational access is not public and depends on credentials, invitation, a legitimate relationship or specific authorisation.

RPSIGN is primarily intended for the operator's own use and for authorised clients, signers and participants. The public website explains the project's architecture and legal/technical criteria; it does not constitute an automated offer to sell subscriptions or make the platform generally available to third parties.

Features requiring integration, an external provider or future implementation only become effective when actually enabled for the relevant workflow.

Platform

The RPSIGN environment used for authorised electronic-signature workflows.

Envelope

The logical structure linking a document, version, participants, roles, policies and workflow state.

Workflow initiator

An authorised person who prepares or initiates a document and identifies participants.

Signer

A person to whom an expression of intent or signature is attributed in a particular document.

Technical evidence

A record actually produced by a used mechanism, such as an event, hash, authentication record or relevant metadata.

Policy

A versioned set of rules defining controls and evidence required for a workflow.

Qualified electronic signature

An electronic signature using a digital certificate under the Brazilian ICP-Brasil infrastructure when such method is integrated and applicable.

User

A person authorised to access the website, an authenticated area or a workflow according to the assigned role.

A user accepts these Terms by entering an authenticated area, using credentials, accepting an invitation, proceeding in a workflow or otherwise clearly using the service. A visitor to the institutional website is subject only to provisions relevant to browsing, security, intellectual property and privacy.

A person acting for a company, client, represented person or other third party represents that they have adequate authority or legal basis to do so. RPSIGN does not grant representation powers and does not automatically validate powers of attorney, articles of association or corporate authority.

Where capacity, representation or the required legal form is uncertain, the parties should obtain appropriate advice before signing. RPSIGN organises the electronic medium; it does not replace legal analysis of the underlying transaction.

Account credentials, one-time codes, authentication factors and personalised access links are personal or tied to the intended recipient. They must not be shared with unauthorised persons. Users should take reasonable care of passwords, devices, e-mail accounts and other means used to access the platform.

Administrative accounts use their own controls, including TOTP multi-factor authentication where applicable. Administrative security should not be confused with signer-identification mechanisms used for a particular document.

RPSIGN may require re-authentication, revoke sessions or temporarily block credentials where compromise, inconsistent behaviour, excessive attempts or another material security concern is detected.

A workflow may involve an initiator, signer, representative, witness, reviewer or recipient. Receiving an invitation does not automatically establish legal authority or representation. Each assigned role should correspond to the real legal relationship.

The workflow initiator must correctly identify participants, review electronic addresses and choose an appropriate policy. If a participant has been incorrectly identified, the workflow may need to be cancelled, corrected or restarted.

A signer should review the document before expressing intent and should stop the process if the document, recipient identity or access method appears inconsistent or fraudulent.

The person who creates, uploads or manages a document remains responsible for its origin, legality, content, accuracy, version, purpose and the authority required to use any personal data or third-party information contained in it. RPSIGN does not automatically validate the legal content of contracts, powers of attorney, declarations or other instruments.

Documents subject to professional secrecy, contractual confidentiality, trade secrecy or another duty of reservation should only be uploaded where the sender is authorised to do so. Electronic processing does not remove confidentiality duties that apply outside the platform.

The initiator must ensure that the uploaded file is the version intended for signature. The system may preserve version identity and integrity; it cannot decide whether the underlying content is legally suitable for the parties' objective.

Brazilian law recognises different electronic-signature categories, but suitability depends on the act, parties, recipient and applicable legal or contractual requirements. RPSIGN does not guarantee that a particular method will automatically be accepted by every authority, court, registry, bank or private counterparty.

A signature without an ICP-Brasil certificate may combine evidence of authorship, intent and integrity, but legal classification does not arise merely from the number of verification codes or authentication steps. A qualified electronic signature, where applicable, requires an ICP-Brasil digital certificate and compatible technical integration.

Transactions requiring a public deed, registration, notarisation, qualified certificate or another special form remain subject to those requirements. RPSIGN does not automatically replace a notary, registry or certification authority.

RPSIGN may associate events, document-version identifiers, policies, metadata and hashes actually generated in a workflow. These records are intended to support later examination of sequence and technical consistency; they are not an absolute presumption that every factual statement in the document is true.

The ledger uses SHA-256 hash chaining to make inconsistencies with the recorded chain detectable. HMAC-SHA-256 authenticated checkpoints reinforce internal verification. An HMAC is not a digital signature, a checkpoint is not a trusted timestamp, and the chain alone cannot guarantee resistance to an attacker who gains complete control of all relevant data and secrets. External anchoring may provide stronger resistance when it is actually implemented.

Any future completion certificate or audit report must reflect only evidence actually collected. Such documents are not, by themselves, an ICP-Brasil certificate, notarial authentication, independent forensic report or guarantee of legal outcome.

Where a workflow requires a qualified signature, operation will depend on an actual integration with compatible components, the signer's own certificate and the ICP-Brasil rules then in force. References to A1 certificates during the regulatory transition, A3/A4, cloud signing, PAdES or validation describe conditional technical paths rather than a statement that every integration is already available.

An ICP-Brasil Electronic Seal, when used by a legal entity under applicable rules, is designed to support organisational origin and integrity. It should not be represented as the personal signature of a natural person.

E-mail, SMS, WhatsApp, biometrics, digital certificates, timestamps, storage or anti-abuse may depend on third-party providers. Their availability and technical terms affect only the components actually used.

RPSIGN may not be used for fraud, false identity, impersonation, knowingly unlawful documents, credential theft, unauthorised disclosure, malware distribution, rights infringement or any conduct contrary to law.

Unauthorised vulnerability scanning, security testing, reverse engineering, abusive automation, attempts to bypass rate limits, tampering with records or access to another organisation's environment are also prohibited.

Reasonable signs of abuse may result in preventive blocking, preservation of relevant records, technical investigation and, where legally required, communication with competent authorities.

Personal-data processing follows the Privacy and Data Protection Policy. Users who introduce third-party information must comply with applicable data-protection, confidentiality and professional-secrecy duties.

RPSIGN seeks to limit internal and technical access to what is necessary. Administrative capability does not authorise unrestricted reading of documents. Exceptional access should have a legitimate purpose such as requested support, security, legal compliance or exercise of rights.

Electronic format does not weaken confidentiality obligations. Users must not forward document links, access codes or files to unauthorised persons.

RPSIGN and ADDON code, architecture, interfaces, institutional texts, visual identity and documentation remain protected by applicable intellectual-property law and the rights of their respective owners. Platform access does not transfer those rights.

Unauthorised copying, commercial exploitation, sublicensing, extraction or reverse engineering is prohibited except to the extent mandatory law expressly allows it.

Documents uploaded by users remain under the ownership and responsibility of their legitimate rights holders. RPSIGN receives only the technical permission necessary to process them in the authorised workflow and preserve legitimately required records.

RPSIGN seeks to maintain availability and security consistent with its private purpose but does not promise uninterrupted operation, complete absence of defects or independence from external infrastructure. Connectivity, devices, browsers, hosting and third-party providers may affect operation.

The platform may undergo maintenance, vulnerability remediation, dependency updates or security-driven changes. Where reasonably possible, planned material interventions should be conducted to reduce impact on active workflows.

Support is provided within the existing institutional relationship. The public website does not offer a commercial public SLA, subscription support tier or contractual uptime guarantee to third parties.

Access may be suspended or revoked when the authorising relationship ends, a security risk exists, these Terms are violated, the responsible person makes a legitimate request, a legal order applies or preservation of the service requires it.

Suspending an account does not automatically delete documents, evidence or logs. Records may remain where necessary for legal obligations, exercise of rights, fraud prevention, incident investigation or another lawful retention ground described in the Privacy Policy.

When deletion is appropriate, retention rules should be followed and data should not be kept indefinitely without purpose.

Each participant is responsible for the actions they actually take and information they provide, subject to investigation of fraud, error or account compromise. The initiator is responsible for document choice, lawful submission and accurate recipient identification. The signer is responsible for the expression of intent actually made and should stop if there is reasonable suspicion of misuse.

RPSIGN is responsible for the service within the limits of applicable law, but it does not guarantee solvency of parties, later contractual performance, material truth of every statement, absence of defects in consent, legal suitability of a document drafted by a third party or universal acceptance of the selected signature method.

Nothing in these Terms excludes liability or mandatory rights that cannot lawfully be waived.

RPSIGN may record technical events, communications, versions, authentications and other data legitimately generated in a workflow. These records may help demonstrate history, sequence and technical context subject to applicable law and the limitations of each evidence type.

Operational communications may be sent by e-mail or another channel actually enabled for the workflow. Users should keep relevant contact details accurate and should not presume delivery when a known addressing error or manifest channel failure exists.

An electronic record remains open to challenge, adversarial examination and assessment by a competent authority. Evidential weight depends on the circumstances and evidence actually available.

These Terms may be updated for legal, regulatory, technical or operational reasons. The current version and revision date will remain available on this page. Material changes may be highlighted through an appropriate channel.

These Terms are governed by the laws of the Federative Republic of Brazil. Disputes are subject to the legally competent forum, without prejudice to mandatory jurisdiction rules or rights that cannot be excluded by agreement.

Questions about use of RPSIGN may be sent through the institutional contact form. Privacy requests should follow the Privacy Policy.