Secure Virtual Signature

About

Virtual Signatures are electronic versions of your physical signature. However, they lack certain technical safeguards: they can't definitively verify the identity of the signer, nor can they detect document alterations post-signing.

To counter these weaknesses, Secure Virtual Signatures have been developed. They provide added layers of authentication to enhance security, such as:

1. OTP Authentication: Mandatory authentication via phone/Email/Whatsapp before accessing the virtual signing pad.
2. Additional optional layers of authentication such as Face and GPS Capture
3. Multi-factor Authentication: An optional feature for further security.
4. Secured via neutral digital signature: The service provider affixes their digital signature in the backend to protect the document being signed from being tampered without knowledge.

Secure Audit Trail: The signature event and document details must be meticulously recorded in a secure, digitally signed audit trail

Legal validity

Under Section 10A of the Information Technology Act, 2000, a contract signed with a Secure Virtual Signature is legally enforceable in India, with two exceptions. Secure Virtual Signatures can't be used to sign:

1. Documents specified in the First Schedule of the IT Act, 2000.
2. Any document that must, by law, rule, or regulation, be signed (here the law, rule or regulation must specifically use the word “sign”, “signed” or “signature”. Most contracts do not fall under this bracket)

Here is a handy table which tells you where can you legally use Secure Virtual Signatures:

eSign type

A document which must mandatorily be signed under any law, rule or regulation

Documents listed in the First Schedule of the IT Act

ALL other types of documents

Secure Virtual Signature

eSign type

Secure Virtual Signature

A document which must mandatorily be signed under any law, rule or regulation

Documents listed in the First Schedule of the IT Act

ALL other types of documents

Legal enforceability

The legal enforceability of any eSign type depends on:

1. How well it can establish the identity of the signer (Authentication)
2. Whether the document can be altered after the signatures are affixed (Integrity)
3. Whether the parties can deny their acceptance of the terms and conditions at a later stage (Non-repudiation)

A Secure Virtual Signature is easy to enforce because it performs these 3 functions very well.

eSign type \ Goal

Authentication

Integrity

Non-repudiation

Secure Virtual Signatures

• OTP verification, Face and GPS capture work together to establish a “virtually irrefutable” trail of identity.

• If the Secure Virtual Signature is secured by affixing a neutral digital signature, then it acts as a security procedure under the IT Act to ensure that the document cannot be altered or modified without alerting the parties.

• Added security layers make it extremely hard for signers to repudiate their Secure Virtual Signatures.

eSign type \ Goal

Virtual Signatures

Authentication

• OTP verification, Face and GPS capture work together to establish a “virtually irrefutable” trail of identity.

Integrity

• If the Secure Virtual Signature is secured by affixing a neutral digital signature, then it acts as a security procedure under the IT Act to ensure that the document cannot be altered or modified without alerting the parties.

Non-repudiation

• Added security layers make it extremely hard for signers to repudiate their Secure Virtual Signatures.

To dispute or deny a document signed via Secure Virtual Signature, the other party would need to:

1. Deny and prove that the OTP was not authenticated on a device/email in their possession
2. Deny and prove that the signature impression was not performed by them
3. Deny and prove that they were not present for signing even though their face has been captured (in case of optional layer of Face Capture)
4. Deny and prove that they were not present for signing even though their GPS coordinates were captured (in case of optional layer of GPS Capture)
5. Deny and prove that they did not possess and authenticate the document via their alternate contact coordinate (in case of optional Multi Factor Authentication layer)
6. Deny and prove that the entire series of events captured by the Secure Audit Trail are false

Doing all of the above is extremely hard to do - making Secure Virtual Sign a highly enforceable form of electronic signature.