Sign2x Provider Comparison for Electronic Signatures

There are now many providers of electronic signature solutions on the market. The table below provides an overview of a selection of these providers. The comparison focuses on the primary use case: electronic signatures applied by a natural person.
 

1 on Premise; 
2 Verifikation von physischen Personen; 
3 App/API; 
4 portiQ, sign-me-API; 
5 DocuSign Security Appliance 

A look at the eIDAS column shows that all listed providers offer a Qualified Electronic Signature (QES). Some providers focus exclusively on this functionality, as it is the only type of electronic signature that is legally recognized as the equivalent of a handwritten signature.

When it comes to verifying electronic signatures, not every provider is forthcoming in making the necessary information available on their website. Some providers, such as DocuSign and Yousign, offer their own verification services linked to their respective EUTL-listed Trust Service Providers (TSPs). Others, such as d.velop and Sign2x, perform verification through the TSPs with which they cooperate.

It should be noted that the EUTL facilitates interoperability at the trust level. However, the technical integration of Qualified Trust Service Providers (QTSPs) remains vendor-specific.

In combination with a suitable identity provider and its associated QTSP, Sign2x can also support processes designed to meet Anti-Money Laundering (AML) requirements. Identity verification is carried out using validated procedures provided by the identity provider, while the electronic signature is secured through the connected Qualified Trust Service Provider.

This enables fully digital customer journeys in which identity verification, evidence collection, and the signature process are seamlessly integrated without media disruption. Depending on business and regulatory requirements, processes can be implemented for simple, advanced, or qualified electronic signatures.

Sign2x therefore provides the technical foundation for deploying trusted digital signature processes, even in regulated use cases. Compliance with AML requirements depends on the identity verification method used, the selected identity provider, and the overall design of the business process.

Many providers state that their servers are located within the European Union or explicitly identify the hosting country. For providers headquartered in the United States, either no information is provided (Adobe, Sign) or reference is made to operating an EUTL-listed server in France, without mentioning that the U.S. CLOUD Act may potentially conflict with GDPR data protection requirements.

If the target solution is required to operate on-premises, the number of available providers is significantly reduced. For D-Trust and DocuSign, this is only possible for specific components of their respective offerings: portiQ and sign-me API (D-Trust), and the DocuSign Security Appliance (DocuSign). No such restrictions for on-premises deployment are specified for Moxis and Sign2x.

If the requirements are that the solution must run on servers located within the EU, GDPR compliance must not be compromised, and the solution must be operated on-premises, only D-Trust, Moxis, and Sign2x remain as viable options.

When full data sovereignty is the key requirement, Sign2x is the only remaining solution.

Further information can be found at: