A Qualified Electronic Signature (QES) is the highest assurance level under eIDAS and is legally equivalent to a handwritten signature across EU member states. In SignNow, a QES combines strong identity verification with a qualified certificate issued by a Qualified Trust Service Provider (QTSP), plus a tamper-evident audit trail.
What is a Qualified Electronic Signature (QES)?
A Qualified Electronic Signature (QES) is an advanced form of electronic signature that:
Is uniquely linked to the signatory and capable of identifying them.
Ensures the signature is created using a secure, tamper-proof environment.
Is backed by a Qualified Certificate (a type of digital certificate), ensuring the authenticity and integrity of the signature.
A QES is equivalent to a handwritten signature in the eyes of the law in many countries, especially those following the EU's eIDAS regulation.
Benefits of Using QES
Highest Legal Standard: A QES is recognized as legally binding in many jurisdictions, such as the European Union.
Enhanced Security: QES ensures the identity of the signer and safeguards the integrity of the signed document.
Audit Trail: Each document signed with a QES includes a timestamp and a certificate that provides a complete audit trail, ensuring accountability.
Compliance: QES meets stringent legal requirements, making it suitable for sensitive documents like contracts, legal agreements, and government forms.
[NEW] Self-service verification: Once every signer has completed the document, signers and recipients get a certified copy and can verify the qualified signature themselves in Adobe Acrobat Reader or a public validation service, without asking the sender or support.
How to Access the QES Feature
📝 QES is available on Corporate (site license) plans only. It integrates with eIDeasy for identity verification and qualified certificates. Enabling specific authentication methods may require additional invoicing, depending on which options your team asks our Support to activate. Contact sales to learn more about volume-based discounts and unlock access.
Step 1
Together with our sales team, you will confirm:
Use cases where you need QES (e.g., HR, finance, public sector, cross-border contracting).
Countries where recipients must be qualified—based on local legislation.
Approved methods/providers that fit your business process.
We record this scope (country legislation, method, eligible resident countries, provider) so your rollout is clear and auditable.
Step 2
SignNow support team will:
Configure your organization with eIDeasy.
Enable the QES setting for your organization.
Once all scoping and billing details are confirmed, provisioning usually takes up to 1–2 business days.
Step 3
Your organization admin completes activation in Organization → Workflow settings by enabling QES and selecting the approved methods/providers.
QES setup is per organization; methods are enabled only for the countries and providers we’ve agreed on.
ZealID is disabled by default and is enabled only upon explicit request.
Your final setup will reflect exactly the authentication methods you approve (and are invoiced for).
How does QES work in SignNow?
When using QES in SignNow, the process involves the following steps:
Signer Authentication: The signer must authenticate their identity using methods such as an official ID verification process.
Qualified Certificate: The signer will need to have or obtain a Qualified Certificate issued by a trusted Certificate Authority (CA).
SignNow Integration: [NEW] Once the identity is verified, the document is signed with the signer's qualified certificate. When every signer has completed the document, signers and recipients receive a certified copy that keeps the qualified signature intact. (Was: "Once the identity is verified, and the QES is applied, the document is securely signed and sealed with a digital certificate.")
[NEW] Certified copy: The certified copy is the signed file exactly as it was signed, with nothing merged or re-rendered on top. See Getting and verifying the certified copy below.
Supported signature types once QES is enabled
1) SignNow eSignature
SignNow’s standard eSignature covers everyday agreements with a tamper-evident audit trail (timestamps, IPs, signer intent/consent) and document integrity seals. It’s fast to set up, mobile-friendly, and ideal for most business use cases; legality relies on process evidence rather than qualified certificates.
2) PDF-QES
PDF-QES applies a Qualified Electronic Signature directly to the PDF using a qualified certificate issued by a QTSP (via eIDeasy). The certificate and cryptographic seal are embedded in the file, so anyone can verify it in standard PDF readers. Use this when you need eIDAS-level, court-grade assurance with evidence self-contained in the PDF.
Once every signer has completed the document, the copy downloaded from the Thank You page, the document page, or the completion email keeps this qualified signature intact. Opened in Adobe Acrobat Reader, it shows the qualified signature with "Document has not been modified since this signature was applied". For details, see Getting and verifying the certified copy below.
3) Hash-based QES
Hash-based QES signs the hash of your document with a qualified certificate instead of embedding the certificate in the file. The original file never leaves your environment; verification pairs the file with QTSP evidence to confirm integrity and signer identity. This is great for very large files or non-PDF formats, and for workflows that prefer external evidence over modifying the file.
4) NOM-151 (Mexico)
NOM-151 adds a time-stamped conservation record (“constancia de conservación”) issued by an authorized provider to prove integrity and a date certain for electronic data/messages in Mexico. It complements eSignatures by anchoring when the content existed and that it hasn’t changed; think “legal timestamp + integrity seal,” not a signature type by itself.
The constancia is delivered as a separate .asn1 certificate file. Once every signer has completed the document, it arrives in a .zip archive together with the signed PDF.
Getting and verifying the certified copy
When a document is signed with QES or NOM-151, signers and recipients get a certified copy: the signed file exactly as it was signed, with nothing merged or re-rendered on top. Anyone who receives it can verify the signature themselves in Adobe Acrobat Reader or a public validation service such as an eIDAS validator.
Where to get it
There is nothing new to click. Once every signer has completed the document, the existing download options return the certified copy:
The Thank You page shown right after signing.
The document page opened through the View Document link in the completion email. This works for signers and senders.
The completion email itself, whether the document is attached or linked.
📝 The certified copy is available only after all signers have completed the document. Before that, downloads return the regular file. Signers who finish before others receive the certified copy in the completion email once the document is complete.
What you receive
A signed PDF can't be changed without breaking its signature. So when there is more than one file (the audit trail, uploaded attachments, the NOM-151 certificate, or the documents of a group), they come as separate files in a .zip archive instead of one merged PDF.
QES: a single PDF.
QES with history: a .zip with the PDF and the history as a separate file.
QES with uploaded attachments: from the document page, a .zip with the document and each attachment as a separate file. The Thank You page of a single document downloads the PDF without attachments.
NOM-151: a .zip with the signed PDF and the NOM-151 constancy (.asn1).
Document groups: from the Thank You page or the document page, a .zip with one file per document.
Completion email: a qualified document always arrives as a .zip archive; a document group arrives as one archive per document. The document ID is no longer printed on the emailed copy.
What works as before
Documents that are still in progress.
Downloads from the documents list.
Download With → Certificate of Authenticity.
API downloads.
Verifying in Microsoft Edge
Microsoft Edge on Windows may show a QES signature as not trusted, because the root certificates of some QES providers (Evrotrust, Adacom, B-Trust) are not in Microsoft's trust list. The signature is still valid: check it in Adobe Acrobat Reader or an eIDAS validator.
For NOM-151, Edge shows "Modified: Yes, allowed" because the signed fields are locked. This is expected.