A qualified electronic signature can be issued on a cryptographic card or in the cloud, for example through SimplySign. These are not two different kinds of signature. In both cases, you use a qualified electronic signature, which has the legal effect equivalent to a handwritten signature.[1]
The practical difference is mainly where the certificate is held and how you use it from day to day.
A card works well in one prepared work environment. A cloud signature is useful when a document arrives outside the office, at a time when you do not have your usual computer with you.
Do not choose between a card and the cloud simply because one option sounds newer. First establish which documents you sign, which devices you use and how the signature will be used in the relevant process.
First, establish whether you need a qualified signature
Choosing the certificate medium comes second. It only makes sense once you know that a qualified signature is the appropriate solution.
It may be required because of legislation, a contract, a public authority, a system or the other party to the document. It is also required where a document must be in electronic form equivalent to written form.
The fact that a document is digital does not, by itself, mean that it needs a qualified signature.
If you want to compare the available methods first, read Trusted Profile, personal signature and qualified signature — what is the difference in Poland?
Once the requirements are clear, the practical question is how you want to use the signature every day.
A card: for work at a fixed desk
With a card-based option, the qualified certificate is held on a cryptographic card. To sign, you need the card, a reader, a computer and the appropriate software.
This option can work well if you:
- usually sign documents at one computer or in one regular workplace;
- have a prepared desk with a card reader;
- prefer to keep the physical card with you;
- have a predictable way of working and rarely sign documents outside the office.
If the Internet connection at your workplace is weak or unreliable, a card may be the more practical option. That does not mean every signing process is completely independent of a network connection. Check the requirements of the software you use, the recipient’s system and any document validation.
A card also brings routine tasks: looking after the card and reader, keeping the PIN and PUK codes safe, and maintaining the software and drivers. That is not a problem when you sign regularly in one place. It can become inconvenient when a document needs to be signed while travelling.
Keep the PUK code in a safe place from the start. Three incorrect PIN attempts can lock the card. You can unlock it with the PUK code in proCertum CardManager. Certum does not keep users’ PIN or PUK codes, so a lost PUK cannot be recovered.[2]
A cloud signature: when work is mobile
A cloud signature such as SimplySign does not require a physical card or reader connected to the device. You can use SimplySign on a phone, tablet or computer.[3] The certificate can be active on only one device at a time. A phone or tablet is an additional option that is not available with the card-based variant.
This option often suits people who:
- alternate between a computer, laptop and mobile device;
- sign documents outside the office;
- work remotely, visit clients or change workplace often;
- do not want to carry a reader and card.
A cloud signature needs Internet access when you sign. You still need to complete the application, verify your identity and install the required software.
In SimplySign, an OTP code is used during installation and when retrieving the certificate from the cloud. The PIN and PUK work on the same principles as with a card-based certificate. Do not share these codes or keep them together with the device.
SimplySign is the name of one specific Certum service. It is not a generic term for every electronic signature or every cloud signature.
Read more about this option: SimplySign — a qualified signature in the cloud.
Three situations that make the choice easier
You sign mainly at your desk
If most documents are signed on one computer, you have a fixed workstation and you do not mind using a reader, a card can be a convenient option. In this situation, keep the software up to date and make sure the reader works properly.
A document can arrive anywhere and at any time
If an agreement needs signing while you are travelling, at home, at a client’s premises or between meetings, a cloud signature usually gives you more freedom. You do not need to have the physical card, reader or computer with you.
You use different devices
Working on more than one device does not automatically rule out a card. It is worth considering how often you would need to move the reader, install software or look for the prepared workstation.
If you want to use the signature sometimes on a computer, sometimes on a laptop or on a mobile device, a cloud option may fit that way of working better. Remember that the certificate can be active on only one device at a time.
What neither option does for you
Choosing the signature option does not complete the whole process.
Even a correctly made qualified signature does not decide:
- whether the document has the right content;
- whether you are signing it at the right point in the process;
- whether the person signing can represent the company;
- whether the recipient requires a particular file format;
- whether the document was sent in a way the recipient can verify correctly.
This matters especially for agreements, company documents, public-authority procedures and exchanges with an overseas counterparty. A signature identifies the signer and protects the integrity of the document, but it does not replace representation rules or the requirements of a particular process.
How to choose the certificate medium without guessing
Before you decide, answer a few questions:
- Do I really need a qualified signature in my situation?
- Where do I usually sign: at one computer, in an office, at a client’s premises, at home or while travelling?
- Do I have Internet access where I work?
- Do I sign on one device or on several?
- Do I use systems or work with recipients whose requirements should be checked before I start?
- Do I prefer a physical card and reader, or would I rather use a phone?
- Do I know what activation, first use and later renewal will involve?
The answer will differ from one person to another. In one case, a card will be a simple and convenient solution. In another, a cloud signature will fit the person’s way of working better.
Summary
A card and the cloud are not a choice between a more or less important signature. In both cases, you use a qualified electronic signature. The difference is the certificate medium.
The choice concerns everyday work:
- a card makes sense when you work in a fixed, prepared environment;
- a cloud signature is useful when you need mobility and use different devices, while remembering that only one device can be active at a time.
First consider how you work. Then choose the medium that will not get in the way when you need to sign a document.
If you are unsure which option fits your situation, describe your process. I can help you establish whether you need a qualified signature and how to get started with the right option.
Sources
- [1] Regulation (EU) No 910/2014 (eIDAS) — consolidated version
- [2] Certum — proCertum CardManager: documentation and FAQ (official source in Polish)
- [3] Certum — electronic signature in the SimplySign mobile app (official source in Polish)
- [4] Certum — SimplySign installation guide (official source in Polish)