# Digital Identity & Security

> Configure signer verification, PDF certificates, cryptographic timestamps, encryption, and audit evidence in WPsigner.

edition: both
Edition: Lite + Pro
AI note: This page applies to Lite and Pro. Call out Lite limits (PDF only, max 2 signers, email OTP, local timestamp) when they apply. Do not invent Pro-only features.
HTML: https://docs.wpsigner.com/digital-identity/
Markdown: https://docs.wpsigner.com/md/digital-identity.md
Source file: digital-identity/index.md

---

WPsigner supports **signer verification**, **cryptographic timestamping**, and **tamper-evident audit trails**. These features strengthen the evidence associated with signed documents and can support a broader compliance program.

---

## Guides

| Guide | Description |
|-------|-------------|
| [Digital ID (.p12)](/digital-identity/digital-id/) | Import or generate PKI certificates to embed a digital identity into every signed PDF |
| [Timestamping (TSA)](/digital-identity/timestamping/) | Add RFC 3161 timestamps from a trusted authority to prove exactly when a document was signed |
| [Audit Trails](/digital-identity/audit-trails/) | Automatic logging of every action — IP addresses, device info, timestamps, and geolocation |
| [Security & Compliance](/core-features/security-compliance/) | Configure OTP, KYC, access codes, evidence capture, and policy modes |

---

## Why It Matters

Electronic signatures are legally valid in most jurisdictions, but the strength of that validity depends on the evidence you can provide. WPsigner's digital identity features create multiple layers of proof:

| Layer | What It Proves | Technology |
|-------|---------------|------------|
| **Digital Certificate** | Which certificate sealed the completed PDF | X.509 PKI, .p12/.pfx |
| **Timestamp** | When they signed (independently verified time) | RFC 3161 TSA |
| **Audit Trail** | What happened (complete event history) | SHA-256 hashed log entries |
| **Document Hash** | The document wasn't altered after signing | SHA-256 integrity check |

Together, these layers can help provide evidence relevant to **ESIGN**, **UETA**, **eIDAS**, and other electronic-signature frameworks. The required controls depend on the transaction, identity method, provider, and jurisdiction.

---

## How They Work Together

```
Signer Opens Document
        ↓
Signer gates completed (when configured)
        ↓
Signature Captured (drawn, typed, or uploaded)
        ↓
Timestamp Requested (TSA server certifies the time)
        ↓
Audit Trail Updated (action logged with IP, device, hash)
        ↓
PDF Sealed (certificate + timestamp embedded in the file)
```

The final PDF contains the digital certificate, the timestamp token, and a reference to the full audit trail — all embedded directly in the file for independent verification.

---

## Getting Started

- **Start with [Digital ID](/digital-identity/digital-id/)** if you want to embed cryptographic identity into your signed PDFs. You can use a self-generated certificate or import one from a Certificate Authority.
- **Add [Timestamping](/digital-identity/timestamping/)** to prove the exact signing time through an independent third party. WPsigner supports any RFC 3161-compliant TSA.
- **Review [Audit Trails](/digital-identity/audit-trails/)** to understand what WPsigner logs automatically and how to access the trail for compliance or disputes.

> **tip**
Choose controls according to transaction risk. A certificate, trusted timestamp, signer-verification gate, and detailed audit trail provide complementary evidence, but unnecessary identity checks can increase friction and privacy obligations.