How is my data protected when signing remotely?

Remote signing processes two categories of data: identity data for certificate issuance, and the documents to be signed or their hash values. Both fall under the General Data Protection Regulation (GDPR).

Qualified trust service providers are additionally subject to the security and supervisory obligations in Chapter III of the eIDAS Regulation and are audited regularly by a conformity assessment body. For a data protection assessment, however, what matters most is which data reaches the provider at all.

Here's how data protection is implemented in remote signing:

• Data minimisation through hash signing: With hash signing your application computes the hash locally and transmits only that value. The document content never leaves your system boundary.
• Processing location: For a GDPR assessment what counts is where processing happens and which law the provider is subject to — not only where the servers stand.
• Group structure: Providers with a parent company outside the EU may be exposed to third-country access even with European hosting.
• Data processing agreement: An agreement under Article 28 GDPR governs purpose limitation, instruction rights and sub-processor relationships.
• Retention periods: Signing logs and identity evidence carry their own retention obligations, which must be documented.
• Encryption: Transmission and storage are encrypted; signing keys reside exclusively in the certified HSM.

What to check during evaluation:

• Provider jurisdiction: Ask about the registered office and group structure, not only the data centre location.
• Verifiable certifications: Conformity reports and certificates should be publicly retrievable and current.
• Hash signing as an option: Check whether the provider supports hash signing — often the single most effective data protection measure.

primesign is operated by CRYPTAS International GmbH, headquartered in Austria, with EU hosting and locations in Vienna, Graz, Düsseldorf, Hengelo and Stockholm. Through the HASH SIGNING API, documents can be signed without their content ever reaching primesign; the related data protection and conformity documents are published in the primesign Trust Center.