The 7 iron rules of QES: how to secure signatures and documents „for years to come”

From „verify first, sign later” to mandatory timestamping and LTV profile, we've put together practical rules that minimize disputes and make auditing easier. We also explain the difference between countersignature and co-signature, and suggest how to combine Certum Mini and SimplySign (proCertum SmartSign) in a single circulation.
The 7 iron rules of QES: how to secure signatures and documents „for years to come.”.
4-minute read Published: October 27, 2025

Best practices in digital trust services: how to sign smartly, securely and... without nerves

Digital trust services are a whole set of tools that allow:

  • confirm identity, 
  • Sign documents electronically (QES), 
  • affix qualified seals on behalf of the organization, 
  • as well as mark time (time stamp) 
  • and deliver electronically (ERDS) documents in a manner that has legal effect. 

 

They allow you to run your business fully digitally: from signing contracts, to accepting bids, to official paperwork - without printing, scanning or „signature visits.”.

More on digital trust services: Digital Trust Services - The Key to Online Security. A complete guide

Why do digital trust services simplify life and business?

It's simple because:

  • Finalize contracts faster - Contractors sign contracts, documents remotely, with legal force throughout the EU.
  • Lower costs and less operational risk - No more couriers and „lost original”.
  • Better evidence security - Electronic signature + time stamp + proper verification = strong material for a dispute.
  • Scalability of the process - It's easy to add more signers, configure roles and automate the workflow.

However, to ensure that this convenience does not turn into an evidentiary problem years later, it is worth sticking to a few ironclad rules.

Best practices - from the experience of podpisano.pl

1) Verify first, sign later

Before you add a second, third or fifth signature - the check if the first one is correct (certificate chain, status and signature profile).
With proCertum SmartSign, it's literally a moment. 

And if the first signature is defective, adding more only complicates the matter and increases the cost of repair.

2) Always include a time stamp

Qualified timestamp acts as policy for years. It makes proof of signature independent of the certificate's expiration date. 

  • Without a timestamp after the expiration of the certificate, questions begin. 
  • With a marker - you have an unambiguous answer: the document was signed then and there.

3) Determine what your procedure requires

  • If the policy says: „the second person acknowledges the signature of the first” - select countersigned by.

  • If the requirement is: „two document signatures” - use co-signature (a joint document with two signatures).

Sounds similar, but evidentially are different scenarios.

4) Take care of LTV (Long-Term Validation) profiles

Document „over the years”? Select PAdES (for PDF) or equivalents in XAdES/CAdES.

These profiles attach verification data so that the signature remains verifiable Even long after the certificate has expired.

5) Mixed environment? No problem

First signature by card Certum Mini, second mobile by SimplySign (or vice versa).

proCertum SmartSign will handle both Scenarios in a single workflow. This is convenient with distributed teams and different user preferences.

6) Audit and evidence trail

Keep verification reports and circulation logins (who signed/verified it, when, with what). When, after time, someone asks: „was this signature valid?, you shorten the discussion to minutes - You show the report and the topic is over.

7) Update the software

Current systems, controllers, trusted lists i applications (e.g., proCertum SmartSign) means fewer errors and more efficient verification. We know that „after all, it works” can be tempting - but it's the updates maintain digital trust At the required level.

How do trust services secure your business?

  • Traceability: known, who signed and with what (personal/professional certificate, organization seal).

  • Integrity: the document was unchanged From the signature - any modification is detectable.

  • Accountability: logs and verification reports build complete evidence trail.

  • Legal compliance: qualified signature/seal and time stamp meet requirements eIDAS EU-wide.

  • Resistance to the passage of time: LTV profiles and archiving policies maintain evidentiary value for the years.

Remember.

Digital trust is not magic - it's procedures, tools and consistency. 

A qualified signature is the foundation of document credibility.

But its durability is up to you.

Signature + timestamp + local archiving = secure document for years.

 

 

If you implement timestamp, LTV profiles, proper differentiation co-signature and countersignature, sort out the powers and archiving and you will be up to date with updates, you will gain efficient, fast and evidentially safe signing process.

Do you have questions, want to sort out policies, implement a qualified electronic seal or qualified signature? Write to us - we will help select a solution to your scale and risk.

Finally, an important piece of information: podpisano.pl is authorized partner Asseco Certum. As a result, we provide proven solutions (including. SimplySign, Certum Mini, proCertum SmartSign) and we support them with implementation practices in companies of all sizes.

Call us at

and we will put you in touch with one of our representatives available virtually nationwide.

Check also:

Do you need help?

Find what you're looking for