Signing a document using Aadhaar eSign is a quick process - the user clicks a link, enters in their Aadhaar number and then the OTP. Although the process is straightforward, there is quite a lot of technology involved. Having a basic understanding of how it works will help give you more confidence and identify any poor processes.

 

What needs to be proven

When signing a document (physical or digital), you have to prove who signed, that they intended to sign and that the document hasn’t been changed after signing. A scribble on paper doesn’t prove this very well. An e-signature can prove this better if done correctly.

1. Document has been hashed

 When uploading your PDF to sign, your document is not passed around to be verified. Instead, a hash is created. This is an abridged version of your document, containing a unique identifier. If you alter anything (even a comma) the hash will change completely. This means we can prove whether it has been altered after signing.

2. Identity has been proven

 The signer clicks the sign link, and grants consent to use their Aadhaar to authenticate their identity. The user will enter their Aadhaar/Virtual ID, and an OTP will be sent to the Mobile number attached to this Aadhaar. They will enter in their OTP to prove their identity. This is commonly the reason why eSign fails - as they may not have an Aadhaar linked to their mobile.

 

3. Trusted service provider signs document

An authorised eSign service provider verifies that the identity has been confirmed via the Aadhaar system. They create a temporary digital certificate for this sign, and sign the hash. This certificate is only used once.

 

4. Sign added to document

The sign is added with additional information to the document, such as the name of the person who signed, time of signature and certificate details. When opened in a PDF reader, you can usually see the signature box. This allows you to see if the document has been altered.

 

5. Audit trail

If you are using a good platform, you will have an audit trail. This will include who was invited, when the link was opened, when they gave consent and when they signed. If there are any questions about the sign, this will answer most of the questions.

 6.e-stamping

Some agreements require you to pay stamp duty. This varies between the states, however, many allow for e-stamping. This means you can pay your stamp duty online, and it can be tied to your document. This means you can stamp and sign in one flow.

 What a good eSign process includes:

  •  Clear consent screen showing what they are consenting to
  • Aadhaar authentication via an authorised service provider
  • Tamper proof signed PDF
  • Downloadable audit trail
  • Ability to e-stamp where required
  • Ability to track who has viewed and signed.

The technology behind digital onboarding

Typically digital onboarding requires a customer to sign something. Businesses will typically run checks on their customers using KYC, PAN and Aadhaar verification. This is often automated with API based platforms. At ZoopSign we have focused on the signing portion of this flow with our Aadhaar eSign, e-stamping and document tracking features. This allows businesses to onboard loans / onboarding / vendor agreements in a paperless process.

 

What it can’t be used for

 There are certain documents you cannot e-sign, such as wills, trusts, powers of attorney and contracts for the sale of immovable property. This is outlined in the IT Act. Rules can vary, so check what type of document you have. If the stakes are high, seek legal advise.

 Best practices to keep your eSigned document secure

  •  Read through the whole document before consenting.
  • Never share your OTP, even if they say they are trying to help.
  • Save the signed document and audit trail together.
  • Open the signed PDF once to confirm the signature is showing as valid.