Trusted Signatures is the document-trust layer that connects cybersecurity controls to legal rigor and financial protection. We apply PKI-based, standards-compliant PDF seals that are tamper-evident and auditable, so critical files hold up in reviews, audits, and cash-flow processes. (Built on ISO 32000 PDF signatures with DocMDP permissions, legal attestation, timestamping, OCSP/CRL, and version-comparison capabilities.)
Our mission: Make verifiable documents the default for business — simple, affordable, and ubiquitous.
Publisher applies an organizational cryptographic seal to your PDFs so recipients can confirm origin and detect any tampering directly in Adobe Acrobat/Reader and other PAdES-aware viewers. Your documents never leave your environment—we sign a cryptographic digest, not your file.
What recipients see:
Built-in assurances:
How it fits your workflow:
See Pricing to learn more about our pay-as-you-go, no license fees model and use an estimator to predict your costs.
An annual add-on that issues a dedicated organizational certificate in your organization’s name from an Adobe Approved Trust List (AATL) provider, so your sealed PDFs show your organization as the signer in Acrobat/Reader.
EU Advanced OrgID is an annual add-on that issues your business name appear in the seal using an organizational certificate from an EU Trusted Lists (EUTL) Certificate Authority.
What recipients see:
See Pricing to learn more about Identity.
Publisher sealing uses our default certificate (OrgID). Identity add-ons put your organization’s identity on the seal while keeping the same CLI/API/Zapier integration.
Trust path note: PDFs sealed using Publisher, without an Identity add-on, support eIDAS Advanced electronic seals (AdES) and validate in Acrobat/Reader and other PAdES-aware viewers.
Expiry: With LTV (--ltv) enabled, previously sealed PDFs remain verifiable after certificate expiry because the timestamp and revocation evidence are embedded. We renew/rotate our default EUTL/AATL organizational certificate ahead of expiry; new seals use the renewed certificate. No action is required on your side, and existing documents remain valid.
Revocation (hypothetical): If our default certificate were ever revoked, PDFs sealed before the revocation and sealed with LTV would continue to validate based on their time-of-signing evidence. Viewers may indicate the certificate is currently revoked while still showing that the signature was valid at signing time. Documents sealed without LTV may display warnings depending on the viewer and network availability.
PDF size: No imposed limit—Publisher only receives a 256-bit digest regardless of the file size. However, the CLI and Zap process the PDF in memory within your environment, which may create de facto limits based on your system or automation constraints.
Rate limiting: None currently on API keys; we may introduce fair-use rate limits at any time to protect service stability.
We generate and keep signing keys inside certified Hardware Security Modules (HSMs) validated to FIPS 140-3 Level 3. Private keys are non-exportable and all signing occurs inside the HSM boundary. Production access is controlled by role-based IAM, least privilege, and dual control for sensitive operations; credentials are encrypted and rotated, and every key operation is audited and monitored. (Where applicable, our HSMs also carry Common Criteria evaluations, e.g., EAL4+.)
Your documents never leave your environment—we sign a cryptographic digest, not your file.
Publisher (sealing) is a usage-based monthly subscription. Identity (OrgID)—AATL or EU Advanced—is an annual add-on with rate breaks for multi-year terms. Identity can only be used with a Publisher service.
Use our pricing calculator for an estimate or to learn more about Identity Add-on pricing.
We offer three ways to integrate:
Official SDKs: We don’t offer SDKs, and they’re not on our roadmap right now. You should use a PDF SDK (available for any number of languages) to apply the signature and DSS into your PDF, or use our CLI.
Testing/demos: You can create demo API keys against a self-signed certificate we provide so you can test your implementation without incurring usage charges; behavior mirrors production.
Audit & usage visibility: We maintain internal audit logs of sealing operations for security and billing. Once subscribed, you can access a customer-facing usage report in your account. If you need event-level exports, contact us.
--ltv in the CLI to embed timestamp and revocation data for long-term verification. Review CLI documentation