EDIT
I added the full replies I got from HelloSign. These may perhaps help someone more expert than I am to determine if they actually provide an AdES signature. Please note that I also asked questions regarding private certificates that as far as I understand now are not required by an AdES signature.
Q: How can I identify the signatory from the document he/she signed?
A: This is outlined in the portion of our Terms of Service > Audit Trail. In summary HelloSign creates a transaction log between signing parties that help to identify signers.
Q: How sole control of the private key by the signatory is assured?
A: HelloSign Offers an Advanced Electronic Signature (AES) In order to be considered an AES the following requirements must be met: - uniquely linked to signatory - capable of identifying the signatory - created using electronic signature-creation data that the signatory can, with a high level of confidence, use under his/her sole control
HelloSign meets all requirements to be considered an Advanced Electronic Signature.
Q: How accompanying data may be checked against modification after the document is signed?
A: A document once signed can not be reopened and modified. In addition to ensure any tampering of your transaction log is detectable, we process the transactions log with hashing technology.
Q: How the signature is invalided in case the document is modified after it i signed?
A: In the event a document is contested, HelloSign will provide the transaction log which will show if any changes were made to the document after signing.
NB: This question is about a specific issue of compliance of HelloSign services with the eIDAS Regulation. It has nothing to do with other questions about DocuSign or HelloSign I have read about on this forum.
I happen to use electronic signatures now and then. In my country, Italy, as well as in most European countries, electronic signatures are in use rather widely and successfully. The most recent legislative framework that makes this possibile is called the eIDAS regulation, a Europe-wide law about electronic identification, signature and other trust services.
Several kinds of signature are allowed by eIDAS, from least secure ("electronic signature") to most secure ("advanced electronic signature" and "qualified electronic signature").
When I discovered that HelloSign was offering an "eIDAS compliant" advanced signature service I rushed to register. After a plain email verification, during which my identity was not validated, I created a PDF file and signed it. Apparently, no digital certificate had been generated. In fact, when I checked the signed document against a common eIDAS-compliant verification tool provided by the European Union and hosted by an Italian Government agency (http://dss.agid.gov.it) the document appeared to be void of any certificate.
This is quite strange, as HelloSign states in its scanty legal documentation that they provide an advanced eIDAS-compliant signature, which contradicts the fact that my identity was not verified and no digital certificates were used.
I tried to have more info about HelloSign compliance from their customer service but after a lenghty and inconclusive mail exchange all I got was several versions of "our signature is eIDAS-compliant because it is compliant with eIDAS". The final reply was something like: "if you have further doubts concering our product we suggest you consult with a local lawyer". I repeatedly asked for a technical reference but I got none.
Does anybody familiar with eIDAS more than I am (I repeat, this is a very specific issue of compliance with that regulation) share my view?