“Signing” a document is not enough: what you can’t see makes all the difference
Script fonts, checkboxes, automatically inserted names… Many tools marketed as electronic signature solutions actually carry no legal value under the eIDAS regulation. Here is how to tell a real signature from a mere appearance.
The illusion of the signature: when appearance replaces legal value
Since the rise of online signing tools, a widespread confusion has taken hold in many organisations: mistaking the appearance of a signature for its legal value. Placing a first name in a cursive font on a PDF, or clicking “I agree” in a web form, does not constitute an electronic signature under the European eIDAS regulation.
⚠️ This graphical element does not constitute an electronic signature. The document remains editable and no proof of identity is attached to the file.
The eIDAS regulation defines three levels of signature (SES, AES, QES) that offer very different guarantees. What a truly robust signature requires — and what only the QES fully delivers — rests on three pillars:
🔐 Integrity
- The document is cryptographically sealed
- Any subsequent modification is detectable
- The signed content cannot be altered
🪪 Certified identity
- The signatory is authenticated with certainty
- Their identity is linked to the document by a qualified certificate
- Proof of identity is verifiable after the fact
📋 Traceability
- A timestamped audit trail is generated
- Each step of the process is recorded
- The evidence is enforceable in the event of a dispute
⚠️ Important clarification: integrity vs certified identity
Cryptographic sealing of the document applies to all eIDAS levels — including SES. A document signed by OTP through an eIDAS platform is indeed protected against modification. What fundamentally distinguishes the levels is the second pillar: the certainty of the signatory’s identity. A SES signature only proves that an OTP code was entered from the email address or phone number provided — it does not authenticate the real identity of the person. QES is the only level where identity is verified with certainty, via a qualified certificate and a rigorous enrolment process (itsme® or Evrotrust). This is precisely why it is the only level legally equivalent to a handwritten signature.
A simple visual addition (script font, automatically inserted name) does not even reach SES level: it has no eIDAS status, the document is not sealed, and it can be challenged or disregarded with ease in the event of a dispute.
The Odoo Sign case: a revealing example
Odoo is a widely used ERP across Europe, deployed by thousands of SMEs. Its native Odoo Sign module allows documents to be sent for signature directly from the platform — which can give the impression of a complete electronic signing process. The reality is more nuanced.
⚠️ What Odoo Sign actually does in standard mode
In its default configuration, Odoo Sign places the signatory’s name and initials as a graphical element on the document. It does not generate a cryptographic signature, does not protect the file against modification, and does not produce a sealed PDF document in the sense of the PAdES standard. The resulting document remains technically editable.
What about itsme® authentication?
Odoo also offers an integration with itsme®, the Belgian digital identity application. This option adds an authentication layer: the signatory confirms their identity via itsme® before signing. This is a genuine step forward in terms of identity verification — but it does not solve the fundamental issue.
⚠️ itsme® authentication ≠ eIDAS-signed document
Even with itsme® authentication, Odoo Sign does not produce a signed and protected PDF under eIDAS standards. The result is an additional document indicating that the person authenticated — but this document is not cryptographically linked to the signed content, is not protected against modification, and does not constitute a qualified signature (QES) under the eIDAS regulation.
To be entirely fair to Odoo: this module addresses internal workflow and validation needs. In a purely internal context — approving a procedure, confirming a meeting — it may be sufficient. But for any document with contractual, regulatory, or litigation potential, it does not provide the guarantees that an eIDAS signature delivers.
💡 Key takeaway on Odoo Sign
The value of a signature solution is not measured by its integration into an ERP, but by its level of eIDAS compliance. Odoo Sign is a workflow tool — not a qualified electronic signature solution. The two can coexist: Odoo for process management, e-Signature.eu for legally enforceable document signing.
✅ The solution: integrate eIDAS signatures directly into your Odoo workflows
e-Signature.eu offers an Odoo integration module that enables eIDAS signature requests — SES, AES or QES — to be triggered directly from your Odoo processes, without leaving the ERP environment. Your documents are cryptographically signed, protected against modification, and fully compliant with the eIDAS regulation. The best of both worlds: the power of Odoo workflows and the legal value of a real electronic signature.
The “unlimited signatures” subscription trap
Another phenomenon deserves attention: monthly subscription offers including hundreds or even thousands of signatures for a fixed fee. At first glance, the savings seem obvious. Looking more closely, the reality is often very different.
The answer is simple: they are not qualified signatures. And often, they are not eIDAS signatures at all.
Two cases can be distinguished:
- The best case: simple signatures (SES) — an OTP by email, for example. SES is the lowest level in the eIDAS hierarchy. It does seal the document, but has limited probative value as it does not authenticate the signatory with certainty. It is legally better than nothing, but far from a qualified signature.
- The frequent case: simple visual script additions — a name inserted in a cursive font, a signature image placed on the document, a ticked checkbox or a simple click — with no eIDAS infrastructure behind them. These elements have no legal status under the eIDAS regulation. The document is not sealed, the signatory’s identity is not verified, and there is no cryptographic proof of the act.
Methodological note: the comparative elements above are presented for illustrative purposes based on publicly available offers. Prices and technical specifications may vary by provider and change over time. Always consult current terms directly with each provider.
⚠️ What the subscription does not always tell you clearly
The terms “electronic signature” or “e-signature” do not distinguish, in commercial communication, between the different eIDAS levels. A subscription including 1,000 signatures per month typically offers SES or AES signatures — rarely QES, which requires a far more costly certified infrastructure. Always verify the actual eIDAS level of the signatures included in your package.
The three eIDAS levels: what the regulation actually says
The eIDAS regulation (No. 910/2014), complemented by eIDAS 2.0 (EU Regulation 2024/1183), establishes a hierarchy of three electronic signature levels. Below these levels exists a fourth category — outside eIDAS — that enjoys no legal recognition: simple visual additions. These four realities are not interchangeable.
| Level | Definition | Legal value | Examples | Document protection |
|---|---|---|---|---|
| Visual only Outside eIDAS |
Graphical addition with no infrastructure — no eIDAS legal status | None — immediately contestable | Script font, signature image, native Odoo Sign | ✗ None |
| SES Simple |
Any data in electronic form associated with other data | Limited — identity not certified with certainty | Email OTP, SMS OTP | ✓ Yes (sealed document) |
| AES Advanced |
Linked to the signatory, created by data under their exclusive control | Strong probative value — not equivalent to handwritten signature | Veriff (AI), certain tokens | ✓ Yes (sealed document) |
| QES Qualified |
AES + qualified creation device + qualified certificate | Equivalent to handwritten signature throughout the EU | itsme®, Evrotrust | ✓ Full (PAdES) |
📌 QES: the only level equivalent to a handwritten signature
Only the qualified electronic signature (QES) has, under Article 25(2) of the eIDAS regulation, a legal effect equivalent to a handwritten signature in all EU member states. SES and AES have probative value — but they are not recognised as equivalent to a handwritten signature.
What a real eIDAS signature delivers
A qualified electronic signature is not simply a higher security level. It fundamentally transforms the nature of the signed document and the guarantees it provides.
A sealed and unalterable document
When a document is signed with a QES, a cryptographic fingerprint is calculated and embedded in the PDF file according to the PAdES standard (PDF Advanced Electronic Signatures). Any modification to the document after signing — even a single character — invalidates the signature and is immediately detectable by any compatible PDF reader. The document is literally “locked” at the moment of signing.
A certified and enforceable identity
QES relies on a qualified certificate issued by a trust service provider (QTSP) accredited under eIDAS. This certificate contains the verified identity of the signatory — verified during enrolment in the application (itsme® or Evrotrust). In the event of a dispute, the signatory’s identity is proven without any possible ambiguity.
A complete audit trail
Each step of the signing process is recorded and timestamped: invitation sent, document viewed, signature applied, download completed. e-Signature.eu automatically generates a downloadable PDF audit trail, providing additional evidence of how the process was conducted.
✅ What you get with a QES via e-Signature.eu
A cryptographically sealed PDF (PAdES) · A qualified certificate linking identity to the document · A timestamped audit trail · Legal value equivalent to a handwritten signature throughout the EU · Complete protection against any subsequent modification
The e-Signature.eu approach: QES without complexity or subscription
e-Signature.eu is designed to make qualified signatures accessible to all businesses, without complex infrastructure or long-term financial commitment.
e-Signature.eu Native QES · No subscription
QES is the default level — not a premium module or an additional paid option.
✅ Strengths
- QES available from the first credit
- Two QES methods: itsme® (32 countries) and Evrotrust (64 countries)
- No subscription — pay-as-you-go model
- Cryptographically signed PDF (PAdES)
- Automatic audit trail included
- Simple interface — signed in minutes
- Compatible with INPI requirements (France)
⚠️ Good to know
- The signatory must have an active itsme® or Evrotrust account (for QES)
- Prior identity verification is required from the signatory
- QES is suited to high-stakes documents — not internal validations with no legal scope
e-Signature.eu also offers two additional levels for contexts where QES is not required: advanced signature (AES) via Veriff, covering 198 countries worldwide, and simple signature (SES) by email OTP, available everywhere. Each use case finds the appropriate signature level — without paying for more than necessary, and without falling into the trap of an insufficient solution.
🎯 When to choose QES over other solutions?
Choose QES for any binding contractual document, any act requiring the equivalent of a handwritten signature (employment contracts, commercial agreements, notarial documents, INPI filings, mandates), and any situation where legal challenge is possible. Avoid non-eIDAS alternatives when proof of signatory identity and document integrity are essential.
Key takeaways
- A cursive font or an automatically inserted name does not constitute an electronic signature under eIDAS — the document remains editable and lacks reliable probative value.
- Native Odoo Sign produces a visual element, not a cryptographically signed document — even with itsme® authentication, the resulting PDF is not protected under eIDAS standards. e-Signature.eu offers an Odoo module to integrate eIDAS signatures directly into your workflows.
- Low-cost “unlimited signature” subscriptions often provide simple signatures (SES) — or even mere visual additions with no eIDAS status — not qualified signatures (QES).
- A SES signature (email or SMS OTP) does seal the document cryptographically, but does not authenticate the signatory with certainty: it only proves that a code was entered from the email address or phone number provided, without real identity verification.
- Only QES is legally equivalent to a handwritten signature throughout the European Union (Article 25(2) of the eIDAS regulation).
- A real eIDAS signature cryptographically seals the document: any subsequent modification is immediately detectable.
- e-Signature.eu offers QES on a pay-as-you-go basis, with no subscription, using itsme® (32 countries) and Evrotrust (64 countries), with an automatic audit trail for every signature.
Ready to sign with real legal value?
Try e-Signature.eu and discover eIDAS qualified signatures — no subscription, no commitment, from a single credit.
View credit pricing →