Vendor Questions. esignatures Request for information Xenex SignatureMaster

Transcription

1 Vendor Questions 1. Legal Compliance Questionnaire This section corresponds to legal requirements as outlined in the CSIO esignatures Advisory Report prepared by Fasken Martineau LLP. 1. Signing Ceremony 1.1 Describe your solution s signing ceremony (how does the signing process work, including authentication, signing the document, and delivery of the document). 2. Consent 2.1 How does the solution prove that consent to use electronic means for both signatures and ongoing delivery of information was provided by the user? 2.2 How does the user indicate acceptance (i.e., click a button, provide a signature, etc.) 3. In Writing 3.1 How does your solution provide access to documents? After registration, Room Hosts upload documents and add participants to a Signing Room. After preparing the documents for review, signing and sealing, the room is locked and the signatories are invited via to login and sign. When all documents are signed by all signatories, the document is secured and digitally signed. The Signing Room is then unlocked and all participants are invited to download the document. At registration, users provide consent to use electronic means for both signatures and ongoing delivery of information by clicking on consent checkboxes throughout the application and confirming their consent by entering their PIN number to signify intent to consent. By both selecting a checkbox and clicking a button. And in the cases where intent to content is required the user must enter their PIN to confirm identity and intent. During the signing process the documents are not accessible except through a non-editable web interface for signing. After all documents are digitally signed, the documents are downloadable by the room participants through web page or web service interfaces. 3.2 How will documents be stored? By default the documents are stored in a secure storage system. The encryption level is customizable to the client specifications.

2 3.3 In what form will documents be stored? PDF/A with digital signatures 3.4 Are the servers located in Canada? 3.5 How is access to a document determined/permitted? 3.6 When will access be granted to each contracting party and for how long? 3.7 Access to the documents if user wants to change providers/no longer uses provider? Privilege based set by client throughout its lifecycle in our servers. Determined by client organization. After download, the client determines the access permissions A non-editable version is available for reviewing and signing only during the signing Ceremony. Full access to the document is provided after securing and digitally signing for as long as the client specifies. Document is in users possession at all time after download. However, if user wants to change providers/no longer uses provider, the PDF/A documents are available to user upon request. 3.8 Backup/disaster recovery plans? Solution is deployed in tier 3 Data Centers with full redundancy and backup. 4. Original Copy 4.1 Will each contracting party (including any assignee) be able to access, retain, use, print and store a copy of the documents? 4.2 How is document integrity assured? Industry accepted SHA and digital certificate algorithms plus the Xenex proprietary DNA sampling process

3 4.2.1 How does your solution prevent changes to the document content that may occur on communication, storage and display? Can the document (look/file type/content) be altered during its lifecycle? Who will have the ability to do so? What security measures prevent unauthorized modification? How are changes to the document tracked through its lifecycle? Will there exist a single authoritative copy of the electronic document that is unique, identifiable and unalterable? Can this authoritative copy identify assigned parties as the owner or secured party with a security interest therein? How can the authoritative copy be distinguished from other copies? The document content is locked and protected. Our proprietary DNA sampling and content verification methodology is not impacted by changes to the document content that may occur on communication, storage and display. Not during the signing lifecycle. Once released to Users outside our system, any alteration will be detected by our solution. Only extremely skilled hackers. However, our proprietary detection algorithms and methodology will be able to detect any change and report it to the user upon authenticity verification. All industry standard PDF security measures of document protection including locking document and digitally signing. An audit trail is recorded during the signing Ceremony and a document comparison feature shows the changes from the originally signed version., in our or third party secure servers, the Room host is always identified as the owner. By our embedded digital signature in the document.

4 5. Contract Formation / Electronic Form How does the authoritative copy mark changes as authorized or unauthorized? Who owns the final document? Is it possible for the electronic vendor to sell, provide or otherwise use such electronic document without the owner s consent? 5.1 What opportunities will the contracting parties be given to review the contract before submitting? 5.2 If a mistake is found, how can it be fixed prior to submitting? 5.3 Does the solution have notification procedures that allow contracting parties to contact each other and/or your company so that an error can be fixed? 5.4 Does the solution allow the publisher to impose an expiration date on the document, after which it will no longer allow recipients to sign? Our solution assumes that all authorized changes are made before inviting Room Participants to sign. After the invitation to sign, any change is considered unauthorised and fails the content verification. The User (Room Host) No The contracting parties are presented with the documents within the signing room and given the opportunity for viewing and reading the documents prior to affixing their signatures and/or seals. SignatureMaster provides full opportunity to change the document prior to the invitation to sign. After inviting participates to sign, documents cannot be altered. Mistakes can only be corrected by substituting the document with a new version of the document. SignatureMaster has its own communication method for the signing and sealing process. For document integrity guarantee purposes, any other communication is done outside the SignatureMaster system. In SignatureMaster, the room host at his/her sole discretion controls the ability to allow or disallow recipients from signing after the invitation has been extended by simply clicking a button in the room.

5 6. Timing and Receipt of Electronic Document 7. Electronic Signature 6.1 How does the any contracting party or assignee become aware when documents have been sent / viewed / signed / finalized? When it is not delivered? 7.1 How will the digital signatures applied by parties to the contract meet the definition of an electronic signature? How does your solution generate electronic signatures? (i.e., what standards are used as part of the process?) How is the electronic signature linked with the document? 7.2 Is your solution flexible with regards to technological advances and future legal requirements concerning electronic signatures as they arise? 7.3 How may a contracting party provide a signature (e.g., scribe, click, etc.) 7.4 Does your solution support multiple signatures within the same document from multiple parties? Through an extensive automatically generated system. All signatures and seals applied to the contract are: 1. identity of signatory confirmed 2. intent to sign confirmed 3. document integrity confirmed 4. authority to sign confirmed 5. document signature audit trail and change detection Embedded 1. PDF/A standards 2. SHA256 and SHA512 Cryptology 3. Certificate Authority Verification (x.509 digital certificates) Proprietary technology compatible with virtually any PDF reader, including adobe and third-party readers. Scribe, type the signature and select from a system generated signatures, upload a scanned signature.

6 8. Authentication 8.1 How can it be proven that the documents are contracts entered into by the contracting parties (e.g., , SMS, etc.)? How and where is the proof thereof stored? How can it be accessed and by whom (e.g., contracting parties, assignees, etc.)? 8.2 What safeguards are in place to verify the identity of the contracting parties? 8.3 Can recipients of an electronic document forward signature requests to others? How is authentication maintained? 8.4 What is the workflow for maintaining authentication when signing in person? Mutual consent is mandatory in our solution prior to the participation of any party in the Signing Room. The party cannot be invited to participate in the signing ceremony without such consent. It is stored in our system and is it available through an audit report to any party that is in possession of the final document and wishes to verify its authenticity and obtain proof of nonrepudiation. Any person who is in possession of the electronic document can access the authentication process at no charge. The only requirement is possession of the electronic document in question. Organizations submit a signed and sealed document confirming the identity of their initial users. All other contracting parties must be invited to join our system by members already known to our system and can be traced to the inviter as a witness of the identity. Upon request from the client, identity verification and confirmation is available through third-party identity verification organizations such as Equifax, Trans Union and Experian. Recipient parties cannot forward signatures to other parties in our system. They can only invite other parties to join the Signature Room where the signing ceremony takes place. This ensures that the document authenticity is maintained during the signing ceremony. Upload the documents to a room, affix signature or seal placeholders where the signature is required. Apply PIN were signature placeholders is present. The system applies the signature or seal only after confirmation of PIN

7 9. Electronic Evidence 9.1 How will the integrity of your solution be provable? What mechanisms are in place to track system operations and downtime? What are the system maintenance practices? What information is backed up and what is the disaster recovery plan? What system security measures are in place? Who will have control over the documents? By clicking on the document and uploading it to our server for verification of the signature, seal and document integrity. A printable certificate of authenticity is presented if the document is authentic. Our tier 3 Data Centers is fully equipped with the state of the art system analytics that is tracked by Network Operations centre (NOC) and report any downtime. The NOC follows a predefined escalation process. Industry standard maintenance practice such as Sunday 5:00 am EST windows and in accordance with our Clients SLA requirements All data is incrementally backed up daily, with weekly full backup and monthly archival backup. Our DR plan consists of (1) preventive measures, (2) detective measures, and (3) corrective measures. We recognize that security is a vital element of this application therefore we take it very seriously. The approach that the application employs ensures compliance with industry standard intrusion protection and cryptology. Our security covers financial industry standard (1) Network Infrastructure Security, (2) Operational & Application Security, (3) User authentication.(4) data; in transit, in process & at rest, and (5) document; in transit, in process & at rest Before invitation to sign, the Room Host designated by the client organisation has control to setup the documents and invite Signatories and Room Participants. After the invitation to sign, each participant is in control of their own credentials (signature and seal). No document modification is allowed after invitation to sign and document digitization (the application of document integrity verification certificates)

8 9.1.6 Is there any reason to doubt the integrity of the system? 9.2 Will the electronic signatures of your solution meet the federal legislative requirements for a secure electronic signature? Will the prescribed process be followed? If not, detail any variations How will signature certificates be validated? How is it known if the certificate has expired or been revoked? Will signature certificates be supported by other signature certificates? Who is the certification authority? Have they passed the vetting process of the Treasury Board? How does an individual receive public and private keys? Any party in possession of the e-document may verify anytime the integrity of the document by a click on a verification icon at the top left corner of the document. In Fact, at the end of 2012, it was tested by Defense Construction Canada (a member of the Treasury Board Advisory Committee on Contracting Construction Subcommittee - TBACC-C) and results were published by the Surety Association Of Canada (SAC) in April 2013 By a third party Certificate authority (Entrust certificate authority) The standard certificate status report provided by 3 rd party certificate authority (Entrust ) informs the user the of expired or revoked certificates. N/A Entrust is the certificate authority.. Since our approach is a digital notarization like process, both the public and private keys remain in our secure servers. Our server certificates are verified by Entrust ( the certificate authority) and we in turn validate the signatures and document integrity. (Chain verification)

9 9.2.7 What controls are there on receiving public and private keys? What controls are there on issuing public and private keys? Do you use a hash algorithm to create a message digest? If so, describe. 9.3 What support do you provide to clients in the event of a legal dispute? 10. Audit Trail 10.1 What is included in the audit trail? 10.2 Where is the audit trail for the document stored, and how may it be accessed by contracting parties? 10.3 Does your solution have the ability to reproduce the transaction from start to finish? The public and private keys are used by internal cryptography and are not publically distributed. Our servers require them to encrypt and decrypt sensitive data in transit, in process and at rest. Our internal public and private keys are simply readable and accessible only by our servers. Our solution does not require the distribution of public key. The entire encryption decryption process is completed in and by our secure servers., We use SHA128, SHA512 and SHA1024 as requested by our clients. It a system generated an elliptical algorithm Depending on the client s SLA, we provide document Audit trail reports out of the box and upon request technical SME consultation. The Identity information of the signatories/users, the type, date and time of their interaction with the document during the lifecycle of the signing ceremony, the date and time of document download by the recipients and the document content integrity certificate. On our serves and can be accessed by a click on the signature or seal and after uploading the document to our server. P.S. Uploading the document to our server eliminates false document or signature validity verifications when non-compliant PDF readers are used by the user., all events are captured and stored in the history of the document displayed in printable audit trail reports

10 10.4 How is electronic evidence provided to a third party in the event of a dispute? 10.5 Does your solution conform to legislated evidentiary requirements (e.g., Canadian General Standards Board s Electronic Records as Documentary Evidence CAN/CGSB )? 11. Privacy 11.1 How will the privacy of contractors and their personal information be assured? (e.g., PIPEDA compliance, etc.) What information is stored by the system? Either on line or printable audit trail reports that can be generated in near-real-time be any third party (e.g., courts) as long as they are in possession of the Electronic Document. The document is notarized with our Digital Signature, which in turn is verifiable by the Entrust certificate authority. The original signed and sealed document is available for examination on request Critical and sensitive data is encrypted User & Company Profiles, Signatures & Seals, optionally a PDF/A sample, the signed and sealed document, and a document DNA to verify authenticity Where is it stored? In a secure Database in a tier 3 Data center Who has access to the information? What security procedures exist? Users have access to their own information; all others have access only if they have the privilege to access the information. The access privileges are managed by the user or their designated superuser. Encryption of all sensitive data in transit, during process and at rest. Employment of SSL, PKI, SHA128, SHA512 and x.509 Certificate (digital signature). Tier 3 data center security procedures.

11 What is the information used for and by whom is it used? How long is the information stored? In what form is the information stored? The information is used for satisfying the audit trail requirements of non-repudiation evidence of Electronic Commerce Acts, Business Acts, PIPEDA, the Upper Canada Law Societies Know Your Client guidelines and industry association standards As long as required by the client. In the surety industry it could be as long as 25 years. All data are stored in a Database. Since SignatureMaster is not a document management system, we prefer to return the documents to the client for storage. However, upon client request, we are equipped to store documents in PDF/A format on secure servers.

12 2. End-User Functionality Questionnaire This section corresponds to the operational aspects of your esignature solution. # Functionality Items Questions Responses 1. Field Overlay 1.1 Can a signature field be overlaid on top of a form? 1.2 Does your solution support multiple signatures within the same document from multiple parties? 1.3 Can additional fields be overlaid on top of a form?, we use signature place holders prior to inviting signatories to sign. 2. Document Management 2.1 How are the documents organized from a broker's point of view? 2.2 Does your solution support multiple signed documents as a single transaction? 2.3 What is the size limit per document? Our solution is not a document management system; it returns the documents back to the broker to be organized in its current system. As per client contractual agreement. 2.4 What document formats are supported? Any document format that can be converted to PDF, Doc, Docx, Xls, Xlsx, PDF. 2.5 Can customers attach supplemental documents with the document to be signed?

13 # Functionality Items Questions Responses 3. Broker Management System (BMS) Integration 4. Compatibility 3.1 Are there APIs available to provide the ability for your solution to integrate with third-party applications such as Broker Management Systems (BMS)? 3.2 How are finalized documents transferred to a BMS (e.g., manual, FTP, etc.) 4.1 What web browsers does your solution support? 4.2 What operating systems does your solution support? 4.3 Will users have to install software to sign documents? 4.4 Is your solution compatible with the Citrix environment?, through web services and minor customization effort As required by Client including; Web Services, ACORD, Secure FTP, manual or custom interface Internet Explorer, Fire Fox, Chrome and Safari MS-Windows, Mac OS, Linux, Android and ios No, all the user needs is a browser 5. Mobile 5.1 Are customers able to sign using mobile devices (tablets / smartphones)? If so, what does it look like from an end-user perspective? 6. User-Friendly 6.1 Are contracting parties able to partially complete the signing process and finish at a later time? How is security/authentication maintained?, it looks the same, the Singing Room is available to all parties until everyone completes the signing Ceremony. The security/authentication is maintained by not releasing the document for distribution before it is fully executed and digitally sealed.

14 # Functionality Items Questions Responses 7. Admin Account 7.1 Is there an admin account that has the ability to monitor/control other user privileges? 8. Reporting Tools 8.1 Are there any reporting features? 8.2 Are the reports out of the box? Can they be customized? 9. Branding 9.1 How can customers customize and brand the documents they wish to have signed? 9.2 Can users customize s sent by your solution? 10. Reliability 10.1 Has your solution been involved in any security or legal disputes within the past five years? If so, describe., the audit and comparison reports are included. Custom reports are possible The documents are branded before they are uploaded to the Room. No No

15 3. Services and Pricing Questionnaire This section corresponds to the customer support and pricing models of your solution. # Services and Pricing Items Questions Responses 1. Technical Support 2. Versions / Pricing Model 1.1 Is there a help line for customer issues/questions with the solution? 2.1 What different versions does the software include? On line (GoToMetting for one on one) and customer support centre (live chat and telephone support). Web browser on desktop and mobile. Also web service integration 2.2 What deployment options (i.e., cloud, behind firewall, etc.) are available? 2.3 What is the pricing model? Cloud deployment: A. Corporate Rates Cloud, behind firewall, web services and/or custom integration Subscription: $15-$20/user/month (1-10 users) Transaction: $1.50-$2.00/document B. Enterprise Edition Subscription: Flat monthly fee with unlimited documents (Call for quote) Behind Firewall Solutions: Call for pricing