A document signing and verification service: prove who signed, when, and that nothing changed — backed by a dedicated private trust root, with open standards anyone can check.
The problem
A signature image, a scan, or an emailed PDF can all be changed silently. Here is what is missing.
A scanned signature or an emailed PDF can be edited and re-saved. Nothing shows whether the file is still the original.
A pasted image of a signature is not identity. There is no cryptographic link between the signer and the document.
A date typed on the page proves nothing. You cannot show when the document really existed in that form.
Email threads and shared drives cannot show who did what, or when, in a way that can be trusted later.
How it works
From upload to independent verification, without a desktop app.
Drop a PDF or any document into the portal.
Your certificate signs the document hash; a visible stamp is added.
An RFC 3161 timestamp from our own TSA seals the moment of signing.
Anyone checks the file; a match proves it has not changed.
Behind the scenes
The signature covers the exact document bytes. Change one character and verification fails.
Benefits
A SHA-256 hash detects any change to the document.
The signature is bound to a CA-issued certificate, not just an image.
The signature is cryptographically bound to the signer certificate.
An RFC 3161 timestamp from our own TSA fixes when it was signed.
Every action is recorded in a tamper-evident hash chain.
Recipients verify through a public page — no account needed.
Signatures follow open standards, so they verify without depending on this service.
PAdES, CMS/PKCS#7, RFC 3161, X.509 — checkable with standard tools.
Comparison
| Email / scan | Public e-sign service | host.name.my | |
|---|---|---|---|
| Trust anchor | None — just an image | Vendor public CA | Your dedicated trust domain |
| Verifiable without the provider | No | Only via the vendor | Yes — Adobe / OpenSSL with the root |
| Standards | — | Varies by vendor | PAdES · CMS · RFC 3161 · X.509 |
| Recipient verification | Trust the image | Vendor portal | Public portal, no account |
| Revocation | None | Vendor policy | CRL + OCSP |
| Audit trail | None | Vendor logs | Hash-chained, tamper-evident |
Open standards mean a signature can be checked with standard tools, even without this service.
Advantages
Documents are protected and user signing keys use AES-256.
Assign more than one signer; signatures are added incrementally.
Invite a registered signer with a direct link.
Revoke a certificate (CRL + OCSP) or withdraw a document.
Timestamped, hash-chained and downloadable.
English and Bahasa Melayu, chosen per user.
Security & trust
A dedicated root (kept offline-capable) with an issuing authority for daily use.
The web tier can never read the CA private keys.
User signing keys are protected with AES-256.
A SHA-256 hash chain over every action.
CRL and OCSP; withdrawn documents are reported as revoked.
Unsigned PDFs are download-marked DRAF until signed.
For recipients
Go to the public verification page, or scan the QR on the stamp.
PDF: the signed PDF. Other files: the original and its .p7s.
VALID means authentic and unchanged since signing.
Use cases
Sign agreements and filings that can be verified independently.
Offer letters and policies with a verifiable signer identity.
Approvals and statements protected against later alteration.
Reports and change records signed at the point of issue.
Internal directives with a controlled, auditable trust root.
Certificates and transcripts anyone can verify.
FAQ
A document signing and verification service backed by a dedicated trust domain for your organisation. Recipients verify through the public portal, or import your root certificate once to validate in Adobe or OpenSSL.
No. The verification page is public. Upload the file (and its .p7s for non-PDF) and get an immediate VALID or INVALID result.
Yes. The signature is computed over the exact bytes with SHA-256; any later change fails verification.
Revoke it. The revocation list (CRL) is regenerated and published, and OCSP answers live status checks.
Signatures use open standards and verify without this service (Adobe or OpenSSL with the root). You are not tied to a proprietary format or portal.
Verify a signed document, or read the step-by-step guide.