Zipper Services in Romania excels in product development and compliance thanks to CEF eSignature

Need for compliance

Zipper Romania specialises in optimising companies’ internal data and document management processes. Serving the needs of both public and private organisations, their solutions range from document archiving to invoice automation with the objective of increasing operational efficiency while reducing costs. As digital solutions play an important role in Zipper Romania’s service offering, the company actively seeks to stay on top of relevant technical standards, specifications and open-source software.

When Zipper Romania designed a solution for e-archiving, one requirement in particular turned their attention to the European Union’s existing solutions provided through the Connecting Europe Facility (CEF) programme: the Romanian e-archiving law (Nr. 135/2007) requires documents to be signed by the issuer using a qualified certificate. Zipper Romania must therefore validate the resulting electronic signature before a document can be archived to ensure adequate proof of the issuer and origin.

In Europe, electronic signatures are regulated by the eIDAS Regulation, which mandates the use of certain standards and specifications in the process. To support organisations like Zipper Romania, CEF provides a solution, called the eSignature Building Block, which packages these standards with sample software and other support services to help Europeans build e-signature solutions valid in all EU countries (and beyond).

Sign securely across borders

The main component of CEF eSignature is the open-source library for Digital Signature Services (DSS). In essence, the DSS is a collection of standards, called baseline profiles, which specify how electronic signatures can be created and validated anywhere in Europe. CEF eSignature also provides open-source sample software, demos and support services to make it swift and easy for anyone to adopt electronic signatures that work across country borders.

Benefits of CEF eSignature

While Zipper Romania researched a suitable long-term solution, they developed an intermediary, proprietary e-signature solution for their e-archiving service. However, they quickly switched to the DSS for its open-source community committed to European standards. Solutions developed in such communities benefit from a wide range of expertise. In addition, adopting a CEF solution based on European standards eliminates the risk of misinterpreting specifications – and gives a company like Zipper Romania extra credibility in front of new clients.

The DSS is a ready-made solution that Zipper Romania found easy to adopt and use for creating and validating electronic signatures. It eased the learning curve and shortened the analysis, implementation and testing phases of the project, which took a total of three months. Zipper Romania estimates that without the DSS, similar functionality would have taken four months longer to accomplish. Reduced development time also reduced development costs, which made it easier for the company to offer the final solution, RepoZIP, to customers at a competitive price.

Zipper Romania promotes and acknowledges the value of common standards coordinated at the European level to bring benefits to all. Furthermore, they perceive standards as an opportunity to grow and prosper outside national borders. This is a European vision, where common standards pave the way to a Digital Single Market.

Implementation

When designing the RepoZIP solution, the company came across several approaches to the long-term preservation of documents. This raised essential questions about the role of electronic archiving: was it to preserve a document for the long term? Or to ensure integrity by providing evidence that a document has not been modified? DSS’s sample software and demos made it effortless for Zipper Romania to test potential solution scenarios and to decide on the best approach for them and their clients. Zipper Romania wanted to make it easy to send documents to RepoZIP directly from the file browser or from different applications (ERPs, CRMs, CMSs etc.) via a standardised Restful API.

The solution that Zipper Romania found the best uses eSignature DSS to first validate a given document’s electronic signature before the document is approved for archiving. In this step, the DSS is used, for example, to check whether the signature is qualified and what type of a certificate was used. The document to be archived is then packaged in a digital container together with the proof that the signature was validated, as well as other metadata detailing the archiving process, as required by the Romanian law. In the next step, the container is encrypted to safeguard integrity. The encryption happens by applying a Long-Term Archival signature (also called an LTA-level signature) with a qualified time stamp provider. Zipper Romania's way of creating and encrypting containers is also based on eSignature DSS specifications: the Associated Signature Container (ASiC) baseline profile for the container and the CMS Advanced Electronic Signature (CAdES) for the encryption.

The steps in blue are conducted with CEF eSignature.

Future prospects

With an eye on further benefiting from CEF services and solutions, Zipper Romania is looking into integrating other CEF Building Blocks, such as eDelivery and eInvoicing, in their service offering. The company also aspires to become a Qualified Trust Service Provider in the near future.