Digitise Your Business for Free - Chapter 8

Electronic signatures that withstand scrutiny

In the previous chapter you got Verifactu running. Now come internal documents, contracts with clients, agreements with suppliers. Many believe a screenshot of a signature or a scanned PDF works fine. Tax authorities look at that during an inspection and raise an eyebrow. Courts do too. This chapter teaches you how to sign for free, with real legal guarantees, without paying anything unnecessary.

Three levels of electronic signature: which you need

The eIDAS Regulation (EU 910/2014) recognises three levels of electronic signature. It's not that the law is complicated; it's that each level serves different purposes. Using the wrong level leaves you with a document that looks valid but won't stand up to questions.

Simple electronic signature

It's the most basic. It includes anything that links your identity to a document: clicking "I accept", typing your name at the bottom of an email, attaching a scanned image of your handwritten signature.

Legal validity: it exists, but it's weak. If someone challenges that you signed it, you must prove that you did. No certificate, no timestamp, no audit trail.

When it works: internal documents (meeting notes, internal rules, approvals of operational changes). Rejected expenses in an audit. Documents between departments within the same company.

When it doesn't: contracts with third parties, agreements with clients or suppliers, anything that could end up in litigation.

Advanced electronic signature

It's the middle level. It has four requirements according to Article 26 of eIDAS:

Uniquely linked to the signatory.
Enables identification of the signatory.
Created using data the signatory controls (their certificate).
Linked to the document such that any later change is detectable.

Legal validity: much stronger than the simple version. In court, if it's challenged, the claimant must prove it isn't valid. The presumption is on your side.

When it works: internal contracts, significant budgets, service agreements between SMEs, documents needing clear audit trails.

When it doesn't: transfer of property rights (property purchase and sale), mortgages, documents that by law require a public deed before a notary, certain high-risk commercial acts.

Qualified electronic signature

It's the highest level. It requires:

Qualified certificate issued by an official Trust Service Provider (in Spain they're listed at the Ministry of Economic Affairs and Digital Transformation).
Created using a qualified device that guarantees your private key cannot be copied or used without your direct involvement.
Compliance with all requirements of the advanced signature, plus this additional requirement.

Legal validity: has the same effect as a handwritten signature across the entire European Union. Under eIDAS, it's valid without question. In court, whoever challenges it must prove it isn't authentic, not the other way round.

When it's mandatory: notarial acts (if you do them digitally), some official transactions with public administration, documents where law requires full equivalence with handwritten signatures.

When it's recommended: any important contract, formal employment agreements, documents you know could end up in court.

Real case: the simple signature that didn't hold up

There was a dispute where a lending company pursued a debtor using a contract signed via DocuSign. The defendant argued the signature wasn't real. The Provincial Court of Lleida (January 2021) sided with the defendant. Why?

DocuSign sent the contract by email. The debtor signed it manually and returned it. No digital certificate, no identity verification, no confirmation of who actually signed it.

The court concluded: it's a handwritten autograph, not a qualified electronic signature. The lending company lost. The debtor didn't pay.

Lesson: the screenshot, the scanned PDF and even signatures on platforms without digital certificates are weak. When the other party wants to avoid payment or challenge the contract, you lose.

Autofirma AEAT: installation and use

Autofirma is free software from the Spanish Government. It's the tool the Spanish public administration uses for electronic signatures. Open source. No cost. Works on Windows, macOS, Linux, iOS and Android.

Autofirma alone doesn't generate signatures. You need a valid digital certificate. It could be:

FNMT-RCM certificate (free for Spanish citizens with an electronic national ID).
Company certificate (issued by competent authorities, though it may cost).
Your smart card (T-Caja or similar).

Installation

Go to https://autofirma.net/descargar/ or the official digital headquarters of the Ministry (sedediatid.digital.gob.es). Download the version for your operating system. Install normally.

Open Autofirma. It will search for certificates on your system. If you have the FNMT-RCM certificate imported in your browser, it will find it.

Signing workflow

File to sign (PDF, ODT, XLS).
Open Autofirma.
Select the file.
Choose the certificate.
Sign.

The signed file is saved as a copy. The original remains untouched.

Limitations

Autofirma generates an advanced signature, not a qualified one. It has strong legal validity for most company documents. Legally, it's sufficient for internal contracts, client agreements, budgets.

It doesn't give you a qualified signature (that requires a specific qualified device, more expensive).

It doesn't automate. Each document is signed manually.

VidSigner and other free or low-cost tools

VidSigner

VidSigner is the solution from Validated ID, a digital identity specialist. It offers electronic signatures with several options:

VidSigner Bio: handwritten signatures on screen, similar to signing on paper.
VidSigner Remote: remote signing with video verification, unique code sent to mobile.
VidSigner SmartCard: signing with national ID 3.0 via NFC on smartphone.

Complies with eIDAS (EU Regulation 910/2014). The signature is advanced. Clear legal validity.

Cost: no completely free option. Enterprise plans from €30-50/month depending on volume. If you sign fewer than 5 documents per month, it gets expensive.

Integration: REST API. Connects with document management systems, CRM, accounting software.

Useful if: you have recurring signing volume and want to automate remote workflows.

LibreOffice and open source

LibreOffice is free, open source. It allows you to sign ODT, PDF and other formats digitally.

Process:

Download LibreOffice (libreoffice.org).
You need a digital certificate (free FNMT-RCM if you have an electronic national ID).
Open the document in LibreOffice.
Menu: File > Digital Signatures > Sign Document.
Select certificate.
Sign.

Cost: €0.

Validity: advanced signature. Sufficient for most commercial documents.

Limitation: it's not a remote workflow. The document must be on your computer.

AEAT e-FACTURA (for invoices)

It's not general signing. It's specific to invoices. Generates invoices directly on AEAT servers. Free. Valid for meeting Verifactu requirements.

To sign a sales contract between companies, it doesn't apply.

To sign an invoice, yes. It's already integrated into the invoicing systems we covered in Chapter 7.

Complete remote signing workflow: company and client, at no cost

This is the most common scenario: you send a contract to a client. The client signs it. You sign it. Both of you have a valid copy.

Step 1: prepare document

The contract must be in digital format (PDF, Word, ODT). Include fields where signatures go. If possible, leave blank space or a marked rectangle.

Step 2: choose signature level

Simple? Only if it's an internal document with no legal risk.

Advanced? Standard contracts with clients, services, moveable property sales.

Qualified? Only if required by law or if you know there's a risk of significant litigation.

For most situations: advanced is sufficient.

Step 3: generate certificates or use simple signature

Option A (advanced signature, more secure):

You have Autofirma with FNMT-RCM certificate.
You sign the document. Save a copy.
Send the signed copy to the client.
Client returns countersigned copy.

Option B (simple signature, faster):

You generate a PDF with date and time.
Send it to the client.
Client downloads it, signs it by hand, scans it, returns it.
You save a copy.

Option B is legally weak. In a dispute, the client can deny its authenticity.

Option A (using Autofirma) is much stronger. It takes you 2 minutes longer.

Step 4: signature chain

If the document needs more than one party to sign:

Company A signs with Autofirma. Saves a copy.
Sends the signed copy to Company B.
Company B opens in Autofirma, adds their signature. Saves a new copy.
Returns to Company A.

The resulting file has both signatures recorded with date and certificates.

Step 5: final file

The signed document contains:

Digital signature + certificate of who signed.
Exact date and time of signing.
Technical details of the certificate (if company certificate, company name).
Cryptographic hash (impossible to modify afterwards).

Step 6: storage

Save the signed document:

On the company server.
In backups (covered in the previous chapter).
With your accountant, if required (for audit).

Never in email alone. Email can delete history. The signed file is the proof.

Errors that invalidate a signature

Expired certificate

The certificate has an expiry date. Autofirma and LibreOffice tell you when you try to sign. If it's old, renew it before signing important documents.

No timestamp

Some signing systems include a timestamp. Others don't. The timestamp proves exactly when it was signed. Without it, someone can argue it was signed later (forgery).

LibreOffice and Autofirma include a timestamp if your certificate supports it. VidSigner always includes one.

Incorrect format

Not all formats support signatures. PDF works. ODT works. Word (.docx) yes, but less stable. Proprietary formats (Microsoft XLS without conversion) can be problematic.

Rule: convert to PDF before signing if there's doubt.

Later modification

A signature is linked to the document's content. If someone modifies it afterwards, the hash won't match. LibreOffice, Autofirma and professional tools detect changes.

But if the client receives the PDF, opens it in Acrobat, edits it (Acrobat allows PDF editing) and signs again, the result is a different document.

Lesson: the document is signed when it's ready. Not after changes.

Signing without verifying identity

If you don't verify who signs, the electronic signature loses its value. A certificate issued to "Company Ltd" only matters if a genuinely authorised employee of that company is actually signing.

VidSigner Remote requires video verification. Autofirma assumes that if you have the certificate, it's you (it trusts your control of your machine).

For highly critical documents (mortgages, transfer of rights), better to require explicit verification.

Signed file opens in browser without validation

Sometimes the PDF opens in the browser. The browser doesn't always validate the signature correctly. Download the file and open it in a desktop application (Adobe Reader, LibreOffice) to properly validate the signature.

Qualified electronic signature: when it's necessary

Qualified signature has full legal presumption. It's the highest standard.

When law requires it

Digital notarial documents: if you do a property purchase deed online, it requires a qualified signature.

Public administration acts: certain critical transactions with government require it.

High-risk commercial agreements: though not always mandatory, some sectors (financial, insurance) require it.

When recommended even if not required

Formal employment contracts: Spanish Law 6/2020 doesn't require qualified signatures, but advanced or qualified are valid. If it's an indefinite employment contract or important, use qualified.

Sales contracts between companies: when the amount is high or guarantees are complex.

Documents you know could face litigation: if someone's likely to challenge it, qualified eliminates argument.

Where to get qualified signature for free

There's no completely free option.

Low-cost options:

Qualified certificates from your bank: some banks issue qualified certificates to business customers (sometimes free if you have an account).
Spanish certification authorities: Acciona (accv.es), Certicámara, others issue qualified certificates from €50-100/year.
VidSigner Remote Premium: adds a qualified timestamp, but it's a service, not a free certificate.

For most SMEs, advanced signature (Autofirma + FNMT-RCM) is sufficient and free.

Coordination with notary and accountant

If a document requires a notary, electronic signature doesn't replace notarial intervention. The notary verifies identity, legal capacity, mutual consent and provides you with a public deed.

Public deed: has maximum authenticity presumption, better still than qualified signature.

Private document with qualified signature: has high legal validity, but not presumption that what it says is true (you'd need additional evidence).

When you need a notary

Property purchase and sale: public deed is mandatory.

Gifts of valuable goods: public deed.

Mortgages: public deed.

Powers of attorney: public deed.

Renunciation of inheritance: public deed.

Formation of a company: notarial deed (if you want maximum security) or private deed with qualified signature of partners (also valid).

When electronic signature without a notary is sufficient

Sales contract for moveable goods (car, equipment, goods): advanced or qualified signature is valid. Doesn't require a notary.

Services contract: advanced signature is valid.

Employment contract: advanced or qualified signature is valid under Spanish Law 6/2020. Doesn't require a notary.

Internal commercial agreements: simple to advanced signature sufficient.

Signature workflow template for companies

Here's how to implement it without expensive software:

For internal contracts

Document prepared in Word/PDF.
Sign with Autofirma (your FNMT-RCM certificate).
The resulting file is filed on the company server.
Copy with accountant (if they audit).

Time: 2 minutes. Cost: €0.

For contracts with clients (advanced level)

Document prepared. PDF recommended.
Send to client: "Please download Autofirma from autofirma.net. Open the PDF, sign with Autofirma. Send the signed PDF back by email."
Client signs. Returns it.
You countersign (open the PDF signed by client in Autofirma, add your signature).
Save final copy.

Cost: €0. Validity: high (advanced signature from both parties).

Problem: if the client has no certificate, they can't sign this way.

For clients without certificate (simple signature)

Document prepared.
Send to client.
Client signs it by hand (or any simple method).
Returns it.
You sign it with Autofirma.

Result: mixed signature (simple from client, advanced from you). Validity: moderate. Better than nothing, but weak if there's a dispute.

For maximum security (qualified level)

Visit a notary, or contact a certification authority that issues qualified certificates.
Obtain a qualified certificate.
Sign the critical documents.
File as a public or private qualified document.

Cost: €50-300 depending on authority.

Validity: maximum. Full legal presumption.

Integration with systems you already use

FacturaScripts (invoicing)

FacturaScripts (Chapter 7) allows you to sign invoices before sending. It integrates with digital certificates.

Plugin: FacturaScripts + Autofirma. You sign the invoice, it's recorded digitally in the system, stored with validated signature.

Workflow:

Invoices created in FacturaScripts.
Generate PDF.
Autofirma signs the PDF.
FacturaScripts archives the signed copy.

Cost: €0 (just FacturaScripts, which we covered in Chapter 7).

n8n (automation, Chapter 6)

n8n can automate signing workflows.

Scenario: each sale in Google Sheets generates an automatic contract. The contract is downloaded, signed with Autofirma, sent by email automatically.

Node 1: Trigger (sale recorded in Sheets). Node 2: Generate document (contract from template). Node 3: Sign with script calling Autofirma (if installed on server). Node 4: Send by email.

Limitation: Autofirma is a desktop tool. n8n (cloud) can't execute it directly. You'd need self-hosted n8n or remote signing API (VidSigner, which is paid).

For most situations: better to sign manually (2 minutes per contract).

Summary: what to do this week

Get free FNMT-RCM certificate if you have an electronic national ID. Go to fnmt.es, request online. Arrives by post in 1-2 weeks.
Download Autofirma from autofirma.net. Install on your computer.
For internal documents: sign with Autofirma. Store on server.
For contracts with clients: send as PDF. Ask them to download Autofirma, sign and return. You countersign.
For critical documents (mortgages, transfers, notarial acts): consult a notary. Electronic signature doesn't replace a public deed when it's mandatory.
Archive signed copies on company server, not in email.
Tell your accountant you're now signing electronically. They need to know for audit purposes.

Resources and links

Next chapter

Chapter 9: Backups and disaster recovery (coming soon).

Need help implementing electronic signatures in your business? Book a free session and we'll review which signature level you need based on your documents and processes.

Digitise Your Business for Free - Chapter 8: Electronic Signatures That Withstand Scrutiny