Skip to content
WQ3

Trust Center

Security

How WQ3 protects documents through the signing workflow.

Why teams use it

Documents are locked once sent.

Signer access is through individual invitations.

Every action is recorded.

Related

01

Audit trail

Every completed document comes with a record of each action and a completion certificate.

02

Privacy

How WQ3 handles personal data on this website and in signing workflows.

How we protect documents

01

Encrypted connection

All data travels over TLS 1.2 or newer.

02

Document fingerprint

A SHA-256 fingerprint reveals any change after signing.

03

Embedded signature

PAdES with a certified TSA timestamp for qualified levels.

04

Access control

Roles and permissions, and a private link per signer that shows only what is theirs.

05

Account verification

The eKYC add-on to verify the account holder's identity.

06

ISO/IEC 27001

WQ3 holds ISO/IEC 27001 certification for its information security management system.

07

ITIDA accreditation

WQ3 software is accredited by Egypt's Information Technology Industry Development Agency (ITIDA).

Start with the requirements for each signature

Before sending a document, decide what you need to establish about each signer and what the transaction requires. WQ3 offers three levels: electronic signature, remote signing and token signing. You can assign a different level to each signer in the same document, allowing the configuration to reflect each participant’s requirements rather than applying one choice to everyone.

The level-selection guidance points to electronic signatures for everyday agreements, and remote or token signing for formal, high-value contracts or organisations requiring a digital certificate. Account verification through eKYC is a separate decision that can accompany any level. Keeping these decisions separate helps avoid confusing verification of the account holder with selection of the signing level.

Understand what each security measure establishes

A useful security review separates protection during transmission, detection of file changes and evidence of signer identity. These answer different questions; they are not interchangeable forms of proof. A protected connection alone does not establish that a file copy remained unchanged later, and a matching fingerprint alone does not establish that someone had authority to approve a contract.

Use WQ3’s evidence to answer the relevant question, alongside your organisation’s own authority and approval checks. Before sending, review the intended version, participants and required signing levels. After completion, review the integrity of the copy in hand and the signing record, rather than relying only on the appearance of a signature on the page.

Verify copies when documents leave your organisation

Verification remains useful after signing is complete, particularly when a copy reaches a reviewer who was not involved in sending it. Every WQ3-signed contract has a public check page accessible without an account, with a QR code and reference. The code appears on the final file and completion certificate, giving recipients a route to verification.

When reviewing, check the actual copy received, not just an earlier file with the same name. The verification process compares the file’s fingerprint with the stored fingerprint and shows signer names, signature level and the timestamp of each step. This information supports review of file integrity and signing history, but does not replace assessment of the contract’s terms or the parties’ authority.

Turn security requirements into acceptance criteria

Create a short review checklist for each document type before signing begins. Identify the required participants, their signing levels, whether account verification is needed and the evidence the final reviewer will require. This turns security requirements into explicit transaction decisions rather than an assumption that one configuration suits every contract.

For Egyptian transactions, WQ3 is aligned with E-Signature Law No. 15 of 2004 and its executive regulations; legal validity remains conditional on meeting the applicable requirements. Review those conditions alongside any sector-specific or organisational requirements, rather than treating technical safeguards as a blanket guarantee for every use. At internal handover, include the final file and completion certificate so reviewers have the signing evidence and its context.

Start your first signing journey today.

Create your WQ3 account, or talk to us about your organization’s requirements.

Frequently asked questions

Is eKYC a fourth signing level?+

No. The three levels are electronic signature, remote signing and token signing. eKYC is an account-holder verification add-on that can be used with any level.

Must every signer use the same level?+

No. You can assign a different level to each signer in the same document, according to the transaction’s requirements and your organisation’s policies.

Does an external recipient need an account to verify a contract?+

No. The public check page allows verification without an account, using the contract’s QR code or reference, and shows signer names, signature level and step timestamps.

Does a matching fingerprint prove the signer can represent their company?+

No. Fingerprint comparison checks file integrity, not authority to represent an organisation. Review the signer’s authority and any delegation documents through your organisation’s approval process.

Do technical safeguards automatically make every contract legally enforceable?+

No. Egyptian Law No. 15 of 2004 gives electronic signatures and documents legal validity when its conditions are met. The transaction also requires review of applicable legal and organisational requirements.