E-Signature / Document Approval Schedule

1. Assurance levels (implemented — deliberately honest)

GBOS represents three assurance levels and never overclaims: (a) Internal approval — a governed, audited approval record, NOT an authenticated e-signature; (b) Authenticated electronic signature — the native GBOS ceremony (one-time bound token, explicit consent, captured evidence, keyed attestation): reliable, but NOT a Qualified Electronic Signature; (c) Qualified trust-service signature — routed through an external qualified trust service (eIDAS QES or equivalent). Only level (c) is a legally-qualified signature.

Native GBOS signing delivers level (b). It must not be presented as a QES. [SOLICITOR TO CONFIRM] which document classes require level (c).

2. The signing ceremony

A signer can only be marked signed by presenting a unique, expiring, one-time token bound to the signer identity and email, the tenant, the document and its locked version, and the signing order. Only a hash of the token rests in the database. The ceremony captures explicit consent (intent), the document hash fixed before the signature, timestamp, IP and user-agent, the signature method, and an evidence disclosure.

3. Evidence and completion

A completion certificate seals the exact executed content and is signed with a keyed GBOS attestation. [SOLICITOR TO CONFIRM] retention of signing evidence and any additional records needed for enforceability in target jurisdictions.