itsme®: A European Success Story in Qualified Electronic Signatures

The Challenge Before itsme®

Before itsme® revolutionized the qualified electronic signature landscape, creating a legally equivalent signature in Europe was a complex, time-consuming process that deterred widespread adoption.

The Traditional QES Burden

Under the eIDAS Regulation, qualified electronic signatures (QES) require specific technical components to achieve legal equivalence with handwritten signatures. Traditionally, this meant:

Smart Card Readers and Hardware Tokens

Users needed physical smart card readers connected to their computers. The Belgian eID card, while technically capable of QES, required:

• Installation of middleware software (different versions for Windows, Mac, Linux)
• Purchase of a card reader (€15-30)
• Regular driver updates causing compatibility issues
• Physical presence at a computer—making mobile signing impossible

In-Person Identity Verification

Most Qualified Trust Service Providers (QTSPs) required signers to appear physically at registration authorities to verify their identity before issuing qualified certificates. This created friction points:

• Scheduling appointments during business hours
• Traveling to verification locations
• Waiting periods for certificate issuance (often 1-5 business days)
• Limited accessibility for remote workers or international users

Technical Expertise Barrier

The entire process required technical knowledge that excluded most average users:

• Understanding certificate authorities and trust chains
• Troubleshooting driver conflicts
• Managing certificate expiration and renewal
• Dealing with browser compatibility issues

The Market Opportunity

This complexity created a clear opportunity: Could qualified electronic signatures be as simple as unlocking your smartphone? itsme® answered this question definitively: Yes.

The itsme® Revolution: Mobile-First QES

Launched in Belgium in 2017, itsme® reimagined qualified electronic signatures by leveraging the device everyone already carries: the smartphone.

The Core Innovation: Your Smartphone as a QSCD

itsme® transformed the smartphone into a Qualified Signature Creation Device (QSCD)—the technical requirement under eIDAS for creating QES. This meant:

• No additional hardware: No card readers, USB tokens, or dedicated devices
• Biometric authentication: Fingerprint or Face ID replaces PIN codes and physical cards
• Mobile-native experience: Sign documents anywhere, anytime, in seconds
• Secure key storage: Private signing keys protected in device secure enclaves

Simplified Identity Verification

itsme® streamlined the identity verification process that had been a major barrier to QES adoption:

Bank-Based Identity Verification

Rather than requiring in-person verification at registration authorities, itsme® partnered with Belgian banks to leverage their existing KYC (Know Your Customer) processes. Users could:

1. Register through their trusted bank’s infrastructure
2. Verify identity using existing banking relationship
3. Complete the entire process in 7-10 minutes from home

NFC Document Reading

For users with NFC-enabled smartphones, itsme® introduced automatic identity document verification:

• Hold phone against eID card or passport
• App reads cryptographically signed data from document chip
• Facial recognition matches user to document photo
• Identity verified without manual data entry or human review

The 60-Second Signing Experience

Once registered, creating a qualified signature with itsme® takes approximately one minute:

1. Receive notification: Email or SMS with secure signing link
2. Review document: Open document on any device to review contents
3. Authenticate: Open itsme app, authenticate with biometric (fingerprint/Face ID)
4. Confirm: Review signature details and confirm
5. Complete: Qualified signature applied instantly, legally equivalent to handwritten

Compare this to the traditional process:

• Print document (if digital)
• Sign with pen
• Scan signed document
• Email or upload
• File original (10-15 minutes minimum)

The user experience difference is transformative—and explains itsme®’s rapid adoption.

From Belgian Innovation to European Standard

What began as a Belgian identity solution has evolved into a pan-European qualified electronic signature platform.

Phase 1: Belgian Market Leadership (2017-2020)

itsme® first established dominance in its home market of Belgium:

• Government adoption: Federal and regional governments integrated itsme for citizen services
• Banking sector: All major Belgian banks supported itsme for secure authentication
• Private sector: Insurance, telecom, utilities adopted itsme for customer onboarding
• Critical mass achieved: 6+ million Belgian users (over 50% of population)

Phase 2: QTSP Certification (2019)

In 2019, itsme® achieved Qualified Trust Service Provider (QTSP) status under eIDAS supervision by Belgium’s Federal Public Service Economy. This meant:

• Signatures created with itsme became qualified electronic signatures (QES)
• Legal equivalence to handwritten signatures across all EU member states
• Mandatory cross-border recognition under eIDAS Article 25(2)
• Appearance on the EU Trusted List of qualified trust service providers

Phase 3: European Expansion (2020-2024)

Initial Benelux Coverage

itsme® first expanded beyond Belgium to cover the complete Benelux region:

• Netherlands: Integration with Dutch identity infrastructure
• Luxembourg: Completing Benelux economic union coverage

Western Europe Rollout

From 2022-2024, itsme® systematically expanded across Western European markets:

• France, Germany, Spain, Italy (major EU economies)
• Austria, Portugal, Ireland (strategic markets)
• Scandinavia: Denmark, Sweden, Finland, Norway

Complete EU Coverage

By 2024, itsme® achieved comprehensive coverage:

• All 27 EU member states
• EEA countries: Norway, Iceland
• United Kingdom (post-Brexit recognition maintained)
• Total: 30 European countries

The Numbers

Technical Deep Dive: How itsme® Maintains QES Status

Understanding itsme®’s technical architecture explains how it achieves both convenience and qualified status simultaneously.

The QSCD: Smartphone Secure Enclave

Modern smartphones (iPhone with Secure Enclave, Android with Trusted Execution Environment) provide hardware-level security meeting QSCD requirements:

Key Generation and Storage

• On-device generation: Private signing keys generated within device secure enclave
• Hardware isolation: Keys cannot be extracted or copied, even by device owner
• Biometric protection: Key usage requires fingerprint or facial biometric authentication
• Tamper detection: Secure enclave detects jailbreaking/rooting and refuses to function

Signature Creation Process

When you sign a document with itsme:

1. Document hash (cryptographic fingerprint) sent to itsme app
2. User authenticates with biometric
3. Secure enclave uses private key to sign hash
4. Signature sent to itsme servers for timestamp and certificate attachment
5. Complete QES package returned to document platform

Your private key never leaves your device—maintaining QSCD security requirements.

Qualified Certificates

Each itsme user receives a qualified certificate issued by itsme’s certification authority (supervised by Belgian authorities):

Certificate Contents

• Identity information: Full name, date of birth, unique identifier
• Public key: Corresponding to private key in device secure enclave
• Validity period: Typically 3 years
• Certificate serial number: Unique identifier for this certificate
• Issuer information: itsme as qualified trust service provider

Certificate Validation

Anyone receiving an itsme-signed document can validate:

• Certificate authenticity: Verify it was issued by itsme (appears on EU Trusted List)
• Certificate validity: Check it hasn’t expired or been revoked
• Signature integrity: Confirm document hasn’t been altered since signing
• Signer identity: View verified identity information from certificate

Timestamp Services

Every itsme signature includes a qualified timestamp proving:

• Exact moment signature was created (to the second)
• Document existed in current form at that time
• Timestamp itself issued by qualified timestamp authority

This prevents disputes about signing time and provides Long-Term Validation (LTV) even after certificate expiration.

Multi-Layer Security Model

itsme employs defense-in-depth security:

1. Device security: Hardware secure enclave, biometric authentication
2. Application security: App integrity verification, certificate pinning
3. Network security: TLS encryption, mutual authentication
4. Backend security: HSM-based certificate authority, ISO 27001 certified infrastructure
5. Operational security: Regular audits, penetration testing, conformity assessments

Real-World Adoption: Who Uses itsme® QES?

itsme®’s combination of legal validity and user convenience has driven adoption across diverse sectors and use cases.

Government Services

Citizen-Government Interactions

European governments use itsme® for official documents requiring qualified signatures:

• Tax filings: Digital submission with qualified signature attestation
• Administrative requests: Official certificates, permits, licenses
• Social benefits: Application and renewal processes
• Legal declarations: Statements requiring sworn authenticity

Public Procurement

Government procurement platforms integrate itsme® for:

• Tender submissions with qualified signatures
• Contract awards and acceptances
• Compliance documentation

Financial Services

Banking

Banks use itsme® for transactions requiring highest security:

• Account openings: Remote KYC with qualified signature
• Loan agreements: Mortgage and credit contracts
• Investment mandates: Asset management authorization
• Power of attorney: Delegation of banking authority

Insurance

Insurance providers leverage itsme® for:

• Policy applications and contracts
• Claims processing and settlements
• Beneficiary designations
• Policy modifications requiring formal consent

Real Estate

Rental Agreements

Property managers and landlords use itsme® for:

• Lease contracts with qualified signatures
• Lease renewals and amendments
• Deposit and inventory documentation
• Early termination agreements

Real Estate Transactions

While full property transfers still require notarial acts in most EU countries, itsme® enables:

• Preliminary sale agreements
• Reservation contracts
• Power of attorney for property transactions
• Construction contracts

Corporate and HR

Employment Documentation

Human resources departments use itsme® for:

• Employment contracts: Legally binding agreements with QES
• Non-disclosure agreements: Confidentiality with enforceability
• Amendments and promotions: Contract modifications
• Termination agreements: Severance and separation terms

Cross-Border Transactions

Since itsme® QES must be recognized throughout the EU under eIDAS, businesses use it for contracts with partners in 30 European countries. Belgian companies sign agreements with French suppliers, German clients, Dutch partners, and businesses across Europe. Mandatory cross-border recognition eliminates legal uncertainty and enables seamless international transactions.

Professional Services

Legal Professionals

Lawyers and notaries integrate itsme® for:

• Client engagement letters
• Power of attorney documents
• Preliminary notarial acts
• Court filings requiring qualified signatures

Healthcare

Medical professionals use itsme® for:

• Patient consent forms requiring legal validity
• Medical power of attorney
• Prescription authorizations
• Healthcare provider contracts

itsme® vs Other QES Solutions

While itsme® dominates in its coverage area, understanding alternative qualified signature methods helps determine the best fit for specific needs.

Comparison with Other European QES Providers

Feature	itsme®	Evrotrust	Adacom
Geographic Coverage	30 European countries	58 countries	68 countries
App Requirement	Yes (mobile app)	Yes (mobile app)	No (web-based)
Registration Process	NFC ID scan + facial recognition	Photo ID + facial recognition	Per-signature verification
Registration Time	5-10 minutes	5-15 minutes	N/A (no registration)
Signing Time (After Registration)	30-60 seconds	30-60 seconds	2-5 minutes
Repeat Signing Efficiency	Excellent	Excellent	Moderate
Primary Markets	Western & Central Europe	Eastern Europe, Balkans	Global
Best For	European businesses, frequent signers	Eastern European operations	International, one-time signers

When to Choose itsme®

itsme® excels in these scenarios:

When to Consider Alternatives

Choose Evrotrust if:

• Your operations span Eastern Europe, Balkans, or transcaucasus regions where itsme® has limited coverage
• You need broader geographic reach (58 vs 30 countries)
• Your signers are in markets like Bulgaria, Serbia, Ukraine, Georgia, Kazakhstan where Evrotrust has strong presence

Choose Adacom if:

• You require truly global coverage (68 countries including Asia, Middle East, Americas)
• Signers are one-time or infrequent users unwilling to install an app
• You need no-friction signing without pre-registration requirement
• Your operations span markets outside Europe where neither itsme® nor Evrotrust provide coverage

Accessing itsme® Through QES-Sign

While itsme® is a qualified trust service provider, most businesses access itsme® qualified signatures through qualified signature platforms like QES-Sign.

Why Use a Platform vs. Direct Integration?

Multi-Provider Access

Platforms like QES-Sign offer itsme® alongside Evrotrust and Adacom, enabling:

• Geographic flexibility: Use itsme® for Western European signers, Evrotrust for Eastern Europe, Adacom for global
• Use case matching: Choose optimal method per signature based on signer location and preferences
• Redundancy: If itsme® experiences service issues, alternative qualified methods remain available

Simplified Billing

Rather than separate contracts with each QTSP:

• Single invoicing across all signature methods
• Unified credit system (purchase €100, use across itsme®, Evrotrust, or Adacom as needed)
• No minimum commitments or subscription lock-in

Document Management

Platforms provide workflow capabilities beyond just signature creation:

• Multi-party signing: Collect signatures from multiple people sequentially or in parallel
• Document templates: Reuse contracts with variable fields
• Audit trails: Complete history of who signed when with which method
• Integrations: Connect to CRM, document management, or business systems via API

Pricing: Pay-Per-Use Model

QES-Sign offers itsme® qualified signatures with transparent pay-per-use pricing:

• €5 per qualified signature (whether itsme®, Evrotrust, or Adacom)
• No subscription fees
• No monthly minimums
• No setup costs
• No per-user licensing

Implementation Scenarios

The Future: itsme® and eIDAS 2.0

The European Union is currently revising the eIDAS Regulation (eIDAS 2.0), with significant implications for itsme® and digital identity more broadly.

European Digital Identity Wallet (EUDIW)

eIDAS 2.0 introduces the concept of a European Digital Identity Wallet—a mobile app enabling citizens to:

• Store and present identity attributes securely
• Authenticate to online services across Europe
• Create qualified electronic signatures
• Hold verifiable credentials (driver’s license, professional qualifications, etc.)

itsme®’s Positioning

itsme® is well-positioned for EUDIW compatibility:

• Existing mobile infrastructure: itsme® is already a mobile-first identity solution
• QTSP status: itsme® can issue qualified certificates for EUDIW
• High trust level: itsme® meets eIDAS “substantial” and “high” assurance levels
• Multi-country presence: itsme®’s 30-country reach aligns with EUDIW’s pan-European vision

Increased QES Adoption

eIDAS 2.0 aims to increase qualified electronic signature adoption from current levels (estimated <5% of electronic signatures) to mainstream usage. Several provisions support this:

• Government mandates: Member states must accept QES for all online public services
• Reduced friction: EUDIW integration will make QES as easy as standard authentication
• Private sector incentives: Regulatory requirements in finance, healthcare, legal services

itsme®, as an established QTSP with millions of users, stands to benefit from this regulatory push toward qualified signatures.

Cross-Border Use Cases

eIDAS 2.0 emphasizes seamless cross-border digital identity and signatures. itsme®’s current 30-country coverage positions it to become a de facto European standard for:

• Remote employment contracts across EU borders
• International commercial agreements
• Cross-border professional service delivery
• Pan-European government service access

Key Takeaways

• itsme® transformed qualified electronic signatures from complex to consumer-friendly: By leveraging smartphones as QSCDs and enabling biometric authentication, itsme® reduced signature time from 15+ minutes to 30-60 seconds while maintaining full legal equivalence.
• Accepted in 30 European countries with mandatory recognition: itsme® qualified signatures are legally recognized in 30 European countries under eIDAS, enabling seamless cross-border transactions without country-specific setup or legal uncertainty.
• Mobile-first architecture meets modern user expectations: 6+ million users have adopted itsme® because it delivers security through familiar smartphone interactions—fingerprint/Face ID authentication feels intuitive compared to card readers and PIN codes.
• Optimal for repeat signing scenarios: Organizations requiring frequent qualified signatures achieve maximum efficiency with itsme®’s one-time registration model, where 7-minute setup enables unlimited 30-second signatures.
• Access through platforms maximizes flexibility: Using itsme® via platforms like QES-Sign enables pay-per-use pricing (€5/signature, no subscription), multi-provider optionality (combine with Evrotrust/Adacom for broader coverage), and unified document workflows.

Frequently Asked Questions

Is an itsme® qualified signature legally equivalent to a handwritten signature?

Yes. itsme® provides qualified electronic signatures (QES) that are legally equivalent to handwritten signatures across all 30 covered European countries under Article 25(2) of the eIDAS Regulation. Courts cannot reject an itsme® signature solely because it’s electronic.

Which countries does itsme® support?

itsme® supports qualified signatures for users in 30 European countries: all 27 EU member states (Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden), plus Iceland, Norway, and the United Kingdom.

Do I need to download an app to use itsme®?

Yes. itsme® requires downloading the mobile app (available for iOS and Android) for both initial registration and subsequent signing. The app serves as your qualified signature creation device (QSCD). If you prefer not to download an app, alternative QES methods like Adacom offer no-app-required signing.

How long does itsme® registration take?

itsme® registration typically takes 5-10 minutes. The process involves scanning your ID card or passport using NFC technology (or photo capture), completing facial recognition, and bank verification (for Belgian residents). Once registered, your qualified certificate is valid for three years.

Can itsme® signatures be used for government documents?

Yes. Many European government agencies specifically accept itsme® qualified signatures for official submissions, tax filings, permit applications, and administrative procedures. Under eIDAS, government entities must accept qualified electronic signatures for online services.

How does itsme® compare to Evrotrust or Adacom?

itsme® offers solid European coverage (30 countries) but less than Evrotrust (58 countries) or Adacom (68 countries). itsme® requires app installation but enables faster repeat signing than Adacom’s per-signature verification. Choose itsme® when your operations focus on Western/Central Europe and repeat signing efficiency matters.

What happens if my phone is lost or stolen?

Your qualified certificate and signing keys are protected by device-level encryption and biometric authentication. If your device is lost, immediately contact itsme® support to revoke your certificate. You can then register again on a new device. Previous signatures remain valid as they’re timestamped and cryptographically signed.

Can multiple people in my organization use itsme®?

Yes. Each individual requiring qualified signature capability must register separately with their own identity document and mobile device. Organizations can manage multiple itsme® users through platforms like QES-Sign, which provide centralized billing and document management while maintaining individual qualified certificates.

Conclusion

itsme®’s journey from Belgian identity solution to pan-European qualified signature platform demonstrates how technical innovation can democratize legal tools. By transforming the smartphone into a qualified signature creation device, itsme® made legally equivalent signatures accessible to millions of Europeans who would never have navigated traditional QES complexity. The platform’s success—6+ million users, 30-country coverage, 500+ integrated services—reflects market demand for security and convenience in equal measure. itsme® proves qualified signatures don’t require sacrificing user experience for legal validity. For businesses operating within itsme®’s coverage area, the value proposition is compelling: mandatory cross-border recognition, instant repeat signing, and widespread user familiarity. When accessed through pay-per-use platforms like QES-Sign (€5/signature, no subscription), itsme® qualified signatures become practical for organizations of any size. As eIDAS 2.0 implementation approaches, itsme®’s mobile-first architecture and existing user base position it to play a central role in Europe’s digital identity future. The qualified signature category that once required specialized hardware and technical expertise is now as simple as unlocking your phone.