How bb-sign signatures are valid

Signatures collected in bb-sign are electronic signatures (firma electrónica) with legal validity in Colombia, under Ley 527 de 1999 and Decreto 2364 de 2012. This page gathers the applicable legal texts and explains how bb-sign meets each condition: it identifies the signer, protects the integrity of the document and keeps the evidence of every signature.

Pending legal review

This page describes the bb-sign mechanism and cites the applicable law. It is not legal advice and has not yet been reviewed by a lawyer.

Legal basis

The Spanish text is the authoritative one; a short summary follows each quotation.

Ley 527 de 1999, article 7: the signature

Artículo 7. Firma. Cuando cualquier norma exija la presencia de una firma o establezca ciertas consecuencias en ausencia de la misma, en relación con un mensaje de datos, se entenderá satisfecho dicho requerimiento si:

a) Se ha utilizado un método que permita identificar al iniciador de un mensaje de datos y para indicar que el contenido cuenta con su aprobación;

b) Que el método sea tanto confiable como apropiado para el propósito por el cual el mensaje fue generado o comunicado.

Lo dispuesto en este artículo se aplicará tanto si el requisito establecido en cualquier norma constituye una obligación, como si las normas simplemente prevén consecuencias en el caso de que no exista una firma.

The law sets two conditions: the method identifies the signer and shows their approval of the content, and it is reliable and appropriate for the purpose. It does not require a specific technology.

Decreto 2364 de 2012: the electronic signature

Decreto 2364 de 2012, compiled in Decreto 1074 de 2015, regulates article 7 of Ley 527 and defines the electronic signature as a method (codes, passwords, biometric data, private cryptographic keys or others) that identifies a person in relation to a data message, provided it is reliable and appropriate for the purposes it is used for, considering all the circumstances of the case and any agreement between the parties.

The decree treats the signature as reliable when the signature creation data corresponds exclusively to the signer and any later alteration of the message is detectable. An electronic signature has the same value as a handwritten one; whoever relies on it demonstrates its validity through the evidence of the method.

Ley 527 de 1999, article 28: the digital signature

Artículo 28. Atributos jurídicos de una firma digital. Cuando una firma digital haya sido fijada en un mensaje de datos se presume que el suscriptor de aquella tenía la intención de acreditar ese mensaje de datos y de ser vinculado con el contenido del mismo.

Parágrafo. El uso de una firma digital tendrá la misma fuerza y efectos que el uso de una firma manuscrita, si aquélla incorpora los siguientes atributos:

1. Es única a la persona que la usa.
2. Es susceptible de ser verificada.
3. Está bajo el control exclusivo de la persona que la usa.
4. Está ligada a la información o mensaje, de tal manera que si éstos son cambiados, la firma digital es invalidada.
5. Está conforme a las reglamentaciones adoptadas por el Gobierno Nacional.

A digital signature (firma digital) is a specific figure: a cryptographic value bound to a certificate issued to the signing person by a Digital Certification Entity, which gives rise to the presumption of intent in article 28. The paragraph lists the attributes (unique to the person, verifiable, under their exclusive control, bound to the message so that any change invalidates it, compliant with government regulation) that give it the force of a handwritten signature.

How bb-sign meets the conditions of the law

bb-sign provides electronic signature. The method is recorded in the evidence of every envelope:

• Identification by email. Each signer receives a personal link at their email address; only whoever controls that mailbox can open it.
• Additional verification. The organization can require, envelope by envelope, a one-time code sent to the same email, which the signer types before signing.
• Express approval. The signer draws or types their signature, which is stamped into the document next to their name, email and the date.
• Integrity. Every signature is bound to the SHA-256 fingerprint of the documents the signer saw, so any later change is detected.
• Evidence. An audit trail records the date and time, IP address and browser of every action.

With this method, bb-sign meets both conditions of article 7: it identifies the signer and shows their approval in a way the organization can explain and prove. See Electronic signature and seal and Evidence and audit.

The organization’s seal

When an envelope completes, bb-sign seals each document with the organization’s certificate. The seal guarantees the integrity of the document and shows which organization sealed it; each signer’s identity is established by the electronic-signature evidence described above.

Configure your organization’s own certificate, issued by a Digital Certification Entity accredited by ONAC, so that validators recognize the seal as trusted. Until you do, bb-sign seals with a Binary Bridges testing certificate. See Your own certificate.

Choosing the mechanism for each document

The law requires a method that is “reliable and appropriate for the purpose”, and what is appropriate depends on the document, the risk and the parties. That is why clause 1.2 of the Terms and conditions states that each customer, through its legal office, decides whether the mechanism is appropriate for the documents it sends for signature. This page gathers the facts for that decision.