A paralegal named Mara opens her first sealed certificate at a Basel law firm. The page is clear, but it is full of words she has never used at work: hash, timestamp, seal, escrow. She has to explain the document to a client within the hour. Seal is the verb we use for this, and to seal a file is to lock in its fingerprint and the time so the file can be checked later. You will meet these words on the certificate itself, in help pages, and in any dispute where the file matters. This glossary gives each word one plain sentence, with a link to the rule or standard behind it, so you can read a sealed document without a law degree.
How to use this list
Each word below gets one plain sentence, then a short note with a link to the rule or standard behind it.
You do not need to read it in order. Jump to the word on the certificate in front of you. Where a law is named, the link opens the official text, so you can check the wording yourself. If a word here is not on your certificate, you can safely skip it. These are general explanations, not legal advice for your own case.
Hash, also called a fingerprint
A hash is a short code worked out from a file, and any change to the file, even a single letter, gives a different code.
Because the code is unique to that exact file, it works like a fingerprint for data. It is produced by a public method, such as the SHA functions set out in NIST FIPS 180-4. Two different files almost never share the same code, so it is a reliable check that a file has not changed. The same file always gives the same code, so anyone can repeat the check and get the same result. When a file is sealed, only this hash is sent to the timestamp authority, not the file itself.
Qualified timestamp
A qualified timestamp is a trusted record of the exact time a file already existed.
In the EU, the rules for a qualified electronic time stamp are set in eIDAS Article 42, and the technical method most tools follow is described in RFC 3161. The word qualified means a trusted provider issued it under set rules, so it carries more weight than the clock on your own computer. It proves a point in time, not what the file says. So the timestamp answers one question well: did this file exist by this moment?
Qualified electronic signature (QES) and electronic seal
A qualified electronic signature links a document to a checked identity, and the law treats it like a signature made by hand.
Under the EU eIDAS Regulation and the Swiss Federal Act on Electronic Signatures (ZertES), a qualified electronic signature has the same legal effect as a handwritten signature. The word qualified is the key: the signer's identity was checked by a trusted provider before the signature was issued. A plain electronic signature, such as a typed name, does not reach this level. An electronic seal does the same job for an organisation rather than a single person.
KYC, the identity check
KYC, short for know your customer, means checking that a real, named person is behind a registration.
It is the step that turns an anonymous account into one tied to a verified individual. In practice it can mean checking an official document or a verified login, so the name on the account is a real one. A signature is only as strong as the proof of who stands behind it, so this check sits underneath everything else on the certificate.
Escrow
Escrow is a recovery route that can help you regain access if you lose it.
It is a safeguard kept to one side, apart from your day-to-day login, so that a lost password need not mean lost records. Where it exists, it is set up in advance and used only in defined cases, such as a user who can no longer sign in. Think of it as a backup path, not a promise about any single outcome.
Certificate of proof
A certificate of proof is the document that records what was sealed and the time it was sealed, not who wrote it.
It brings the hash and the timestamp together on one readable page, with a public link anyone can open to check them without an account. If someone later claims the file was different, the certificate lets anyone compare the stored fingerprint with the file in hand. Nothing on the page reveals the content of the file to the public. Read it as a record of a moment: this file existed in this exact form at this time, and nothing more.
Reading a certificate with these words in hand
With these six words, a sealed certificate stops being a wall of jargon.
- Hash: the fingerprint of the file.
- Timestamp: the moment it existed.
- Signature or seal: the checked identity behind it.
- Certificate: the page that holds all three together.
The next time a sealed file reaches you, open its public verification link and read the certificate line by line. The hash is the fingerprint, the timestamp is the moment, the signature is the identity, and the certificate ties them together. You can learn more about the platform at swisstrustlayer.com, then open a certificate and read it for yourself.
