Most questions about sealing arrive the week someone first needs proof. A client disputes a date. An auditor asks whether a file has changed.
Here are the twelve we hear most, limits included. Steps in order: how it works.
What exactly gets sealed?
A fingerprint of each file is signed with a timestamp. The file itself is never changed.
You upload files into a folder. Each file gets a cryptographic fingerprint, called a hash. Swisscom Trust Services, the qualified trust service provider, signs that fingerprint with a timestamp under RFC 3161. For a PDF, the signature is embedded in the PDF. Each sealed folder version gets a certificate of proof. That signed PDF lists every file, its hash and the sealing time in UTC. More: what happens when you seal a file.
Does my file leave your servers?
Only the fingerprint goes to Swisscom Trust Services. The file stays in your folder on Swiss Trust Layer.
The signing key never leaves Swisscom Trust Services hardware. A hash alone cannot be turned back into the document. Anyone holding the original file can confirm the match. On data protection: GDPR sealing guide.
Who can check a sealed document?
Anyone. The public validator takes any signed PDF, no account and no registration.
Upload the PDF at swisstrustlayer.com/validate. It checks the signature chain, the issuing certificate authority, certificate expiry and timestamp integrity. It reports who signed, when, with which certificate, and whether the content was modified after signing. It recognises eIDAS and ZertES qualified signatures and never stores the document content. The QR code on the certificate opens a second public page, no login, with the result and the certificate PDF.
What does the certificate of proof show?
Who sealed, when, and a list of the sealed files with their fingerprints.
The certificate shows "Sealed for" and the account holder's name, the sealed date and time in UTC, a Cert ID and a QR code. A table lists each file's name and hash. Where present, it adds the ISCC code, AI declaration, human authors, approver, rights claimed and other rights holders. An identity block, passport number as asterisks, appears only if that version was sealed after identity verification. Anyone with the link or QR can open that page and download the certificate, so keep personal data out of file names. Field by field: how to read a certificate of proof.
Do I need to verify my identity?
Not to seal. Identity verification is optional, but content labels and ISCC codes need it.
It is a passport check through DIDIT, provided via Swisscom Trust Services. The identity snapshot is taken at sealing time. A later change never rewrites an issued certificate.
What are the content labels?
Six self-declarations about how a work was made, from HUMAN AUTHORED to AI GENERATED.
The Content Label Terms with ProLitteris define HUMAN AUTHORED, HUMAN APPROVED, AI FREE, AI ASSISTED, AI MODIFIED and AI GENERATED. Each content and version carries exactly one AI label. HUMAN AUTHORED goes only with AI FREE. HUMAN APPROVED comes from a different person than the author. A label is a self-declaration; it does not indicate whether the content is protected by copyright. Declarations are locked once sealed. An ISCC code is a content code under ISO 24138:2024. A file ISCC cannot fingerprint is still sealed. More: the labels explained.
What happens if I edit the file after sealing?
The seal stays on the version you sealed. The edited file shows as changed.
Any change gives a different fingerprint, so the validator reports content modified after signing. Under Article 41(2) of the eIDAS Regulation, the date, time and data bound to a qualified electronic time stamp are presumed correct unless shown otherwise. Seal the edited file as a new version.
Can I seal a new version of the same work?
Yes. Each version is sealed and certified on its own.
Every folder has a Version History and Add new Version. Each version gets its own hash, timestamp, certificate and note. The hashes and declared labels of an issued version never change. One exception: a certificate can take ISCC data and the verified identity without a new version. More: seal every draft.
Can other people sign with me?
Yes. Each co-signer adds their own qualified electronic signature.
A sealed folder can be shared with other users with roles. For co-signing, the owner adds signers by name, email and phone. A signature field is placed on the PDF for each. The owner signs first, then each co-signer signs with their own qualified electronic signature. In Swiss law, Article 14 paragraph 2bis of the Code of Obligations covers this. It treats an authenticated electronic signature with an authenticated time stamp under ZertES as equivalent to a handwritten signature. That holds unless a law or contract says otherwise.
What does the seal not prove?
It does not prove who wrote the file, whether it is true, or who owns the rights.
It proves this exact file existed at that moment and has not changed since. It does not prove a signature inside the file is genuine, or that a mark was used in trade. A timestamp cannot be added backwards. It does not create copyright. Under Article 5(2) of the Berne Convention, copyright is not subject to any formality. More: a timestamp proves existence, not identity.
What happens if I delete my data?
Deleting removes files and certificates from the portal. Sealed PDFs you already downloaded stay valid.
A folder can be deleted; the portal warns this cannot be undone. Account deletion is a request. Once approved, it permanently deletes the profile, every uploaded or sealed file, the signing history, issued certificates and billing records. Download your data first. A sealed PDF and certificate you already hold stay valid, because the validator reads only the PDF.
What is ESCROW Storage?
An optional Swiss-hosted storage choice, tied to the verified identity of the account holder.
Folders deposited there receive an ESCROW ID for recovery. Swisscom Trust Services provides the storage, ProLitteris operates the escrow, Swiss Trust Layer provides the technology. Lost credentials? Re-verify your identity, online or in person through a KYC agent, and access is restored.
One step this week
Seal one file you would struggle to defend from memory, then check it yourself.
Check its name carries nothing personal. Seal it, download the sealed PDF and certificate, then upload the PDF to swisstrustlayer.com/validate. Read the report anyone else would see.
Seal your first document on Swiss Trust Layer and have the answer ready before the question arrives.
