INVOICES SECURED BY MEANS OF AN ELECTRONIC SIGNATURE

What is an electronic signature ?

The electronic signature is a means of securing electronic invoices accepted by the French legislator. It autonomously guarantees the authenticity, origin, and integrity of the content.

Only electronic signature that complies with the General Security Repository (RGS) and the eIDAS Regulation  are allowed:

• Either the advanced electronic signature with qualified certificate (level 3);
• Either the qualified electronic signature (level 4).

The secure electronic signature creation device shall ensure by appropriate technical means and procedures that the electronic signature created data:

1. Cannot be established more than once and their confidentiality is ensured.
2. Cannot be found by deduction and that the electronic signature is protected against falsification.
3. May be satisfactorily protected by the signatory against use by others.

It must also not allow any alteration and must not prevent the signatory from having an exact knowledge of the content before signing it

Verifications

integrity of the document, using the data inserted in the electronic certificate attached to the electronic signature.

• This verification must be possible not only upon receipt of the invoice but also at any time during the planned retention period.
• Verifying the document fingerprint using the signer’s public key ensures that the document signed by the invoice issuer has not been altered or subsequently modified.
• In addition, the company receiving the invoices must also ensure the authenticity and validity of the electronic certificate attached to this electronic signature verification data.
• These provisions are applicable to the recipient of electronic invoices accompanied by an electronic signature (or server stamp) regardless of the format of the latter.

• Demonstrate the reliability of the electronic certification services it provides.
• Ensure the operation, for the benefit of the persons to whom the electronic certificate is issued, of a directory service listing the electronic certificates of the persons who request it.
• Ensure the operation of a service allowing the person to whom the electronic certificate has been issued to revoke this certificate without delay and with certainty.
• Ensure that the date and time of issuance and revocation of an electronic certificate can be accurately determined.
• Employ staff with the knowledge, experience and qualifications necessary to provide electronic certification services.
• Apply appropriate security procedures.
• Use systems and products that guarantee the technical and cryptographic security of the functions they provide;
• Take all appropriate measures to prevent the falsification of electronic certificates.
• In the event it provides the signatory with electronic signature creation data, guarantee the confidentiality of such data during their creation and refrain from retaining or reproducing such data.
• Ensure, in the event that both creation data and electronic signature verification data are provided, that the creation data corresponds to the verification data.
• Keep, possibly in electronic form, all information relating to the electronic certificate that may be necessary to prove the electronic certification in court.
• Use electronic certificate retention systems.