Transparency

Document Signing

Documents we issue for electronic signature are sealed with a True Build Design certificate and a third-party timestamp. This page lets anyone verify one without needing us, our signing platform, or our servers to still exist.

True Build Design LLC · Version 1.0 — 20 October 2026. Part of our Terms; client and vendor agreements may incorporate this page by reference.

1. What a signed document contains

Our signing portal at sign.truebuild.ae runs DocuSeal, an open-source e-signature platform, self-hosted by us and carrying True Build Design branding. Every completed document is a PDF that carries three things: the signers' marks, initials and stamps as placed; an appended audit log recording who signed, from which email address, when, and the SHA-256 hash of the file before and after signing; and a cryptographic signature over the whole file so that any later change, however small, is detectable.

Each signer receives the executed PDF and audit log by email on completion, and we file a copy in the project record. The copy in your hands is the evidence. Nothing on this page, or on our signing platform, needs to remain online for it to hold.

2. The certificate

The signature is made with a certificate issued by our own certificate authority. It is not on Adobe's public trust list, so Adobe Reader will report the signer as unknown until you tell it to trust our root certificate. That wording is about whether Adobe recognises the issuer, not about whether the signature is genuine. Check the fingerprint below against the one Adobe shows and the question is settled.

If we ever replace a certificate, the old one stays listed here with its dates. A document signed under it remains valid for the period it was in force.

3. The timestamp

Each signature is also countersigned by DigiCert's public timestamp authority at timestamp.digicert.com (RFC 3161). That token proves the document existed in exactly this form at that moment, and it is issued by DigiCert, not by us. It is the part of the signature that does not depend on anyone trusting True Build Design.

4. How to verify a document

In Adobe Reader. Open the PDF and the signature panel. Confirm the signature is intact and that the document has not been modified since signing. Click the signer certificate, compare its SHA-256 fingerprint with the one above, then choose to trust it if you wish the warning to go away.

On the command line. With poppler installed:

pdfsig signed-document.pdf

Expect Signature is Valid and Total document signed, with the signer named True Build Design Document Signing. "Certificate issuer isn't Trusted" is expected until the root certificate above is added to your trust store.

Independently of any viewer. Extract the signature's byte ranges and CMS object from the PDF and run:

openssl cms -verify -inform DER -in signature.der -content signed-bytes.bin -binary \
  -CAfile true-build-document-signing-root-ca.pem

A result of Verification successful ties the file to our root certificate with nothing in between.

5. Legal basis

Electronic signatures are recognised in the UAE under Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services. The signature, the timestamp and the audit log described above are the evidence of reliability that law looks for. Questions: [email protected].