Every Procurement File issued by Visualnet is an electronically signed PDF file. This page explains what it contains, what it means and how to check it yourself, without relying on Visualnet.
What the File contains
- Advanced electronic signature of Production Lifecycle Management, S.L. (Visualnet), applied by its legal representative with a qualified representative certificate issued by FNMT-RCM.
- Qualified time stamp from FNMT-RCM, which fixes the date and time at which it was signed.
- PAdES-B-LTA format: the PDF itself contains the data needed to validate it in the long term.
FNMT-RCM is listed on the European trusted list as a qualified provider of both services.
What it means
- Under Article 41.2 of Regulation (EU) 910/2014 (eIDAS), a qualified time stamp enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which it is bound: the File is presumed to have existed on that date and not to have been modified since.
- In Spain, if the File is challenged in court proceedings, Article 326.4 of the Spanish Civil Procedure Act (Ley de Enjuiciamiento Civil) presumes that it has the characteristic in question, because qualified trust services from a provider on the trusted list were used.
What the signature does not attest. The signature and the time stamp attest that the document is the one that was issued, and when. They do not by themselves attest that what it records is accurate. The procurement process is documented by the File itself, with the list of invited companies, the offers and the award. If the recipient needs it, an audit firm may also issue an agreed-upon procedures report (ISRS 4400) on it: it is neither an audit nor a certification, and the evidentiary value of the File does not depend on that report.
The platform record is verified separately. The events of the process are chained with SHA-256 hashes and numbered without gaps. An auditor with access to the project can download them from the Auditor Portal and recalculate the chain (section 6 of the File).
How to verify it
Before uploading the File to an online service, check that your internal rules allow it: the File contains data about suppliers and individuals.
1 · With Adobe Acrobat Reader
- Open the PDF as you received it and open the Signatures panel.
- With the European trusted list up to date, Acrobat indicates that the document is signed and that all signatures are valid, and shows both the signature and the time stamp as valid.
- If the time stamp appears as of unknown validity, your copy of the list may be out of date. Update it in Preferences › Trust Manager (on a Mac, in the Acrobat menu; on Windows, in the Edit menu): under “Automatic European Union Trusted Lists (EUTL) updates”, click “Update Now”, then close the PDF and open it again.
2 · With VALIDe, the validation service of the Government of Spain
At valide.redsara.es, upload the PDF using the signature validation option. The service indicates whether the signature is correct and who made it.
3 · With your organisation’s validation service
Or with any validator that uses the European trusted list.
4 · Check the provider
On the European Commission eIDAS Dashboard (https://eidas.ec.europa.eu/efda/tl-browser/), look up Spain and FNMT-RCM: its qualified services for certificates and time stamps are listed there.
Outside the European Union
Qualified trust services are a concept of European Union law. Outside the Union, the signature and the time stamp can be checked technically by the same means. The weight given to them by the authorities of each country is governed by that country’s law.
Help
If you have questions about validating a File, write to validacion@visualnet.com quoting its reference (shown in the header and footer of each page).