Introduction

In order to issue a qualified certificate

for a trust service to a legal person according to eIDAS (e.g. QC eSeal or QWAC), Buypass must ensure that the certificate is issued to the actual legal person and not anyone claiming to be the legal person.

Buypass does this by verifying the identity of the

legal person by physical presence of an

authorized representative of the legal person. The authorization must be verified independently of the certificate application, via an authoritative source.

The physical presence requirement may be satisfied by alternative identification methods which provides equivalent assurance in terms of reliability to physical presence. This includes using an eID mean issued to the authorized representative at LoA High (or Substantial) and where a physical presence of the representative was ensured. Another alternative is to use a Qualified Electronic Signature.

Buypass must comply with specific requirements in the eIDAS regulation to accomplish this.

How to verify the identity

Buypass offers different options to verify the identity of a legal person according to eIDAS.

Contract Signer signs the Subscriber Agreement electronically

The Contract Signer must sign the Subscriber Agreement before a certificate may be issued. By doing this, the Contract Signer accepts the terms and conditions related to the use of the certificate.

The most easy and best option for verifying the identity is by having the Contract Signer signing the Subscriber Agreement by using an appropriate electronic signature. The Contract Signer must be an authorized representative according to an authoritative source, so authorization is already covered.

If the Contract Signer signs the Subscriber Agreement using a Qualified Electronic Signature, the identity has been properly verified according to the requirements. The Contract Signer may also sign the Subscriber Agreement using Advanced Electronic Signature based on an eID mean satisfying the physical presence requirement described above.

We may also accept electronic signatures (or electronic seals) from services where the service provider seal the Subscriber Agreement and ensures that the Contract Signer was authenticated and approved the Subscriber Agreement using an acceptable eID mean. Buypass can provide a list of authorized service providers and may also consider new service providers on demand.

Authorized Officer acts as authorized representative responsible for physical presence

In case the Contract Signer does not sign the Subscriber Agreement using an appropriate electronic signature, we must use alternatives. This may be the case if the Subscriber Agreement is signed with a handwritten signature or by an electronic signature not “strong enough” to meet our requirements.

In this case the Authorized Officer may act as the authorized representative - and the authorization is given in the Subscriber Agreement.

Authorized Officer signs a digital document electronically

Buypass may send a digital document to the Authorized Officer to be signed electronically satisfying the same requirements described for the Subscriber Agreement above.

Authorized Officer retrieves a physical letter by meeting up in person

Buypass may also send a physical document by physical mail using methods which requires physical presence to retrieve the letter at the Post Office. In this case, the letter includes information the Authorized Officer must provide to Buypass as evidence for meeting up in person. Whether this option can be used or not depends on the quality of the postal service in the applicable country. It can be used for Norwegian legal persons, and it may be used for non-Norwegian legal persons based on a case by case assessment.

Authorized Officer meets up in person

If the Authorized Officer is able to actually meet up in person at a Buypass office and identify herself by showing recognized identity documents (e.g. passport or national ID card), this will also be an acceptable way of verifying the identity.