Signatures and ceremonies · Sydney · October 2026
Wippli SignWippli Sign
Certified signatures. Verifiable by anyone.
CeremoniesPermissionsVerifyApplicationsPricingAuthoritiesSecurityVerifyContact
Verify a documentSign a document

Front page

This is
Wippli Sign.

Sign in turn. Keep the record.

Wippli Sign runs signing ceremonies: a key by email, one party at a time, a certificate for every signatory, a seal with an independent timestamp, and a record that a stranger can check without an account.

Own signing authorityTimestamped by DigiCertPublic ledger

Sign a document · US$9.99Read the ceremoniesVerify one
Service agreement SIGNATURE ON THE PUBLIC LEDGERENTRY 18 · 4D641E2C CERT2 H WIPPLI SIGN SEALED DIGICERT 13:37 AUDIT LOG✓ INVITED✓ OPENED✓ SIGNED✓ SEALED

Ceremony 01 · Documents

A signature that a stranger can check.

Each ceremony issues a short-lived certificate to every signatory, seals the document to the PAdES standard with an independent timestamp, writes an audit log of who opened and who signed, and enters the result in a public ledger. A key by email, in turn; no account, no app, no password.

  • Signing PrepPay per document, no subscription. You organise, they sign, in the order you set. US$9.99 a document.
  • In turnOrganiser first, or any party first. Each signatory sees the signatures before theirs; the organiser is told at every step.
  • CopiesThe signed PDF, the audit log and the proof go to every party when the last one has signed.
Figure 2 · What holds it uppolicy 0.1
  • Issued per ceremony: a certificate per signatory, an attestation of what each filled in, a seal over the PDF and the audit log, a signed proof envelope.
  • Independent of us: time from DigiCert, free verification at sign.wippli.ai/verify, a public hash-chained ledger, storage encrypted per document.
Signing PrepThe ledger

Ceremony 02 · Permissions

An agent asks. A person approves.

A requester, human or machine, states who is asking, what action, for how long, for which task and why. One approver reads a one-page permission request and signs it with an emailed key. The signature becomes a sealed PDF, a sealed audit log, a signed proof that carries the request as claims, and a ledger entry. The proof goes to the service that asked, and that service decides what the grant means.

  • RequestRequester, action, duration, task and reason, as submitted.
  • ApprovalOne named approver, one emailed key, one page to read and sign.
  • ProofThe claims ride inside the certificate, the seal, the audit log and the envelope.
  • CallbackDelivered to the asking service, which grants, limits or refuses.
Figure 3 · The claims, in four placesEC P-256, two hours
  • In the signatory's certificate, issued for that ceremony only and named after it.
  • In the seal, with every party's certificate fingerprint.
  • In the audit log, a sealed PDF with the whole trail: created, emailed, opened, signed, sealed, delivered.
  • In the proof envelope, signed by the authority's proof key, public at a fixed address.
Who stands behind itSigning policy

Verification · Open to all

No account. No call to us.

Checking a Wippli Sign document needs nothing from Wippli. The root certificate and the policy are published. The verify page reads a sealed PDF or audit log and reports what it finds. The ledger is a public hash chain with one entry per completed ceremony.

  • The rootroot.pem under .well-known; its fingerprint is printed in every audit log and on the back of every task board.
  • The policypolicy.json: the version in force, the claims extension, timestamping on, the verify address.
  • The pageSeal intact, signature valid, trusted by the root, timestamp time, and whether the file's hash is on the ledger.
  • The ledgerapi/ledger: every completed ceremony, chained by hash, readable by anyone.
Figure 4 · The docketlive and proposed
01 · Document ceremonieslive
02 · Permission ceremonieslive
03 · Identity check before signingproposed
04 · Ledger anchored outside the serviceproposed
05 · Revocation of a grantproposed
Verify a documentAuthority root

Editorial

What a signature here actually is.

Three things, every time. A certificate issued to that signatory, for that document only. A seal over the whole PDF, so any change after signing shows. An independent timestamp from DigiCert, so the time is not ours to set. The signed copy, the audit log and the proof go to every party, and anyone can check them without asking us.

Signing policyAuthority root
Figure 5 · What you get, and the limitspolicy 0.1

What you get

  • A certificate per signatory, a seal over the PDF, an independent timestamp
  • An audit log of who was invited, who opened and who signed, with the time of each
  • A proof anyone can read, and an entry on a public ledger
  • Documents encrypted at rest, keys of eight digits, tries limited

The limits

  • The seal rests on the Wippli Sign root, not on a public certificate authority
  • Identity means holding the emailed key; an identity-document check is not yet a step
  • What a signature binds depends on the law that applies to you
  • Nothing here is legal advice

Practical applications

What you can do with it.

01

Send a document, know it was opened

Each party is invited by email with a key of their own. The audit log records the invitation, the moment the key was accepted and the signature, each with its time. You know who opened and when.

Delivery and opening, on the record
02

Sign a document

A contract, a consent, a release. Signatures, initials, dates and stamps are placed where you want them; the result is one sealed PDF that every party holds.

Signature documents
03

Run a ceremony

One organiser, up to four parties, in the order you set. Each signatory sees the signatures before theirs, and the organiser is told at every step until the last seal.

Ceremonies, in turn
04

Your own signing authority

Wippli Sign runs its own authority: a certificate for each signatory, issued for that document only, under a published root and policy. No public certificate authority is in the loop.

Authorities
05

Approve what an agent asks

An AI agent asks for a specific action for a set time; a named person approves it by signing. The approval travels inside a proof the asking service can verify.

Permissions
06

Prove it later, to anyone

Drop the signed PDF or the audit log on the verify page: seal intact, signature valid, time, and whether it is on the ledger. Free, no account, years from now.

Verification and the ledger

Plain pricing

Pay per document. Nothing to subscribe to.

US$9.99

Signing Prep, per document

One organiser and up to three signatories, in the order you set. Fields placed by you; keys by email; the signed PDF, the audit log and the proof to every party at the end. No account for anyone who signs.

Buy once, use for one document
By arrangement

Permission ceremonies

Your service asks, a named person approves, the proof comes back to your service. Set up for your workflow, with the request written into the certificate. Write to us with the action and the approver.

For platforms and agents
Free

Verification

The verify page, the proofs, the ledger, the policy and the root certificate are public. Checking a document costs nothing and needs no account, for you or for anyone you hand it to.

Always

An invitation

Certified ceremonies, for every process.

Insurance, construction, health, finance, education, public bodies: wherever a signature has to be checked by a stranger, or an agent's action needs a named person's approval, we can set the ceremony up. One product is live today; the method travels.

Contact us sign@wippli.ai
Write to usSee the store

Tell us the parties, the order and what the record must prove. We answer with a proposal and a first run.

A ceremony, simulatedPreparing
Service agreement
Party 1 · signature
Party 2 · signature
Key emailed · 8 digitsKey emailed · 8 digits
  1. 01Organiser places the fields and sendsOrganiser
  2. 02An eight-digit key goes to Party 1 by emailWippli Sign
  3. 03Party 1 opens with the key and signsParty 1
  4. 04A key goes to Party 2; the organiser is toldWippli Sign
  5. 05Party 2 sees the first signature and signsParty 2
  6. 06Sealed with a certificate and an independent timestampWippli Sign
  7. 07Copies and audit log to everyone; proof on the public ledgerOn the record

Authorities

Who stands behind a signature.

A signature is only as good as the authorities behind it. Here there are four, and each one can be checked on its own: the person who signs, the authority that certifies them, the clock that is not ours, and the record that is open to all.

Figure 6 · The four authoritiesSignatory · Signing authority · Time · Record
01 The signatory key

A named person with a key of their own

The key arrives by email, eight digits, one party at a time. Entering it opens the document; signing it leaves that person's name, certificate and time in the seal.

Here: the key gate
02 The signing authority certificate

Wippli Sign certifies each signatory

For every ceremony the authority issues a short-lived certificate per signatory and seals the finished PDF. Its root and its policy are published for anyone to check against.

Here: root.pem and policy.json
03 The time DigiCert

A clock that is not ours

Every seal carries a timestamp from DigiCert, an independent timestamp authority. Without it the engine refuses to seal. The time of signing is theirs to vouch for, not ours.

Here: the timestamp in every seal
04 The record ledger

Open to anyone, for as long as it matters

The proof, the audit log and the public ledger entry are readable without an account. Drop the file on the verify page and it reports what it finds.

Here: api/proofs/prf_pOVicTgP_Cui
Published root · published policy · public ledgerRead a proof

Security

What stands between a document and anyone else.

01

Keys, not passwords

Eight digits, sent by email to one party at a time, used once. Wrong tries are limited per address and per document; after a run of them the document pauses and the organiser is told. No account, so nothing to phish.

Entry
02

Encrypted at rest, a key per document

Every document is stored under its own encryption key. That key opens only when a party enters theirs or a live signing session asks for it. Wippli's own service key cannot read your document. A recovery key, kept offline, covers a lost key.

Storage
03

A certificate that lives two hours

Each signatory is issued a certificate for that ceremony alone, valid for two hours and named after it. There is nothing long-lived to steal and nothing to reuse on another document.

Identity of the signature
04

Sealed, timestamped, tamper-evident

The finished PDF is sealed to the PAdES standard with a timestamp from DigiCert. Without a timestamp the engine refuses to seal. Any change after sealing is detected by ordinary PDF readers and by the verify page.

The seal
05

A document API that is not on the internet

Creating and reading documents happens on a private network only. From the internet, the only doors are the signing pages behind their keys, the proofs, the policy and the verifier.

Exposure
06

A record that names no one

The public proof carries hashes, times, the seal, the authority and the ledger entry, and counts the parties. It names none of them and holds no contents. The full proof goes to the parties alone.

Privacy of the record

Verify

Drop a document. Read the verdict.

Any PDF that Wippli Sign sealed, or any audit log it issued, can be checked here. The file is read once, its seal and its timestamp are examined, and its hash is looked up on the public ledger. Nothing is kept.

You will see whether the seal is intact, whether the signature is valid and trusted by the Wippli Sign root, the time the timestamp authority recorded, and the ceremony and proof the file belongs to.

No accountNothing storedSame check as sign.wippli.ai/verify

The public ledger: api/ledger

this is

Wippli Sign