A qualified validation service for electronic signatures and seals is governed by eIDAS Articles 32, 33 and 40. Implementing Regulation (EU) 2025/1942 refers to ETSI TS 119 441 for the service and ETSI TS 119 172-4 for the validation policy, which in turn build on the validation algorithm in ETSI EN 319 102-1 and the report format in ETSI TS 119 102-2. The organisational requirements are in ETSI EN 319 401.
How the service is run is described in detail in our practice statement.
| Requirement | Standard | Status |
|---|---|---|
| Validation algorithm | EN 319 102-1 | In place. The European Commission’s reference implementation DSS 6.4, with basic, with-time and long-term validation. |
| Validation policy | TS 119 172-4, clause 4.2 | In place. Tindom validation policy 1.0, published as XML. |
| Determining whether a signature or seal is qualified | TS 119 615 | In place. Only EU Member State trusted lists count. |
| Signature formats | EN 319 142-1, 319 132-1, 319 122-1, TS 119 182-1, EN 319 162-1 | In place. PAdES, XAdES, CAdES, JAdES, ASiC-S and ASiC-E, including detached signatures. |
| Hash computed by the service | TS 119 441 VPR-8.1-10, VPR-B-11 | In place. Always on the server, from the full document. |
| Validation report in the standard format | TS 119 102-2 | In place. Downloadable on the web and attached in the email pilot. |
| Qualified time-stamps reported | TS 119 441 SVR-8.4-13, SVR-B-08 | In place. |
| Secured channel | TS 119 441 SVP-8.3.1-01 | In place. HTTPS/TLS. |
| Published practice statement | TS 119 441 OVR-6.1 | In place. Practice statement. |
| Validator identity in the report | TS 119 441 SVR-8.4-08, -09, SVR-B-09 | Not in place. Requires a qualified electronic seal, which we are working to acquire. |
| Report signed or sealed by the service | TS 119 441 SVR-8.4-16, SVR-B-05 | Not in place. Requires the same seal. |
| Machine interface | TS 119 442 | Not in place. Planned. |
| Own identifier (OID) for the policies | TS 119 441 OVR-9-10 | Not in place. |
ETSI EN 319 401 requires, among other things, trusted roles with separation of duties, an information security management system, a risk assessment, business continuity and termination plans, liability cover and an audit by an accredited body. Becoming a qualified service also requires review by PTS and listing on the Swedish trusted list. None of this is in place. Tindom is currently run by one person.
Questions about the service or this page: contact@tindom.se.