Chegatta Trust Service — Tamper-Evident Digital Contract Signing

Chegatta Trust Service: Tamper-Evident Digital Contract Signing

Employment contracts that sign themselves — verified by SMS one-time codes and biometrics, anchored with SHA-256 hashes, and backed by a hash-chained audit trail you can verify at any time. Built into the Chegatta attendance & HR platform, no third-party signing tool required.

See the full Digital Signature feature page

1. What Is the Chegatta Trust Service?
2. The 3-Step Signing Flow
3. Tamper-Evident Documents
4. The Hash-Chained Audit Trail
5. Evidence Pages & Signing Certificates
6. Built-In Anti-Fraud Hardening
7. Privacy & GDPR
8. Frequently Asked Questions

What Is the Chegatta Trust Service?

The Chegatta Trust Service is the digital signature engine inside Chegatta. When you hire someone through the hiring pipeline, their employment contract doesn't get emailed back and forth or printed for a wet signature — the employee opens the contract on their own phone, proves who they are, and signs it. Everything that happens along the way is recorded as evidence.

It answers the three questions every labour dispute turns on:

• Who signed? — identity proven by a registered device, a verified mobile number (SMS one-time code) and an on-device biometric check.
• What exactly did they sign? — the document is hashed (SHA-256) when it's uploaded, and that hash is re-verified the instant it's signed. If even one byte changed in between, signing is refused.
• Can anyone tamper with the record afterwards? — no. Signed documents are immutable, and every event is linked into a hash chain where each entry seals the previous one.

Because it lives inside the platform you already use for clock-ins, leave and payroll, there's no separate tool to buy, no separate login for employees, and no copy-pasting of signed PDFs into folders.

The 3-Step Signing Flow

When a contract is ready, the employee gets it directly in the Chegatta mobile app. If a valid mobile number is on file, signing runs as a three-step wizard:

1. Confirm the phone. The app shows the number on file, masked (e.g. +351 ••• 678 ). The employee confirms it's theirs or corrects it — the correction is saved for future signings.
2. Enter the 6-digit code. Chegatta sends a one-time verification code by SMS. The code expires and can only be used once. This proves the employee is in possession of the registered phone number.
3. Sign with biometrics. Face ID / Touch ID / fingerprint confirms the person holding the phone is the employee, and they sign by typing their full name. This proves intent .

Possession proof + intent proof, tied to the exact document hash — that combination is what gives the signature its evidential weight. If an employee has no valid phone number on file, the biometric-only flow still works, so nobody is blocked from signing.

Tamper-Evident Documents

Every contract document is anchored to a SHA-256 hash the moment it enters the system. From that point on, the math protects the document, not just permissions:

• Hash on upload. The original PDF's SHA-256 fingerprint is computed and stored when the contract is created.
• Re-verified at signing. At the instant of signing — inside a database lock — the stored PDF is re-hashed and compared against the recorded hash. Any modification, however small, causes signing to be refused with an error instead of producing a signature over changed content.
• Immutable once signed. A signed contract's document cannot be replaced and the contract cannot be deleted. Corrections happen as a new contract version, preserving the original evidence forever.
• A sealed final bundle. At signing, the platform generates the final PDF — the original contract pages plus evidence and signature pages — and stores it with its own final SHA-256 hash and the hash of its evidence manifest. What the employee signed is exactly what you can download today and years from now.

The Hash-Chained Audit Trail

Every meaningful event around a contract is written to an audit trail where each record contains the cryptographic hash of the previous one — like a blockchain, but private. Tamper with any historical record and every hash that follows it breaks visibly.

Recorded events include:

• contract.presented — the employee opened the contract (recorded once)
• otp.requested — a verification code was sent (resends included)
• otp.verified — the employee entered the correct code
• otp.failed — a wrong code was entered, with the reason
• contract.bundle_created — the signed PDF bundle was sealed
• contract.signed — the signature itself

And you don't have to take our word for it: admins can open a chronological audit viewer directly on each contract, export the trail as CSV for a labour inspector or lawyer, and run a built-in integrity check that re-hashes every stored document, every bundle, every manifest and the entire chain — flagging anything that doesn't match. Trust, but verify.

Evidence Pages & Signing Certificates

The signed PDF bundle isn't just the contract with a name typed at the bottom. It carries its own evidence pages, generated from the platform's evidence manifest:

• The SHA-256 hash of the original document that was presented to the employee
• The verification method used — SMS one-time code, biometric, or both
• The exact date and time the OTP was verified
• The employee's phone number, masked for privacy (e.g. +351 ••• 888 )

When several documents are signed within the same verification session — for example a contract and its confidentiality annex — they share one signing session ID, and Chegatta issues a signing certificate listing every document covered by that single authentication. One strong proof of identity, many signed documents.

Built-In Anti-Fraud Hardening

A verification code is only as strong as the system around it. The Trust Service ships with the guardrails that would take you months to build yourself:

• Attempt limits: 3 wrong code attempts trigger a 5-minute lockout; codes expire after 48 hours.
• Send limits: 3 code challenges per hour, with a 60-second cooldown between sends — no SMS-bombing.
• Single-use tokens: the OTP produces a one-time nonce that gates the actual signing call; it cannot be replayed.
• Auto-cancellation: requesting a new code automatically cancels all older pending ones — only the newest code can ever work.
• Brute-force flagging: repeated failures are flagged for review.
• Idempotent signing: a double-tap or retried request can never create two signatures — the platform detects the duplicate and returns the existing signed state.
• Race-proof signing: the signing operation runs inside a database transaction with a row lock, so two simultaneous attempts cannot both succeed.

Privacy & GDPR

The Trust Service was designed for the EU market from day one:

• One-time codes are never stored in plaintext — only their hash, so a database leak can't reveal live codes.
• Phone numbers are masked in logs (e.g. +351 ••• 888 ), both for successful sends and provider failures.
• Evidence renders the masked number, not the full one.
• Device tracking, which the rest of the platform uses, already requires explicit employee consent and follows defined retention periods — the signing evidence follows the same privacy discipline.

This page describes technical capabilities and is not legal advice. Electronic signature requirements can vary by jurisdiction — the evidence produced here (verified identity, document hash anchoring, tamper-evident audit trail) is designed to support advanced-electronic-signature style requirements under EU eIDAS, but consult your counsel for your specific use case.

Frequently asked questions

Electronic signatures are legally recognised in the EU (eIDAS), the US (ESIGN/UETA) and most other jurisdictions. Chegatta produces the kind of evidence — verified identity, SMS possession proof, biometric intent proof, hash-anchored documents and a tamper-evident audit trail — that gives a signature its weight in a dispute. Whether a specific signature meets your specific legal requirement depends on your jurisdiction and contract type, so check with your counsel.

No. The Trust Service produces strong advanced-signature-style evidence (identity verification + document integrity + audit trail). A qualified electronic signature requires a certificate from a qualified trust service provider. For most employment contracts, an advanced signature with solid evidence is sufficient — but if your use case requires QES, you'll need a qualified provider on top.

The signing flow automatically falls back to biometric-only signing (registered device + Face ID / fingerprint + typed name), so nobody is blocked. As soon as a valid number is added, new signings automatically include SMS verification.

No. Signed documents are immutable — they cannot be replaced or deleted, only versioned as a new contract. And because every stored PDF is hash-anchored and re-verifiable with a single command, any tampering with storage itself would be detected.

Three ways: the audit viewer on each contract shows the full hash chain with an integrity badge; you can export the trail as CSV; and a built-in integrity check re-hashes every stored document, bundle, manifest and the entire event chain on demand — any mismatch is flagged.

No. Signing happens inside the Chegatta mobile app the employee already uses to clock in — same login, no new tool, no extra cost per signature.