QSeal

eIDAS recognises three levels of electronic seal. A plain electronic seal is any data attached to other data to assure its origin and integrity. An advanced electronic seal has to be uniquely linked to the organisation that created it, identify that organisation, be created with seal creation data the organisation keeps under its own control, and be linked to the sealed data so that any later change is detectable. A qualified electronic seal is an advanced seal that adds two things: it is created with a qualified electronic seal creation device, and it is based on a qualified certificate for electronic seal, written QSealC in the ETSI profiles.

Only the qualified level earns the legal presumption. Article 35 of eIDAS gives a qualified electronic seal the presumption of integrity of the data and of correctness of the origin of that data, which in practice reverses the burden of proof: the party disputing a sealed document has to show that it was altered, instead of the organisation having to show that it was not. A seal that falls short of qualified is still admissible evidence, but a court weighs it rather than being obliged to start from that presumption.

The certificate behind the seal comes from a QTSP, a trust service provider that a member state supervisory body has granted qualified status and published on its national Trusted List. Because the certificate identifies a legal person rather than a human, it carries an organisation identifier, such as a VAT or LEI based reference, instead of a personal name, and the requirements it has to meet are set out in Annex III of eIDAS. The creation device is certified separately, under the same regime as the device behind a qualified signature. The same certificate turns up under its ETSI name QSealC outside the document world as well: in open banking a payment service provider seals its API messages with a QSealC and secures the channel with a QWAC.

The practical difference from a QES is who stands behind it. A signature expresses the intent of a named natural person, so it is the right instrument when someone personally agrees to something. A seal expresses the origin and integrity of data issued by an organisation, so it is the right instrument for invoices, statements, registry extracts and anything else issued in bulk, where nobody is being asked to agree to anything. Sealed files use the same PAdES, XAdES, CAdES and ASiC container formats as signed ones, so a single verification stack handles both.

For digital credentials this matters because an issuer is normally a legal person. Sealing issued data with a qualified certificate for electronic seal is how the eIDAS presumption attaches to the content itself, on top of whatever signature the credential format already carries. A QEAA itself has to carry the qualified signature or seal of the QTSP that issues it, so a QSeal and a QEAA work together rather than as alternatives: the attestation makes a statement about a subject, while the seal establishes which organisation issued it and that nobody changed it afterwards.