What makes an electronic signature valid in Québec

For a private business document, an electronic signature is valid in Québec when it meets the definition in article 2827 of the Civil Code of Québec — a person affixing their name, or a mark that is personal to them and that they habitually use, to express consent. The first paragraph of section 39 of the Act to establish a legal framework for information technology (CQLR, c. C-1.1) adds that the signature may be affixed by any means that satisfies the requirements of that article 2827, whatever the medium of the document.

Enforceability is a separate question from validity. The second paragraph of section 39 of the Act to establish a legal framework for information technology provides that a signature affixed to a technology-based document is enforceable against the person who affixed it when the integrity of the document is assured and when, at the time of signing and since, the link between the signature and the document has been maintained. No format is therefore imposed and no vendor is accredited for such documents: what must be demonstrated bears on integrity and on the maintained link, not on the process used.

Québec law does not treat paper as the reference and electronic records as the exception. The first paragraph of section 5 of the Act to establish a legal framework for information technology, in force since 2001, provides that the legal value of a document, including the fact that it may produce legal effects and be admitted in evidence, is neither increased nor diminished solely because a specific medium or technology was chosen. The second paragraph states an equivalence rather than a replacement: a document whose integrity is assured has the same legal value whether it is on paper or on another medium, provided that, if it is a technology-based document, it otherwise complies with the same rules of law. Replacement proper — destroying the source document and substituting the one produced by the change of medium — falls under a different mechanism, the transfer governed by section 17, which requires the operation to be documented.

Integrity is not a vague notion; it carries a statutory definition. Under section 6 of the same act, the integrity of a document is assured when it is possible to verify that the information has not been altered and has been maintained in its entirety, and that the medium carrying it provides the required stability and permanence. That integrity must be maintained throughout the entire life cycle of the document: from creation, through transfer, consultation and transmission, to retention, including archiving or destruction. Security measures taken to protect the document are weighed in that assessment. A signature applied to a file that remains editable afterward, with no cryptographic fingerprint and no frozen copy, leaves that verification with nothing to examine.

Section 7 of the Act to establish a legal framework for information technology removes any need to prove that the medium of the document, or the processes, systems or technologies used to communicate by means of a document, are capable of assuring its integrity, unless the party contesting admission of the document establishes, on the balance of probabilities, that integrity has been compromised. The exact scope of that exemption is disputed, and this is what vendor comparisons leave out. In Benisty c. Kloda, 2018 QCCA 608, the Court of Appeal held that what is presumed is only that the medium or technology used is capable of assuring integrity — it speaks of a presumption of technological reliability — and that the integrity of the document itself is not presumed, since alteration may come from a source other than a technical failure. Scholarly opinion remains divided: some read a presumption of the document's integrity, others a mere exemption of proof bearing on the technological environment. On either reading, the demonstration will be made with whatever was preserved at signing time.

Each element invoked around an electronic signature traces back to a text, or to none. Consent and the act of affixing a personal mark come from article 2827 of the Civil Code of Québec. The integrity of the document and the maintained link between signature and document come from the second paragraph of section 39 of the Act to establish a legal framework for information technology. The traceability tying that act to a person is required by neither text: it is a practice of evidence, useful because the demonstration will be made with whatever was preserved, not a legal condition. Its limit is one of kind rather than degree: a signing link sent by email authenticates an inbox, not a person. The same distinction between what a tool produces and what it demonstrates runs through automating business documents.

The vocabulary of the qualified electronic signature comes from Europe and has no Québec equivalent. European Regulation 910/2014, known as eIDAS, defines three tiers: the electronic signature, the advanced signature described in its article 26, and the qualified signature, which under its article 3 rests on a qualified electronic signature creation device and a qualified certificate. Québec law sets out no such hierarchy; it states a functional definition and leaves the assessment to the court. A separate regime does exist for the technology-based notarial act: the Chambre des notaires du Québec states that a notarial act is signed in the physical presence of the notary, who may allow a party or a witness to sign remotely where circumstances require it. A business signature never becomes a notarial act, whatever the tool.

In OffrePro, the electronic signature engine serves signature requests on letters, and the guarantees that follow apply to that path. It requires an explicit consent checkbox before a signature is accepted, accepts the received mark only if it is a PNG image encoded as a data URL of at most 200,000 bytes, and records for each signatory the timestamp of the signing act — consent is stamped in the same write, hence at the same instant — the IP address and the browser user agent. When the request is created, the SHA-256 fingerprint of the PDF is computed and the file itself is frozen as an attachment, so the version submitted for signing remains comparable to any version produced later. Accepting a proposal follows a distinct path: the mark is validated by the same rules there, but no fingerprint is computed and no certificate is produced. The public signing endpoints are throttled to 60 views per IP per minute and 20 writes per IP per hour.

The completion certificate is a document separate from the signed PDF, and that distinction deserves to be stated rather than glossed over. For signature requests on letters, it carries the SHA-256 fingerprint of the source document and, for each signatory, their name, email, role, the signing timestamp, the IP address and the signature mark; the user agent is recorded but not reproduced on the certificate. It is not merged into the PDF, which therefore does not carry its own evidence: the usable record is the pair formed by the frozen PDF and the certificate. Three limits go with it, acknowledged and documented: identity rests on a secret link rather than on identity verification, signing tokens do not expire, and only parallel signing is implemented — sequential signer ordering does not exist.

What an electronic signature vendor has to be able to show comes down to four mechanisms, all of them checkable. Is a cryptographic fingerprint of the document computed, and at exactly what moment? Is a frozen copy of the submitted file retained? What tracing data is recorded for each signatory, and for how long? How is the signer's identity established, and what precisely does the vendor claim about it? A vendor answering 'legally binding' without detailing those mechanisms is describing a sales argument, not an evidentiary record. The same verification reflex applies to the content of the documents themselves, as the anatomy of a business proposal that wins shows. This article describes legislative provisions; it is not legal advice.