Tractis launches a new signature method: Advanced Clickwrap

Starting today, you can use a new signature method in Tractis: Advanced Clickwrap.

What is Advanced Clickwrap?

A signature using Advanced Clickwrap involves sending an SMS PIN to the signer, which PIN has to be entered prior to the signing.

What is the difference between Basic and Advanced Clickwrap?

In general, in a clickwrap signature the signer has to express consent by clicking an “OK” or “Agree” button.

More specifically, in Tractis we differentiate between two types of clickwrap (Basic & Advanced), each with its own signature process and characteristics (Assurance Level, price, etc):

• Signature using Basic Clickwrap: the user just has to log in Tractis, go to the contract, select “Basic Clickwrap” as signature method and click the “OK” button.
• Signature using Advanced Clickwrap: the user logs in, goes to the contract, selects “Advanced Clickwrap” as the signature method, and then he receives an SMS PIN that he shall have to enter before clicking the “OK” button.

Legal validity & Assurance level

The parties to an agreement are free to decide how they express their mutual consent and therefore all signatures methods -handshake included- have “legal validity”.

What matters, however, is not the “legal validity”, but the “Assurance Level” provided by the evidence generated by the signature method. A notarized contract offers a greater “assurance level” than an agreement just signed by the individuals involved. Both have legal validity, but do not offer the same Assurance Level.

Overall, our recommendation is that you should distrust of any provider of electronic signature emphasizing the “legal validity” of their solution, as by this is they are probably trying to distract users from the low “Assurance Level” of the method.

• In Basic Clickwrap, the only link to the identity of the signer is the email used to login. Sometimes, this email provides information about the identity of the user (e.g.: tim.cook @ apple.com) and sometimes it does not (e.g.: snake69@hotmail.com). For this reason, we assign to Basic Clickwrap a Tractis Score of “1 – Minimum assurance level”.
• In Advanced Clickwrap, we link to the signer’s identity, not just the email used to log into Tractis but also to their mobile number. For this reason, we assign to Advanced Clickwrap a Tractis score of “2 – Low assurance level.”

Advantages of Advanced Clickwrap

• Usability: The main advantage of Advanced Clickwrap is its high usability. Unlike with electronic signature certificates, you do not need to obtain a certificate beforehand, remember its password and have a properly configured computer. To make a signature with Advanced Clickwrap a mobile phone suffices, something that virtually everyone has and knows how to use.
• Universality: This follows from the former point; since almost everyone has a mobile phone, Advanced Clickwrap allows anyone to sign electronically with any other person on planet earth. Tractis supports more than 990 mobile networks, allowing you to use Advanced Clickwrap in more than 220 countries, 80% of the world population. Just for comparison, in signatures using Electronic Certificate, we support certificates from 14 countries.

If you value usability and universality above any other factor (Assurance Level, lock-in, etc.), Advanced Clickwrap can be a good choice as signature method for your contracts.

Disadvantages of Advanced Clickwrap

• Assurance Level: In any electronic signature attention must be paid to how to ensure the 3 phases of the process: (1) the verification of identity and expression of consent by the signer, (2) the time instant when the transaction is made, and (3) the preservation of the integrity of the electronic evidence generated. Although Advanced Clickwrap offers a high Assurance Level in phases 2 and 3 (we ensure the time instant using Tractis TSA and the preservation using Tractis LTA, the most powerful technology options available today), it offers a low Assurance Level for phase 1 (we only have the email and mobile phone of the signer).
• Legal uncertainty: As you go down and start using signature methods with lower Assurance Level but greater usability, legal certainty depends less on the technology used and becomes a matter of opinion. Some vendors claim that their clickwrap solution is considered not just a basic electronic signature, but reaches the level of an advanced electronic signature. Without getting into that discussion, in these cases it is advisable to get (and take into account the additional cost of) an opinion on the legal robustness of the solution from an expert, both neutral and independent to the solution vendor.
• Lock-in: Unlike electronic certificates, there is no agreed standard for Advanced Clickwrap representation. Moreover, the strength of identity verification and the expression of consent do not depend on the technology (public and private key), but on the quality of the supplier processes for sending and receiving PINs and clickwraps. In other words, although the data from your clickwraps may be exportable, if you change providers, your data will be worth little if a dispute between the parties or a subsequent expert process arises and you do not have the cooperation of your former provider. Lock-in gets aggravated when hardware-based preservation (e.g.: WORM devices) is used instead of software-based preservation (e.g.: Tractis LTA), then you end up creating lock-in not only in phase 1, but also in phase 3. Lock-in, often an underestimated factor, has an important impact on operational flexibility, supplier selection and future prices.
• Ex-post and non autonomous verification of identity: Unlike electronic certificates, where the user’s identity is verified before signing, in Advanced Clickwrap no identity verification is performed ex-ante. The fact that the number of the user mobile phone is saved does not mean that their identity is verified. Only later and if necessary (e.g.: a dispute arises), is the identity of the owner of the mobile phone number checked. Moreover, this later checking is not “autonomous”, in the sense that the signature solution provider (e.g.: Tractis) can perform it on its own, but has to be done through the telecommunications operator that provided the SIM card to the user (e.g.: Vodafone) and, therefore, their cooperation is needed. Giving up on prior, autonomous and reliable identity verification has business and legal implications that should be carefully evaluated.

If you value the Assurance Level (e.g.: your business is in a highly regulated industry), legal certainty, want zero lock-in or want to verify the identity of your customers in a reliable, prior and independent way, no matter how much you like its usability and universality, Advanced Clickwrap may not be a good choice as a signature method for your contracts.

Setup & Integration

As with other signature methods, Tractis lets you configure the signature methods allowed, both at the account level (the setup applies to all contracts in the account) and at the contract level (the setup affects that contract only).

If you want to incorporate Advanced Clickwrap in your application or service, see the Tractis Contracts API, in particular, the API call named “Create contract”, where you will find all the necessary information (call description, examples, error codes, hints, etc.. ) to complete the integration in one morning.

As you will see, you have quite powerful setup options, such as creating signature gateways for unregistered users (completing the registration process automatically after the signature) or for protecting the contract with the SMS PIN itself (not only the contract cannot be signed without the PIN but you cannot even view its content). For any questions or suggestions to improve the API, write to us.

Price

“Basic Clickwrap”, until now simply known as “Clickwrap” at Tractis, will remain free for users with an active monthly subscription plan.

The rates for “Advanced Clickwrap” depend on the type of contract chosen. It is € 1,15 in prepay mode, € 1.15 to € 0.805 for monthly subscription plans and even lower prices for credit packs. Visit our website to know the different rates and the number of transactions included in each option. For reference, the rates of firms using Advanced Clickwrap include the clickwrap cost and the cost of an SMS.

Final words

With today’s announcement, Tractis offers the following signature methods:

• Signature using Basic Clickwrap (Tractis Score 1).
• Signature using Advanced Clickwrap (Tractis Score 2).
• Signature using Electronic Certificates (Tractis Score 2-4).

Our mission is to provide secure electronic commerce, to make possible that any person can verify the identity or sign contracts with any other person, 100% online, regardless of their country, jurisdiction, language, authentication/signature method chosen or the Certification Authority that issued their certificate. Today we take another little step in that direction.

By David Blanco
Saved in: Announcements, Tractis Signatures | No comments » | 9 July 2014