In modern business environments, legal resilience depends not on the convenience of an EDM interface, but on the system's architectural ability to ensure data immutability and provide an evidentiary base for court proceedings. IT executives and legal counsel often view electronic document management (EDM) merely as an automation tool. They may overlook risks associated with the lack of a reliable audit trail and systemic integrity controls, leaving signed documents vulnerable to successful challenges.
According to the Law of Ukraine "On Electronic Documents and Electronic Document Management," the legal force of an electronic document cannot be denied solely due to its electronic form. However, the law requires the presence of all mandatory attributes, including a qualified electronic signature (QES). If it is proven during litigation that unauthorized changes were made to a document or its metadata after the signature was applied, the document loses its legal force. The mere presence of a signature file without proven integrity of the environment in which it was stored does not guarantee the protection of a company's interests.
Why a visual QES is not a guarantee of success in court: the concept of non-repudiation
Many organizations believe that if a document is signed with a QES, legal security is fully ensured. However, the mathematical correctness of a signature only proves that a private key encrypted a specific hash code of the file. It does not provide a definitive answer as to whether the certificate was valid at the moment of signing or whether the associated metadata in the EDM database was altered after that event.
The concept of non-repudiation requires an architecture where neither party can deny the fact of creating, sending, receiving, or signing a document. If an EDM system's architecture allows a database administrator to change registration dates or associated statuses without recording them in a secure log, such a system is unreliable from an audit perspective.
To create a reliable evidentiary base, the system must ensure:
- Fixing the exact time of signing using a timestamp from an accredited trust service provider.
- Long-term archival storage (LTV — Long-Term Validation), which allows for signature validity verification even after the certificate's expiration.
- An immutable link between the document body, its metadata, and the signature at the DBMS level.
Architectural requirements of ISO 15489-1: records management and audit trail organization
The international standard ISO 15489-1:2016 establishes universal principles for records management regardless of an organization's structure, form, or technological environment. Any system claiming to be a reliable document repository must guarantee authenticity, reliability, integrity, and usability.
A key tool for meeting these requirements is an audit trail. This is a modification-proof log that automatically records every action in the system:
- Who, when, and from which IP address created, viewed, modified, or signed a document.
- Which specific document card attributes were edited (with the preservation of previous values).
- Any attempts to change access rights.
Recording logs into standard text files on a server or an open database table does not meet security requirements. An administrator with direct access to the DBMS could edit such logs. A true audit trail must be integrated into the platform core and protected from modification, even by users with the highest privileges.
Validation of trust services: real-time certificate status verification
In legal disputes, a common scenario involves one party attempting to invalidate a contract by claiming the signature was applied with a revoked key. To prevent this, an EDM system must verify the signature certificate status via official trust service registries (e.g., the Central Certification Authority) at the exact moment of signing.
This is achieved through requests using OCSP (Online Certificate Status Protocol) or CRL (Certificate Revocation List) protocols. The received responses are imported into the document structure. Even if the trust service provider ceases to exist years later, the document retains its evidentiary force because all proofs of validity are fixed within the file itself at the time of signing.
Transitioning from legacy architecture to Security by Design
Many legacy systems were built with security added as an external layer. Modern information management standards (including Intelligent Information Management concepts promoted by AIIM) require the implementation of Security by Design and automated data processing.
This means that access control mechanisms (Row-Level Security — RLS and Access Control Lists — ACL) must operate at the data access level. If a user attempts to access the database directly, bypassing the interface, the platform must block the request based on security metadata. Furthermore, automating document classification using IDP (Intelligent Document Processing) technologies reduces the risk of human error when determining retention periods and access levels.
How Intecracy Group ensures legal force and EDM resilience
To build legally resilient enterprise solutions, the technological alliance Intecracy Group utilizes the low-code platform UnityBase. It is a joint development of the consortium's companies, where InBase acts as a key (though not the only) developer.
EDM systems such as Megapolis.DocNet (which holds a G2 security certificate) and Scriptum are built on UnityBase. The platform's architecture provides built-in core-level security, solving the challenge of legal non-repudiation:
- Domain metadata model: A unified domain model combines data, access rights, and system behavior. This makes unauthorized modification of the data structure, bypassing business rules, impossible.
- Immutable audit trail (DataHistory): A data history mechanism records all changes to document attributes directly within the platform core.
- Access control: Enterprise and Defence commercial editions support multi-level access control (RLS, ACL, and attribute-level security).
- QES validation in Defence Edition: Supports integration via CRL and OCSP protocols for real-time signature status verification and the formation of evidence for long-term storage.
Matrix for evaluating EDM architectural legal resilience
| Evaluation criterion | Weak level (Legacy approach) | Target level (Legally resilient architecture) |
|---|---|---|
| Audit trail | Logs are written to text files or a general database that an administrator can modify. | Immutable audit log at the system core level, recording actions of both administrators and users. |
| QES verification | Only mathematical signature validity is checked at the moment of opening the file. | Automatic certificate status verification via OCSP/CRL at the moment of signing with LTV formation. |
| Metadata management (ISO 15489) | Metadata is stored separately in an open format without versioning. | Metadata is linked to the document; changes create a new record version with author attribution. |
| Access control | Basic folder-level permissions, easily bypassed via direct database access. | Multi-level access control (ACL and RLS) at the platform level. |
Practical steps for IT and legal teams
To minimize the risks of electronic document challenges, the IT department, in collaboration with the legal department, should take the following steps:
- Conduct an audit of the logging system. Ensure that the EDM records not only document creation but also every instance of reading, changes to access rights, and login attempts.
- Implement timestamps. Any document signed with a QES must contain a certified timestamp.
- Configure long-term signature storage (LTV). This is critical for contracts with a validity period exceeding one year.
- Segregate access at the platform level. Use solutions that support RLS/ACL to eliminate the possibility of direct table modification via DBMS administration tools.
Building a system based on Security by Design principles and ISO 15489-1 requirements creates a reliable technological foundation that minimizes the risks of losing the legal force of your digital assets during forensic examinations or court disputes.
FAQ
How can one prove in court that an electronic document was not altered after signing?
The EDM system must provide an immutable audit trail at the platform core level, which records the absence of adjustments in the database. Additionally, the integrity of the file is mathematically confirmed by verifying the correspondence between the document's hash sum and the applied QES with a timestamp.
Which requirements of the ISO 15489-1 standard are critical for electronic document management systems?
The standard requires ensuring the authenticity, reliability, integrity, and usability of documents regardless of the technological environment. This is implemented through the strict linking of metadata to the document and the maintenance of a secure action log.
How does a standard electronic signature differ from the long-term LTV storage format?
A standard signature may require online verification of the certificate status, which is typically valid for 1-2 years. The LTV (Long-Term Validation) format stores proofs of certificate validity (OCSP responses and CRL revocation lists) directly within the file at the time of signing, which allows its legal force to be verified in the future.
Data sources
- Verkhovna Rada of Ukraine: Law of Ukraine On Electronic Documents and Electronic Document Management
- ISO 15489-1:2016 Records management
- AIIM — Intelligent Information Management
- Central Certification Authority of Ukraine: Qualified providers of electronic trust services
- ISO/TR 22957:2018 Enterprise content management systems