01
A verifiable part of the case file.
Define the relevant document type and acceptable evidence. The responsible team compares the file and record and retains the finding with the case. Substantive decisions, technical verification and operations each have designated owners.
02
Specify on-premises or EU hosting in concrete terms.
A sovereign operating model identifies the location, operator, administrative access and control of keys. Align these requirements with retention, recovery and update procedures. Selecting a suitable deployment model involves examining individual data flows and system boundaries.
- Define your own approved issuers and keys.
- Separate operational and verification roles.
- Keep versions, verification scope and status information traceable.
03
Verify offline. Handle freshness separately.
The included verification data supports local checks of the signature, event chain and file binding. An air-gapped process also needs controlled transfer of software and trust anchors, and a way to update them. The age of that information belongs in the finding; offline verification does not provide a live revocation check.
04
Match requirements to protection needs.
A Creation Record provides technical evidence for the defined check. Legal classification, procurement requirements and necessary certifications are assessed separately for the specific process. A valid ExtraProof signature is not a qualified electronic signature or qualified electronic timestamp.
