Acknowledgement is not a signature
Before the ladder, a line the wallet does not cross: acknowledging and signing are different acts, and the product never calls one by the other's name.
The acknowledgement is notice. It says "I saw it" — and nothing else. Whoever acknowledges a notice has agreed to nothing and bound themselves to nothing; they declared that the text passed before their eyes, and the time of that was recorded. It is what a manager does with a memo, what an employee does with a circular.
The signature is will. It says "I agree, and I bind myself". It is what one does in a contract, in a term sheet, in a receipt. And that is why a signature has metal — Bronze, Silver, Gold — and an acknowledgement does not: metal is the measure of how far the wallet made sure of who was declaring will. Notice does not need that measure; will does.
Why the wallet is so strict about this: calling an acknowledgement a signature would be fraud on our part. Someone who merely declared having read would show up in the vault as a signatory — and one day, in a dispute, a document with "3 signatures" would in fact have three people who only opened the file. The metal exists so that "signed" always means the same thing.
The four heights
The ladder has three metal steps — and a floor. The floor is the Acknowledgement, level zero: it does not enter the vault, and it is here because it is the ruler the metals are measured against. Each step asks something more of whoever signs — and therefore proves something more to whoever receives. No step costs anything; what changes is the rigor.
Acknowledgement
One tap. It declares that you read — and prints a strip with the time. It declares no will about the text, and for that reason it has no metal.
provesthat you saw it, and when
Bronze signature
One tap, signed in. It rests on the session of the devices connected to your account. It is the everyday signature: arrangements, simple authorisations, what today gets closed with an "ok" in chat.
provesthat a device on your account declared will
Silver signature
One tap plus a 6-digit code, sent to the account's verified channel. It proves, at the moment of signing, that the account is still yours — and not a forgotten device signed in somewhere.
provesthat whoever signed controls the account now
Gold signature
The code, plus legal identification: full name as it appears on the document, the document number, the address. It is the contract signature — the one that names a person, or a company and who represents it.
proveswho, in law, bound themselves
Notice what the ladder does not do: it does not ask for more than the text needs. An arrangement about a time slot does not deserve a national ID number; a service agreement cannot live on an "ok". The right rigor is what the relationship requires — and the product was designed so that asking too much feels as odd as asking too little.
The sender chooses the rigor
Rigor is neither a platform setting nor a preference of whoever signs. It is the sender's decision — and it travels under the hash of the document.
When sending an X-DOC for signature, the sender answers a single question: with what rigor does the other party sign? The wallet suggests a step by the kind of document — a notice suggests Acknowledgement, a contract suggests Gold — but the choice belongs to the sender. And once chosen, it goes into the seal: the rigor is part of what is sealed.
The consequence is the one that matters to the receiver: the request does not change along the way. If the document arrived asking for Gold, the frame's button says "Read and sign" and the ceremony demands identification — there is no way for the other party to "sign with one tap" and hand back something that looks like what was asked. And there is no way for the sender to claim later that they asked for more than they did: it is in the hash.
Why the identification lives on the device of whoever identifies themselves, and not of whoever asks: the sender says how much they want to know; the signer owns what will be said. If the contracting party could fill in the other party's identity, it would not be identity — it would be an allegation. The ladder separates the two on purpose: the rigor belongs to the sender, the data belongs to the signer.
The vault — where who you are lives
On the wallet's home there is a line called My signatures. It is the vault: the page where the three heights with metal show what each one is worth to you — and where Gold keeps the identities you sign with.
The screen has three shelves, one per metal. The Bronze one lists the connected devices on your account — because it is their session that Bronze proves; an old device you do not recognise is the first sign that this height has stopped being yours alone. The Silver one shows the verified channel the code goes to, with the address masked. And the Gold one is a book: the stored identities, each with the country flag, the name as it appears on the document and the document number masked.
The book is like that on purpose. A person does not have one legal identity — they have several. Someone with dual nationality signs as two natural persons, one per country. Someone with a company signs as a legal entity, with the representative named. Someone who represents more than one company has one form per company number. The vault accepts as many identities as you have, and the signing ceremony asks which one — like an address book at checkout, where you choose where the delivery goes.
And the rule that makes the vault deserve the name: it stays on this device only. The identification leaves there in exactly two situations — when you send a contract as the contracting party, or when you provide a Gold signature — and in both the screen warns first. Beyond that, nobody reads your vault. Not the federation. Not X-ID.
The Gold form
The Gold identity is a form that begins with the country — because it is the country that decides the rest: which document, with which mask, which words the law there uses.
Thirty countries with search and flag. Once the country is chosen, the form speaks its legal language: "CPF" here, "DNI" there, "SSN" elsewhere — and the document mask follows. A country with no known rule is left free: a wrong mask would block a real document.
Not the nickname, not the display name on the network — the name the identity document carries. That is the one that goes into the record, and it is by that name that a third party checks who bound themselves.
In Brazil, the CPF and CNPJ carry a check digit, and the vault verifies it: an invalid number does not go in. In other countries, the mask guides and the person answers. What is stored is what you typed; what travels at the act is masked.
Street, number, unit, city — with "no number" written the way each country writes it. In the United States, city and state; in Brazil, the postcode fills in the rest. The address is what makes a contract enforceable: it is where notice is served.
The date of birth goes in for two reasons, and neither is curiosity: it proves capacity (under 18 is warned, not blocked — there are acts a minor may perform) and it undoes the namesake problem. Two John Smiths with the same date are rare; with different ID numbers, impossible.
The vault does not ask for gender: it qualifies nobody in law, and data protection law says to collect only what is necessary. Marital status is optional, and only for natural persons — most contracts do not use it. Fewer fields means less of your data going around.
For a legal entity, the form changes shape: registered name, company number, registered address — and the representative, with their role. The record comes out as a notary would write it: "Such-and-such Company, by its manager So-and-so, signed…". And the brand never uses the person's face: the legal entity's vault belongs to the legal entity.
What a signature prints
Every signature prints a strip: the record of the act, in the third person and in the past tense, the way a clerk notes down what took place before him.
on 4 September 2026, at 10:31
At 9:14 on 4 September 2026, Pedro Yamada sent for signature the document "Service agreement — Video Editor", saying: "Here it is for signature. Deadline is Friday.". One hour and seventeen minutes later, at 10:31, Marina Sá signed the contract at Gold rigor.
record seal #7f3a…c91e · Safari · iOS · dispatched
The third person is not style, it is jurisdiction. "You signed" is the application talking to you; "Marina Sá signed at 10:31" is a record that serves any reader — including a third party who was not there and has to decide who is right. The first sentence is interface. The second is proof.
And the proof has three layers, each covering the previous one's weakness. The hash of the document guarantees that the signed text is exactly that one — change a comma and the seal does not check out. The device key endorses the signature: a cryptographic pair only that device has, tied to your .id, turns "Marina signed" into a fact a third party verifies without trusting anyone. And the strip is permanent: it is neither erased nor rewritten; a new act is recorded on top, with a new time — never in place of the previous one.
Why the strip does not vanish when you remove the document from the vault: removing is local cleanup — it takes the text off your device, and that is all. The act of having signed is a past fact, and its strip stays where it was, in the conversation and on the other party's tape. A record that vanished whenever one of the parties wished would be no record.
Once only
The same document is signed once. If you have the wallet on two devices and open the frame on both, only one signs — and the second one finds out.
It is the reverse of the market standard, where the last tap wins and the earlier work disappears without warning. Here the first decision is the decision: the second device receives a refusal that says which device acted, at what time and with what text. You find out what has already been said in your name — instead of finding out that you lost.
And the signature is only recorded when it leaves the device — not at the tap. Between the tap and the send there is the undo window, in which nothing has been said to anyone; recording at the tap would stamp a decision that was still yours and reversible. If the send fails, the frame goes back into the queue and the light blinks — the opposite of vanishing from the screen and leaving you thinking you signed.
What it does not do
A product that deals with signatures has to be exact about what a signature does not do — because whoever trusts what does not exist runs a real risk. Three limits, stated plainly.
- It does not prove the text is true. A signature proves that person declared will over that exact text, at that time. If the text lies, the signature proves that someone signed a lie — which, incidentally, is exactly what a judge needs to know.
- It does not replace the certificate the law requires where the law requires it. Every country has its own legal ladder. In Brazil — and the examples here are from Brazilian law — Law 14.063/2020 distinguishes simple, advanced and qualified electronic signatures; the qualified one requires a certificate issued under the ICP-Brasil standard, and there are acts that accept only it. The wallet's ladder was designed to speak to that distinction: Bronze and Silver operate in the territory of the simple; Gold, with identification and device key, in that of the advanced. The qualified step is the one still missing — and the last section is about it.
- It does not validate identity against a third party. Gold stores what you declared, with the arithmetic that can be checked (check digit, mask). It does not query the tax authority, does not match a photo against a document, does not ask for a selfie. It is honest about that: what it proves is that whoever controls this account and this device declared this identity, under this hash. For most contracts between people who already know each other, that is more than any "ok" in a chat ever gave.
Why the vault is yours
Here the conversation stops being about buttons and starts being about who is in charge of your data.
Think about how a traditional signature service works. You create an account, fill in your name and your ID number, and from then on every contract you sign sits on their server, next to your identity, indexed, searchable — by them. The proof that you signed depends on the service existing, on the server answering, on the company not having been sold, hacked or shut down. And every envelope has a price.
In the wallet, the logic is reversed. Your identity is on your device; the platform never sees it — the server knows the hash and the key, never the ID number. The signed contract sits in your conversation and in the other side's, each with their own copy, each verifiable on its own. The proof does not die with the company: even if the entire federation vanished tomorrow, the strip you hold, with the hash and the key, would go on proving what it proved. And no step charges anything per envelope.
This has a name, and it is worth saying without ceremony: SOVEREIGNTY. Not as a slogan — as architecture. Whoever signs a contract ought to own the proof that they signed. For twenty years that was impossible on the internet, because the proof had to live in a trusted intermediary. The chain, the hash and the device key made the intermediary unnecessary — and the wallet was built to take advantage of that, not to pretend it is still needed.
What changes for a company: the legal entity's vault works the same way — on the device of whoever represents the company, with the representative named in the record. A small firm that today pays per envelope, prints, signs and scans starts closing contracts inside the conversation where it negotiated, with better proof than it had — and without handing its client base to a third party along the way.
The step that does not exist yet
The ladder has three metals today. The product's vocabulary already has room for a fourth — and it appears in grey, the way the wallet shows everything still to be earned.
Diamond signature
Gold proves who you say you are. Diamond will prove who you are — identity verified by an accredited third party, with a certificate issued under the standard each country's law recognises as qualified. It is the step that today requires going to a certification authority, paying, waiting; and that is where the project is heading: as the federation evolves, X-ID tends to become a digital certification authority itself — and the vault you already have starts holding that certificate too.
No date, no promise of a deadline. What is recorded here is the direction: the ladder was designed with the fourth step in mind, and every Gold signature you store today is the base it will be placed on. When the medal gains colour, you will know — from the tape, like everything else.
What you take from this chapter
Three sentences, and they are enough.
- One floor and three metals, one right rigor for each text. Acknowledgement is notice, level zero; Bronze, Silver and Gold are will, in rising degrees of certainty about who declared it. The sender chooses, and the choice travels under the hash.
- The vault is yours — literally. Name, document number and address live on your device, leave only when you say so and are never read by the platform. As many identities as you have, natural person or legal entity.
- The proof does not depend on anyone continuing to exist. Hash, device key and a permanent strip: every signature verifies on its own, on your device, forever — and costs nothing per envelope.