Legally sound signatures, with rigorous architectural boundaries
Jno Trust keeps contracts of record on infrastructure you operate. Key custody, AI execution, and compliance policies are strictly governed — choose Azure Key Vault in Canada, an on-prem HSM, local models, or your own private cloud endpoint.
Canadian & international e-signature law, in plain terms
Electronic signature
Ontario Electronic Commerce Act, 2000
When: Most commercial documents — contracts, NDAs, HR agreements, procurement approvals.
How: Click-to-sign or cryptographic signature with authenticated signer consent and full audit trail.
Cryptographic / advanced signature
PKI-based, keys in Key Vault / HSM
When: High-value contracts requiring verifiable tamper-evidence and strong non-repudiation.
How: PAdES signature with X.509 certificate, long-term validation (LTV) and RFC 3161 timestamp.
Secure Electronic Signature (SES)
PIPEDA Part 2 + Secure Electronic Signature Regulations
When: Regulated federal filings requiring a recognized Certification Authority.
How: Certificate issued by a CA recognized by the Treasury Board of Canada (e.g. via Entrust or GlobalSign).
In Canada there is no single signature regulator. Most commercial transactions are governed by provincial law (in Ontario, the Electronic Commerce Act, 2000), while a narrow set of federal filings require a Secure Electronic Signature defined by PIPEDA and its regulations, where the Treasury Board of Canada recognizes the certificate authorities.
What runs where
We do not claim every component lives in your server room. The platform is honest about boundaries: documents and workflows on your stack; keys in your vault or your HSM; AI optional, tiered, and governed by an immutable action ledger.
Hybrid (common)
- Documents
- On your servers (Docker / Alfresco)
- Signing keys
- Your Azure Key Vault — Canadian region
- AI
- Local Ollama, or private Azure OpenAI in your tenant
Full sovereignty
- Documents
- On your servers
- Signing keys
- On-prem PKCS#11 HSM (e.g. Luna)
- AI
- Local models or air-gapped
Sign-only
- Documents
- On your servers
- Signing keys
- Key Vault or HSM — your choice
- AI
- Disabled — ECM + cryptographic signing only
Azure Key Vault and on-prem HSM
Azure Key Vault is certified for the electronic and cryptographic signatures that cover virtually all Canadian and international commercial documents. Keys are generated and used inside the vault — never exported in plaintext. Premium and Managed HSM pools are certified as a Qualified Signature Creation Device (QSCD) under the EU's eIDAS regulation.
Key Vault is a cloud HSM service in your Azure subscription (e.g. Canada Central). Signing calls reach Azure over encrypted TLS — it is not the same as a physical HSM in your rack. For air-gapped or strict on-prem key custody, Jno Trustsupports PKCS#11 devices such as Luna HSM.
Key Vault is not a “recognized Certification Authority.” For the Secure Electronic Signature tier, the certificate must come from a Treasury-Board-recognized CA. Jno Trust integrates that path (e.g. Entrust or GlobalSign) when you need it.
Governed, tiered AI with Action Ledger
AI assists with bounded steps — summarize and classify after upload, then help participants during signing — with mandatory human approval and a server-side Action Ledger with instant kill-switch control.
No AI. Cryptographic signing, entity policies, and Alfresco workflows only.
Small local models on CPU or modest GPU — automated summaries, classification, and task Q&A.
Larger local models for RAG and workflow assist on indexed repository content without network egress.
Your Azure OpenAI endpoint (e.g. Canada Central) for frontier tasks. Documents of record stay in your Alfresco repository.
How we keep you in control
Self-hosted documents
Alfresco, workflows, and signed PDFs run on your infrastructure via Docker — not in an offshore US envelope SaaS.
Pluggable key custody
Azure Key Vault in your tenant (Canadian region) or on-prem PKCS#11 HSM. Keys never exported in plaintext.
Entity policy enforcement
Automated compliance gates mandate authentication methods, SMS challenges, and quorum requirements per organization.
Server-side Action Ledger
Every AI proposal is cryptographically bound by SHA-256 payload hashing, protected by an instant admin kill-switch.
Audit trails & RFC 3161
Every signature, seal, and endorsement is timestamped and recorded for irreversible legal evidentiary strength.
Zero-reload transition
Signers inspect documents and execute signatures in-memory without session disruption or exposed tokens.
This page is general information, not legal advice. Deployment profile, key custody, and AI tier depend on your security policy and use cases. We recommend confirming your requirements with qualified legal and security counsel.
Ready to sign with AI agents on your own infrastructure?
Book a 30-minute walkthrough. We'll show Jno Trust by Jno Labs in action: cryptographic signing, AI Action Ledger governance, and the sovereign on-premise stack running entirely under your control.