ZTmail Sign
Document Signing, Simplified
Sign and verify documents — from email attachments to local files.
The document is already in email. Why leave email to sign it? Sign it in email.
Explore Service Details and PricingPlease Choose the Cryptographic Application Automation Service for Documents
General Edition
From US$ 0
T1 ▪ Mailbox Identity (MV)
Document Cryptographic Automation Service for Mailbox IdentityPersonal Edition
From US$ 5
T2 ▪ Personal Identity (IV)
Document Cryptographic Automation Service for Personal IdentityOrganization Edition
From US$ 8
T3 ▪ Organization Identity (OV)
T4 ▪ Employee Identity (SV)
Document Cryptographic Automation Service for Organization IdentityCurrently, the email and Signing Process is a Separate Workflow. Most online document-signing services are designed around a dedicated platform. The deeper question is how signing identity, document custody, communication and verification fit together.
Separate Workflow
The document must leave the email conversation and enter another application or web workspace.
Separate Document Copy
The signing platform normally receives and manages a copy of the document as part of the signing transaction.
Separate Identity Model
Platform signing workflows commonly use platform-managed signing certificate, authentication and trust mechanisms rather than the user's own Document Signing Certificate.
Separate Communication Flow
Contract negotiation and discussion remain in email while the actual signing process moves to another system.
Separate Validation Experience
The recipient may need the signing platform or its validation workflow to understand the signature and signer information.
Separate Data Boundary
The organization must manage another service, account, document lifecycle and access boundary in addition to its existing email infrastructure.
The Six Separation Must Be Fixed for Productivity and Efficiency.
Why Create a Separate Signing Workspace?
Contracts, proposals, statements, approvals, specifications, internal notices and other business documents are often exchanged as email attachments before anyone signs them. The email conversation already contains the participants, the context, the latest version and the document itself.
ZTmail Sign extends that existing workflow, combining email and e-document signing into one, all within the same workflow.
Email discussion
PDF attachment
final version confirmed
right-click attachment
Sign
optionally Encrypt
Send
recipient verifies identity and signature
Sign
email to parties.
The signing process should follow the document, not force the document to leave the conversation.
Six Innovations ZTmail Sign Changes Document Signing ZTmail Sign combines document signing, email workflow, certificate-backed identity, document encryption, trusted timestamping and visible verification into one cryptographic application layer.
01
One-Click Signing from Email Attachment
Sign the document where it already exists. Right-click a PDF attachment and choose Sign. ZTmail Sign uses the user's configured signing certificate to create the digital signature without requiring the document to be uploaded to a separate signing platform.
02
E-Contract Signing Stays Inside the Email Flow
The entire contract process can remain in email: discuss terms, exchange versions, confirm the final PDF, sign it, send it back and continue the conversation. After completion, the signed contract can remain as an encrypted email attachment in the user's own mailbox rather than becoming a document managed only through a separate signing platform.
03
Sign with Your Own Identity Certificate
The signature is tied to the user's own certificate-backed identity. For formal organizational documents, an Organization Validated identity can make the signer and organization relationship visible, instead of relying only on a platform-centered signing identity.
04
Trusted Identity Is Visible in the Signed Document
When a signed document is opened in ZTmail App, the validated signer identity can be presented as T1 / T2 / T3 / T4 Trusted Identity. The signature becomes more than evidence that a cryptographic operation occurred: it becomes a visible identity signal that users can understand.
05
Encrypt the Document and Control Who Can Read It
A PDF can also be encrypted using Document Encryption Certificates. The document can be encrypted for one or multiple authorized recipients, so each recipient can use their own private key to decrypt it. Authorized users can read the document without managing a shared password, while users without the corresponding private key cannot decrypt it.
06
Trusted Timestamping for Long-Term Validity
A trusted timestamp adds verifiable time information to the signed document, helping establish when the signature existed. ZTmail Sign can apply trusted timestamps as part of the signing workflow, supporting long-term validation of the signed document.
A Digital Signature Should Say Who Signed the Document.
Digital signing proves that a document was signed with a particular private key. ZTmail Sign connects that cryptographic signature with a certificate-backed identity so the recipient can see more than a signature mark. For example, formal organizational documents and contracts, T3 Organization Validated is the key identity level to highlight.
| Level | Identity | Typical Meaning |
|---|---|---|
| T1 | Mailbox Validated | The signer controls the mailbox identity. |
| T2 | Individual Validated | The signer is a validated individual identity. |
| T3 | Organization Validated Highlighted | The signer is a validated organization identity. |
| T4 | Sponsor Validated | The signer is a validated individual and organization/sponsor relationship. |
Your signature. Your certificate. Your identity.
Cloud Signing Without Uploading the Document
Traditional online document-signing workflows require users to upload the original document to a signing platform. ZTmail Sign provides both local signing and a fundamentally different approach: the original document stays on the user's device throughout the signing process.
- ZTmail Sign divides the signing process between ZTmail App and the cloud signing service. ZTmail App calculates the document's cryptographic hash locally using SHA-2 and sends only the hash to the cloud signing service.
- The cloud service signs the hash using its trusted platform-identity signing certificate and returns the signed data to ZTmail App, which completes the document-signing process locally.
- The cloud service performs its part of the signing operation without receiving the original document. This architecture helps protect personal information, confidential contracts, commercial secrets and intellectual property by avoiding the need to upload the document to an external signing platform.
- ZTmail Sign Cloud e-Signing Service follows the cloud signing standards developed by the Cloud Signature Consortium (CSC).
Only the Hash Goes to the Cloud. The Document Always Stays with You.
A Digital Signature Should Prove Not Only Who Signed, But When.
A digital signature establishes the signer’s identity and document integrity. A trusted timestamp adds verifiable time information, helping establish when the signature existed.
Trusted Time for Long-Term Validation
- ZTmail Sign integrates trusted timestamping into the signing workflow, supporting long-term validation of signed documents.
- ZTmail Sign provides timestamping service for local and cloud signing service, user also can set other timestamping service as default.
- Timestamping service support RSA/SM2 algorithm and complies with RFC3161 international standard and GM/T 0033-2014 China cryptographic standard.
Document→Digital Signature→Timestamped→Long-Term Validation
Signing Says Who Signed. Encryption Controls Who Can Read.
Signing and encryption solve different problems. ZTmail Sign lets users combine them in the same email workflow.
Signing
- Sign the PDF with the user's own signing certificate.
- ZTmail App and Adobe Reader UI display the signer’s trusted identity
- Signing for certifying the signer’s trusted identity to prevent identity fraud in electronic documents
- The digital signature attached with a timestamp is to prove that the document's signing time is trustworthy.
Encryption
- Encrypt the PDF with the user's own document encryption certificate.
- Encrypt for one recipient or multiple authorized recipients.
- Each authorized recipient uses their own private key to decrypt, anyone without the corresponding private key cannot decrypt the document.
- No shared document password is required for the recipient to read an encrypted document.
A signed document can prove identity. An encrypted document can restrict access.
ZTmail Sign brings both operations to the same PDF workflow.
Make the Signer Visible.
In ZTmail App, a signed PDF can present the verified signer identity using the ZTmail Trusted Identity model. The user should not need to inspect certificate fields manually just to understand who signed the document.
Open the signed PDF→cryptographic signature is validated→signer identity is displayed→T1 / T2 / T3 / T4 level is visible.ZTmail-signed PDFs are standard signed documents, it can also be opened and verified in Adobe Reader, and Adobe Reader also can show the signer's trusted identity.
and can also be opened in Adobe Reader so the signature and signer information can be verified there as supported by the certificate and document format.
and can also be opened in Adobe Reader so the signature and signer information can be verified there as supported by the certificate and document format.
| ZTmail Sign and ZT Browser UI | Adobe Reader and Acrobat UI | |
|---|---|---|
| MV Identity |  | |
| IV Identity |  |  |
| OV Identity |  |  |
| SV Identity |  |  |
Sign with ZTmail App. Verify with ZTmail App. Verify with Adobe Reader.
Keep the Contract Negotiation and Signing in One Communication Flow.
ZTmail Sign is particularly natural for contracts/agreements because the contract is often already an email attachment, the final signed document does not need to become disconnected from the email conversation that produced it to a separate signing platform.
Discuss the contract in email
Exchange revised PDF versions as email attachments
Confirm the final version
Right-click the final PDF and sign it with the user's certificate
Optionally encrypt it for the intended recipients
Send the signed/encrypted PDF through the same email conversation attachments
Keep the completed signed contract as an encrypted email attachment in the user's own mailbox
Open and verify the signed document later from the mailbox
E-Contract and E-mail, Two in One.
From One Document to Thousands of Documents.
For organizations that generate documents automatically, signing should not require a person to manually open every PDF. ZTmail Sign extends the same certificate-backed signing and encryption model into an enterprise Gateway – Document Cryptographic Application Automation Gateway.
- Business systems generate PDF.
- The system sends the document to the Gateway through an integration interface.
- The Gateway applies the configured signing policy.
- The Gateway digitally signs the document using the configured organizational signing certificate.
- The Gateway can encrypt the document for configured recipients.
- The signed/encrypted PDF is returned to the business system for delivery or archival.
- The attached timestamp signature is automatically handled by the gateway through ZoTrus Cloud Timestamping service. Optional for local deployment of ZoTrus Timestamping System for local use.
- Certificate configuration and lifecycle operations can be automated as part of the Gateway deployment.
Trust Can Become a Signing Policy. Different document types can require different identity levels, signing certificates, recipients or encryption rules.
Your Document. Your Identity. Your Signature.
ZTmail Sign brings together six capabilities that are normally separated across document-signing platforms, email systems and security tools: attachment signing, email-based contract workflows, certificate-backed signer identity, visible Trusted Identity, document encryption and enterprise signing automation.
The document starts by email. The identity comes from the user's certificate. The signature stays with the document. Access can be protected with encryption. Validation remains possible outside the original signing workflow. And at enterprise scale, the same cryptographic operations can be automated by Gateway.
| Product | Core Question | ZTmail Capability |
|---|---|---|
| ZTmail App | Who sent this email? Who can read it? | Trusted identity + signing + encryption + validation |
| ZTmail Chat | Who am I talking to? Who can read it? | Trusted identity and encryption carried into conversation |
| ZTmail Sign | Who signed this document? Who can read it? | Digital signature + trusted identity + document encryption + timestamping |
| ZTmail Gateway | How can an organization automate it? | Centralized cryptographic signing + encryption + timestamping + certificate automation |
ZTmail Sign is built on the same cryptographic foundation as ZTmail App, ZTmail Chat, complete digital signatures, encryption, trusted identities, and certificate automation all in the same business workflow.