How to work

Signing purchase documents digitally, and making it hold up

The question everyone asks is whether signing on a computer counts. The short answer is yes. The longer answer is: it depends entirely on what you kept.

Thailand has recognised electronic transactions in law since 2001. The broad principle is that a message or a signature is not denied legal effect merely because it is electronic. What the law cares about is not pen versus mouse — it is whether you can show who signed, and whether the document changed afterwards.

Three levels of digital signing

1. A signature image dropped onto a PDF. Simplest, and accepted for most internal paperwork. The weakness is obvious: anyone can copy that image
2. A signature tied to a user account. The system records who was signed in, when, and which file they signed. Strong enough for internal documents and ordinary purchase orders
3. A certificate-based digital signature from an accredited provider. For high-value contracts and anything filed with a government body

For purchase orders — internal, or with suppliers you deal with regularly — the second level is usually enough, and most companies can do it today without buying anything.

What to keep, every time somebody signs

• Who signed — tied to a real account, not just a typed name
• When — date and time
• Which document — keep a checksum of the source file (SHA-256, say) so you can prove the signed file is that file
• Which position in the order, if several people sign
• The signed file itself — stored separately from the original, never overwriting it

That last point matters more than it looks. If the signed file overwrites the original, you can never show what the document looked like before anyone signed it.

Mistakes that come up constantly

• Sending the file to be signed over chat and getting three versions back, none obviously the latest
• Sharing a signature image — keeping the director's signature file so an assistant can place it. That is precisely the situation where you have no evidence the director saw the document
• Signing and losing track of the file, then failing to find it when someone audits a year later

What to demand of whatever tool you use

Three things, whichever product you pick: the signature is stamped onto the real page in the position that was agreed, the signed version is written as a new file, and there is a record of who signed what and when. A tool that gives you those three is enough. Everything else is convenience.