Final copy and manifest

When the last party signs, Ravisign automatically assembles the final copy: a single PDF that contains the original document and, at the end, the signature manifest. This file is digitally signed by the platform and sent to all parties.

What the manifest contains#

The manifest is embedded in the PDF itself (it is not a separate file). It includes:

• Document title and envelope code.
• SHA-256 hash of the original, to prove that the signed content is exactly what was sent.
• For each signer: name, email address (masked), CPF or CNPJ when provided, role, code confirmation channel, date and time of signing, IP and the signature mark.
• Hash of the last event in the envelope's audit trail, which links the final copy to the trail.
• A QR code and the link to the public validator, which lead directly to the verification of that envelope.

The texts of the manifest title, statement and footer are editable in Settings, in all three languages.

The platform signature#

The final copy is signed in the PAdES standard with the platform certificate, an ICP-Brasil e-CNPJ belonging to Ravi Systems, and receives an ICP-Brasil timestamp. The goal is the long-term level (PAdES-B-LTA), which keeps inside the PDF the information needed to validate the signature even after the certificate expires.

This signature protects the final copy: if anyone changes a single byte of the PDF afterwards, any PDF reader that verifies signatures shows that the document was modified.

Note the platform signature does not replace the signature of the parties. It seals the document and the evidence collected (identity confirmed by code, IP, date and time, chained trail), which is what characterizes an advanced electronic signature.

Delivery#

• Each party receives a completion email with the final copy and the validation link.
• In the panel, the Signed copy button downloads the file in the envelope detail view.
• Through the API, the file is downloaded with documentos/baixar and tipo=final. See Documents and templates.
• The file name is the document title followed by " - signed" (in Portuguese "assinado", in Spanish "firmado").

How to check a final copy#

There are three ways, from the simplest to the most technical:

1. Ravisign validator: open the link or scan the QR code on the manifest, or upload the PDF in the public validator. The file is not stored.
2. ITI verifier: the official government service at verificador.iti.gov.br checks the platform's ICP-Brasil signature.
3. PDF reader: readers that support digital signatures show the signatures panel, the certificate and the timestamp.

When the final copy is delayed#

Assembling the final copy normally takes a few seconds. If the signing service or the timestamp is unavailable, Ravisign tries again automatically. Meanwhile, the envelope shows the internal notice Final copy not generated yet. If the timestamp cannot be applied, the final copy is issued with the protection available and the level achieved is recorded; see the internal notices in Envelopes.