Qualified trust service provider (QTSP)

What does Qualified trust service provider mean?

A qualified trust service provider (QTSP) is an organization that has been granted qualified status by a national supervisory body under the EU's eIDAS regulation to provide one or more qualified trust services. Those services include issuing qualified certificates for electronic signatures and seals, qualified timestamps, qualified validation and preservation of signatures, and qualified electronic registered delivery. The 2024 amendments added further qualified services, such as electronic attestations of attributes and electronic archiving.

Becoming a trust service provider with qualified status is demanding. The provider must be audited by an accredited conformity assessment body, meet strict requirements for security, staff, liability and identity verification, and be re-audited at least every 24 months. Once approved, it is published on its country's trusted list, and the EU aggregates these national lists so that software across Europe can check whether a certificate came from a genuine QTSP.

When someone creates a qualified electronic signature, the QTSP is the party that verified their identity and issued the qualified certificate underpinning the signature. Its role is similar to a certificate authority in general PKI, but with regulatory supervision and legal consequences attached.

A practical example: an accounting firm in Belgium needs partners to sign statutory filings with a QES. Rather than building anything itself, the firm contracts a QTSP, whose onboarding process verifies each partner's identity and issues qualified certificates. The firm's documents can then be signed either through the QTSP's own tool or through a signing platform integrated with that provider.

A common misconception is that any e-signature company is a QTSP. Most are not; many platforms offer simple signatures only, and those that offer qualified ones usually partner with a separate QTSP. Another is that a QTSP's approval in one country limits it to that country. Qualified services are recognized throughout the EU.

Our take: if a vendor claims qualified signatures, look up the named provider on the EU trusted list yourself. It takes a minute and cuts through a lot of marketing language. Genuine QTSPs are easy to verify, and that transparency is one of the best features of the eIDAS system.

eSignSimple is not a QTSP and does not issue qualified certificates. We provide simple electronic signatures supported by an audit trail, certificate of completion and a SHA-256 document hash that can be checked on our /verify page.

What is an example of qualified trust service provider?

A French notary's office needs qualified certificates for its staff. It chooses a provider listed on France's national trusted list, each employee verifies their identity, and the provider issues certificates stored on a remote signing service. Because the provider holds qualified status, signatures made that way count as qualified across the EU. eSignSimple is not a trust service provider of any kind.

What does a QTSP actually do in a signing flow?

A QTSP usually stays in the background. When a platform offers qualified signatures, it hands the signer to its partner QTSP at two moments. First at enrolment: the QTSP verifies the signer's identity using a method its supervisor has accepted and issues a qualified certificate. Then at each signature: if the certificate lives on a remote device, the QTSP operates that device and only uses the signer's key after the signer authenticates. Many QTSPs also apply qualified timestamps to signatures so they can be validated long after the certificate expires.

The platform itself handles the document, the fields, the routing and the notifications. That split is why a single e-signature product can offer qualified signatures in several countries by working with different QTSPs, and why you should always ask which provider sits behind a qualified option.

How do you read an entry on the EU trusted list?

Each member state publishes a trusted list, and the European Commission's Trusted List Browser lets you search them all in one place. Search for the provider's legal name, not its marketing brand. An entry lists the provider, then each service it runs separately: for example a service issuing qualified certificates for electronic signatures, another for seals, another for qualified timestamps. Each service has a status, such as granted or withdrawn, and a history showing when that status changed.

So a provider can be qualified for timestamps but not for signature certificates, or may have had a service withdrawn. When a vendor tells you its signatures are qualified, the useful check is: does the named provider hold a currently granted qualified service for issuing certificates for electronic signatures? If you are verifying an older document, look at the service history to see what the status was on the signing date.

What happens if a QTSP loses its qualified status or shuts down?

eIDAS requires qualified providers to keep an up-to-date termination plan, so that the evidence they hold remains available if they stop operating. If a supervisory body withdraws qualified status, the provider and its affected services are marked as withdrawn on the trusted list from that date. In general, a signature validator looks at whether the provider was qualified when the signature was made, which is why the history on the trusted list matters and why signatures with trusted timestamps age better.

For you, the practical takeaway is to keep validation evidence with important documents. If you received a QES on a contract that matters, save a validation report at the time you receive it, alongside the signed file. It costs nothing and spares you from reconstructing the provider's status years later. The same habit applies to simpler signatures: keep the audit trail and certificate with the document.

Which terms are related?

• eIDAS: eIDAS is the EU regulation (No 910/2014) on electronic identification and trust services, including electronic signatures.
• Advanced electronic signature (AES): An advanced electronic signature is uniquely linked to and identifies the signer, is under their sole control and detects later changes to the data.
• Qualified electronic signature (QES): A qualified electronic signature is an advanced signature created with a qualified device and backed by a qualified certificate from a QTSP.
• Public key infrastructure (PKI): PKI (public key infrastructure) is the system of certificate authorities, digital certificates and key pairs that binds public keys to real identities.