Digital Signature Platform

Overview

A signing service used by the group’s other platforms whenever a user journey produces a legally binding document — a vehicle purchase contract, most often. It verifies that the person signing is who they claim to be, binds the signature to a hardware-backed credential, and produces a document that holds up as evidence.

The problem

Signing flows fail in a specific way: they are the step where users are most likely to abandon, and also the step where you have the least freedom to simplify. Identity verification, credential enrolment and signing each involve an external system with its own latency, its own failure modes and its own idea of what a session is. FIDO2 in particular behaves differently across browsers and platform authenticators, and a user who has never enrolled a security key has no mental model for what the browser is about to ask them. Meanwhile nothing in the flow can be fudged — an ambiguous state in a signing UI is a legal problem, not a UX complaint.

Approach

• Treated the flow as an explicit state machine with named states rather than a sequence of screens, so every external callback lands in a state the UI knows how to render — including the failure states.
• Made identity verification, credential enrolment and signing independently resumable: a user who drops out at eKYC returns to eKYC, not to the start.
• Wrapped FIDO2 in a capability check that tells the user in plain language what their device supports before the browser prompt appears, rather than letting an unexplained platform dialog be their first contact.
• Kept the exact document being signed visible and immutable at the moment of signing — what the user sees is what the signature covers.
• Integrated with the central SSO so the signing platform never handles credentials of its own, only a token scoped to the signing session.

What shipped

• IranSign SDK integration for certificate-backed digital signatures.
• eKYC identity verification as a resumable step in the flow.
• FIDO2 / WebAuthn enrolment and authentication with graceful handling of unsupported devices.
• Runs standalone — other platforms hand off to it and receive a signed result.

Outcome

Legally sensitive journeys across the group now route through one audited signing service instead of each platform approximating its own. The resumable step design cut the cost of a mid-flow drop-out from "start over" to "continue".