Access & identity
RBAC, 2FA and server-side controls
TRUST CENTER · OPERATIONAL TRANSPARENCY
Trust Center
One place to understand how Firmato protects access and data, governs providers, preserves evidence integrity and clearly separates platform responsibilities from those of external trust service providers.
Evidence integrity
SHA-256, manifests, audit and verification
Provider governance
Trust Orchestrator and credential segregation
Privacy & security
GDPR, minimisation and traceability
FIRMATO ASSURANCE MODEL
Trust is not a badge. It is a set of verifiable controls.
Firmato combines application controls, operational governance and technical evidence. Qualified functions, where required, are delivered by the trust service provider actually involved in the workflow.
Identity & Access
Roles, permissions, 2FA, sessions and least privilege reduce unnecessary access.
Application Security
Server-side secrets, CSRF controls, output encoding, rate limiting, webhook validation and environment segregation.
Evidence Integrity
SHA-256 hashes, audit trails, Evidence Certificates, verification QR, package manifests and integrity checks.
Provider Governance
Isolated connectors and multi-provider routing reduce lock-in and make the actual provider visible.
EVIDENCE CHAIN
A readable evidence chain, not a black box.
01Document / file
02SHA-256
03Signature or timestamp
04Audit & provider
05Evidence Certificate
06Independent verification
SHARED RESPONSIBILITY
Clear responsibilities across the trust chain
Firmato / UESE
SaaS orchestration, workflow, access control, audit, evidence and application governance.
Trust provider / QTSP
Delivers the trust or qualified service where required by the active process and contract.
Customer / user
Defines purposes and documents, governs its users and selects the assurance level appropriate to the use case.
POLICY & GOVERNANCE
Trust documentation
Policies and operational information are published separately to avoid generic claims and enable precise verification.
Operating principle
Discover UESE ITALIA Group ↗Firmato does not label as “qualified” what is not qualified. The effective level of a signature, timestamp or other trust service depends on the provider, method, identification and configuration actually used.