Amélie Frezier, head of the EDICOM Technology Observatory for ensuring the legal compliance of our electronic archiving system, answers all the questions a company could have concerning an electronic archiving project.
Does my business need a certified digital storage service?
- What type of documents can be kept using certified long-term electronic archiving?
All types of documents have a certain value for a company, such as legal, commercial, proprietary or intellectual value. Put simply, there are some documents we are legally required to keep, such as contracts and invoices, and others that we want to protect because they contain sensitive company information.
- What happens if I don’t archive digital documents electronically?
Let’s take the case of an electronic invoice. I have to be able to demonstrate the integrity of the process and of the document for the full legal preservation time (many countries require 10 years of storage). Having an electronic archiving service guarantees this long-term integrity.
- Can any business require a certified long-term electronic archiving service?
All businesses handle documents with legal preservation periods. Moreover, the digital transformation of processes these days sees us use electronic documents that must be preserved in their original format. Use of an electronic archiving system therefore appears to be an essential part of our digital evolution.
- What types of mechanisms are used to ensure the integrity of archived documents?
EDICOMLTA, our electronic archiving system, guarantees document integrity by means of a process called “electronic sealing”. Metaphorically, we could picture it as the wax seal used in the Middle Ages for handwritten documents – if the seal was broken, the message was corrupted. At the electronic level it involves the same process, but instead of wax we use computer algorithms (qualified electronic seal) to seal the document and ensure it cannot be tampered with. A test journal is kept throughout the entire preservation period, collating the activity logged on the platform and, in the documents, (queries, downloads, etc.).
- Does a digital document have the same legal validity as a physical one?
Yes. An electronic document today has the same validity as a handwritten one so long as its authenticity, legibility and integrity are guaranteed, and it has been preserved using methods capable of ensuring these characteristics.
Obviously, you have to refer to the laws in force to create and process the document in line with the legal descriptions of each country. It is here that having a provider capable of supporting you in these processes is both a strategic advantage and a source of reassurance.
- What is the role of FNTC?
The aim of the Federation Nationale des Tiers de Confiance is to bring together information-sector stakeholders and users to work jointly on rolling out good practices in order to propose a framework of trust to both enterprises that can apply to become a trust service provider and users who can choose and learn more about possible partners for their digital transformation projects.
- What are the takeaways from the work groups?
The goals of the work groups, driven by experts and users, are to standardise digital processes and guide users towards effective and simple good practices to comply with different laws and help them bring about their digital transformation.
About the service provider
- What does it mean to be a qualified service provider?
It means we are certified to provide a secure service in digital trust terms. In Europe, EU Regulation 910/2014 defines the features of accredited providers and the trust services they can provide (by means of dedicated certificates for each service). Trust services in turn have various levels of security and trust, the highest being the ‘qualified’ level.
- What is the difference between a qualified trust service provider and a non-qualified one?
There are different trust service levels and the Qualified Trust Service Provider and a non-qualified one can provide trust services in line with their level.
- What does it mean when we talk about electronic archiving with probative value?
It refers to an archiving system that preserves documents with integrity guarantees for a long period of time (generally the legal preservation period). A document acquires probative value when the archiving system preserves it guaranteeing its integrity. The features of these systems are described in international standard ISO 14641.
- What is understood by ‘evidence’ in the electronic archiving system?
‘Evidence’ is computer proof logging actions performed with archived documents and on the archiving platform. It can demonstrate the integrity of the documents and platform used. At the document level, evidence provides a trace of the archived document lifecycle (proof of creation, origin, electronic signature, erasure, etc.).
About the service
- What technology do I need to have an electronic archiving service?
EDICOMLta is a cloud solution. You only need an internet connection to access it. The solution is developed for both manual and automatic use from a company’s IS applications. EDICOMLta can interact with apps through the use of a REST API. What matters is that, whether used manually or automatically, the solution provides administrator users with complete freedom to evolve the solution in line with their requirements.
- Do I need an EDI solution to implement the electronic archiving service?
No. EDICOMLta can archive all sorts of documents from different sources (accounting module, EDI platform, HR module, management systems, etc.).
- Where are my company documents stored?
The EDICOM archiving solution is supported by our DATA CENTER and ISO 27001, ISO 20000, TIERS II and ISAE 3402 certificates to guarantee a high service level. In geographic terms, our DATA CENTER is sited in VALENCIA, Spain.
- How does the service provider ensure the full availability of my documents and their integrity in the event of a data center fail?
Our Data Centers are subject to the levels we present in our SLA and the conditions required by the ISO certificates we hold. They also work in redundancy mode to guarantee service availability.
About the law
- Can the certified e-archiving system be used for documents generated abroad?
Yes, the system features various compliance levels. The first is international compliance as it responds exhaustively to ISO 14641. It is also compliant with specific laws in Italy (Conservazione Elettronica) and Mexico (NOM151), for example. At the European level, the solution is supported by the eIDAS regulation as a qualified trust service for electronic signature preservation. This means we can ensure probative value for archived documents. Plus, the settings enable the solution to be used at a corporate level since you can configure all types of archiving in line with geographic area. For example: EDICOMLta used on-premise as a global document repository can operate on a country-wide basis and ensure legal, compliant archiving.
- Can electronic archiving be understood as a competitive advantage?
Electronic archiving is more than a competitive advantage – it is a mandatory and essential part of a company’s digital transformation. Indeed, businesses often start their digital transformation with flow dematerialisation projects (EDI, e-invoicing, VAT compliance) due to their competitive and economic advantages. However, the joint implementation of a good archiving system should be developed and promoted, particularly in global projects. In point of fact, processing electronic documents requires archiving them in conditions that ensure their integrity. Using a competent system will afford security and confidence in our digital transformation.
- What are the core benefits for day-to-day management of my company in addition to secure and certified archiving?
An e-archiving system will enable companies to use a global archiving repository that offers advanced information-organisation functionalities. Thus, in addition to running searches, lodging queries and sharing documents, we can define which users will have access to what documents and the permits they will have for them.
- What volume of documentation should be the baseline for considering taking out an e-archiving service?
Necessity is not really calculated by volumes but by whether or not you manage electronic documents and whether these documents have a legal, historical or proprietary value for your firm. If you handle electronic documents with a legal value, regardless of volume, you should archive them in their electronic format (such as an electronic invoice, for example). Other cases would be ensuring documents with risk information such as personal data, technical documents, files that must be easy to search, etc.
- Does my provider manage the e-archiving service or is it up to the company’s inhouse resources? Or both?
EDICOMLta proposes full autonomy for the administrator user. This lets the company manage the resource freely or seek our help to evolve it in terms of things such as settings.