SMS + Face ID Signatures With a Hash-Chained Proof

The Real-World Context

Employment contracts need proof: who signed, what they signed, and that it never changed. A typed name at the bottom isn’t proof.

The Test Scenario

We created a fictional contract, hashed it SHA-256 on upload, requested signature, sent SMS one-time code to the employee’s verified phone, verified it, then Face ID on the registered device. We then tried to change one byte and re-verify.

How It Works (The Mechanics)

1. Hash on upload — document SHA-256 anchored.
2. OTP + biometrics — ContractOtpChallenge single-use SMS, expires in minutes, then FaceID/fingerprint on registered device + typed name.
3. Hash chain + certificate — every event hash-chains the previous; Signing Certificate has public verify page with ID and hash.

The Results / What We Verified

• SMS + biometrics created certificate, public page verified. Pass.
• Hash re-verified at signing; one-byte change refused. Pass.
• Chain intact across 128 events. Pass.

Honest caveat: This is advanced-seal evidence — strong for labour disputes. Qualified Electronic Signature (QES) needs a qualified TSP — we state that openly in digital-signature.mdx.

Call to Action

Sign inside the app your team already uses — Instant 2-Minute Setup • No Credit Card Required. Try Chegatta free at Chegatta.com.