You meet these terms on the completion certificate, the verification page and the signed PDF, as well as in vendor assessment questionnaires and tender documents. Each entry gives the full form, a plain explanation and where you are likely to meet it. At the end of the page are four common sources of confusion, either because an acronym carries more than one meaning or because one role goes by several acronyms, so confirm which meaning is intended before you base a decision on it.
Timestamping: an independent party attests to when a document was signed
The clock on any device or server can be set by hand, so writing the signing time inside the file is not enough. A Time-Stamping Authority (TSA) is an independent, trusted party that attests that a specific document existed in this exact form at a specific moment.
The authority never sees the text of the contract: it receives a request carrying only the document’s digital fingerprint, and returns a token signed with its certificate that binds that fingerprint to a date and time. If the document is changed afterwards, its fingerprint no longer matches the timestamp.
You do not receive a certificate file to keep. The certificate belongs to the timestamping authority, which signs with it; what you receive is a Time-Stamp Token stored with the document’s own evidence. “Time-Stamping Authority” describes a role, not a product name, which is why providers usually offer it as a “timestamping service”.
The document's fingerprintSent on its own, without the contract text
Time Stamping AuthorityAn independent party binds the hash to a date and time
Signed time-stamp tokenKept with the document’s evidence
In Wthaiq, the evidence record that seals a completed contract carries a certified timestamp from an independent authority under the RFC 3161 standard. The verification page shows the status of this timestamp among the independent evidence layers, and the contract owner can download it inside the “evidence file”.
108 / 108
01
Signing evidence
The terms you see on the completion certificate and the verification page, and rely on when proving who signed, when, and that the document has not changed.
Terms in this group: 9
Hash
Cryptographic hash (digest)
A fixed-length value calculated mathematically from a file’s content; the content cannot be recovered from it. Any change to the file, even a single character, produces a completely different hash, so it is used to detect changes, not to hide content.
Where you meet it
On the completion certificate and the verification page in Wthaiq, where the document hash is fixed when signing completes; at every check, the verification page recalculates it from the content stored on the platform and compares it with the fixed hash.
Audit Trail
Audit trail (event log)
A numbered, chronological record of everything that happened to the document: sending, opening, sending the verification code, successful verification, signing and completion. Each event is recorded with its time, the party who performed it and the IP address it came from.
Where you meet it
On the completion certificate attached to the contract, and on the public verification page, where IP addresses are shown masked to protect privacy.
Certificate of Completion
A document attached to the contract and issued automatically once all parties have signed. It brings together the signers’ details, how each was verified, the timestamps, the document hash, the event log and a QR code for the verification page.
Where you meet it
You receive it with the final copy of every contract completed on Wthaiq. It is a document the platform issues about the signing process, not a digital certification certificate and not an accreditation from an outside body.
Verification Reference
Verification reference (verification number)
A unique identifier given to a signed document, which anyone can enter on the verification page to see its status, hash and event log. It is only a lookup key: it carries no contract data and does not reveal the text.
Where you meet it
On the completion certificate at the end of the signed copy, and in the signing-completed email sent to the parties. The number in the email subject is the document number, which the verification page does not accept.
QR
Quick Response code
A square code read by a phone camera that opens a link without typing it, sparing you copying errors.
Where you meet it
On the completion certificate in Wthaiq, where it opens the verification page with the verification number already filled in.
IP
Internet Protocol address
The numeric address a connection appears from on the network at the moment of an event. It helps distinguish where each step came from, but on its own it does not establish a person’s identity or exact location.
Where you meet it
In the audit trail and on the completion certificate next to each event; it appears masked on the public verification page.
UTC
Coordinated Universal Time
The international time reference against which time zones are defined. Timestamps under RFC 3161 are recorded in UTC, and software may then display them in your local time.
Where you meet it
In timestamp and digital signature details. If you see a difference of two or three hours from Cairo time, it comes from the time zone, not from an error in the timestamp.
Non-repudiation
The ability of the evidence to prevent a signer from credibly denying their signature. It is built from several elements combined, including linking the signature to the signer’s identity, detecting any later change, and recording when the signature was made.
Where you meet it
In questions from legal and procurement teams about the strength of signature evidence. Weighing the evidence in any dispute remains within the court’s discretion.
JSON
JavaScript Object Notation
A structured text format for storing data and exchanging it between systems, readable by both people and computers.
Where you meet it
In the “evidence file” the contract owner downloads from the verification page in Wthaiq, and in API responses and webhooks.
02
Electronic signatures and timestamping
Electronic signature levels, formats and baseline profiles, and the terms of timestamping, which proves when a signature was made.
Terms in this group: 20
TSA
Time Stamping Authority
An independent, trusted party that issues signed timestamps proving that specific data existed at a specific moment. The term describes the party’s role, not a product or a certificate.
Where you meet it
In descriptions of signature evidence and evidence layers, and in provider offerings, which usually call it a “timestamping service”.
TSU
Time Stamping Unit
The set of hardware and software inside a time-stamping authority that actually signs the timestamps; each unit has a single active signing key at any time.
Where you meet it
In timestamping authorities’ policies and practice documents; its name may also appear in the details of the certificate used to sign the timestamp.
TST
Time-Stamp Token
The timestamp itself: a small piece of data signed by the time-stamping authority that binds the document’s hash to a date and time. It is what gets stored with the document instead of a certificate file, and it has nothing to do with the signing token you plug into a computer.
Where you meet it
Inside a PAdES signature embedded in a PDF when it carries a timestamp, and in the “evidence file” the contract owner downloads from the verification page in Wthaiq.
TSQ / TSR
Time-Stamp Query / Time-Stamp Response
Common abbreviations for the two messages of the RFC 3161 protocol: the request carrying the document’s hash, and the response carrying the signed time-stamp token.
Where you meet it
In technical tools such as OpenSSL, where the two messages appear as files with the .tsq and .tsr extensions.
RFC 3161
Request for Comments 3161 (Time-Stamp Protocol)
The document published by the Internet Engineering Task Force (IETF) that defines how timestamps are requested and issued. The number is the document’s number in the RFC series, not the name of an organization.
Where you meet it
In the description of timestamping in Wthaiq, where the evidence record is sealed with a timestamp from an independent authority under this standard; its name appears on the verification page.
PAdES
PDF Advanced Electronic Signatures
A standard in which the digital signature and the digital certificate are embedded inside the PDF file itself, so the signature travels with the file wherever it goes. A PDF reader shows whether the file has changed since signing.
Where you meet it
In a PDF signed with a token on Wthaiq, where the signature is embedded under this standard and can be checked in Adobe Reader or any compatible reader.
CAdES
CMS Advanced Electronic Signatures
An advanced signature format based on the CMS structure that can sign any type of file or data; the signature may be kept separate from the file or wrap it.
Where you meet it
When signing data outside PDF files, including signing in the Egyptian Tax Authority’s e-invoicing system.
XAdES
XML Advanced Electronic Signatures
An advanced signature format designed for XML files and XML-based messages.
Where you meet it
In system-to-system integrations, and in some e-invoicing and government service systems around the world.
ASiC
Associated Signature Containers
A single compressed file that bundles one or more documents with their signatures and timestamps, so they travel together without being separated.
Where you meet it
When signed documents are exchanged between European systems; its files usually carry the .asice or .asics extension.
B-B / B-T
Baseline – Basic signature / Baseline – with Time-stamp
The first two levels in the European signature standards (PAdES, CAdES and XAdES): the basic level holds the signature and the signer’s certificate, and the second adds a certified timestamp proving when the signature was made.
Where you meet it
In digital signature technical specifications and tender documents, and on Wthaiq’s credibility page, which explains the progression of levels from B to LTA.
Two higher levels: LT stores the certificate validation material inside the file, such as certificate chains and revocation status, and LTA adds an archive timestamp that keeps the signature verifiable after the certificates used in it have expired.
Where you meet it
In descriptions of documents that must remain verifiable for many years, such as real estate contracts, bank records and government documents.
LTV
Long-Term Validation
A signature’s ability to be verified years later, even after the certificate expires or its checking services stop, because the validation material is stored inside the file. It is the same idea behind the LT and LTA levels.
Where you meet it
In the signatures panel in Adobe Acrobat and Reader, where “LTV enabled” appears for a signature that carries its validation material.
SES
Simple Electronic Signature
Any electronic form of consent, such as typing a name, clicking a button or pasting an image of a handwritten signature. It is the easiest level and the weakest as evidence unless other evidence surrounds it.
Where you meet it
In comparison tables of the three signature levels (simple, advanced and qualified), including Wthaiq’s credibility and legal standing page.
AES
Advanced Electronic Signature
A middle level whose requirements are set by the EU eIDAS Regulation: the signature is uniquely linked to and identifies the signer, is created with means the signer uses under their sole control, and reveals any later change to the document.
Where you meet it
In procurement and legal questionnaires that ask about signature level, and on Wthaiq’s credibility page, which shows where each signing path sits among these levels.
QES
Qualified Electronic Signature
The highest level under eIDAS: an advanced signature created with a certified secure signature-creation device and based on a qualified certificate; in the European Union it has the effect of a handwritten signature.
Where you meet it
When signing with a certificate issued by a licensed certification authority. Wthaiq’s credibility page states that this level comes from the customer’s own token and certificate, not from the platform.
eSeal
Electronic Seal
A digital seal similar to a digital signature but issued in the name of an organization rather than a person, proving a document’s origin and integrity. It is often used for documents issued automatically in large volumes, and what makes it a seal is the type of certificate: one issued to an organization, not to a person.
Where you meet it
On invoices, notices and official documents that organizations issue in their own name.
DSS
Digital Signature Service
A common name for services and libraries that create and validate digital signatures, including an open-source library published under this name by the European Commission. The same acronym also stands for the US Digital Signature Standard.
Where you meet it
In the technical documentation of signing and validation tools, and in signature validation reports.
Token
USB cryptographic token
A small device plugged into a computer that holds your digital certificate and private key, and uses the key only after you enter your PIN. It is designed so the private key cannot be extracted from it.
Where you meet it
In the token signing level on Wthaiq: the certificate is issued by a licensed certification authority, the signature is embedded in the PDF under the PAdES standard, and the certificate and token belong to the customer, not the platform.
AATL
Adobe Approved Trust List
A list of certification authorities that Adobe Acrobat and Reader trust automatically, so a signature based on one of them shows as valid without manual setup. Adobe also relies on the European trusted lists.
Where you meet it
When you open a signed PDF in Adobe Reader: if the certificate’s authority is not on its trust lists, the signature validity may show as “unknown” even though the file has not changed since signing.
ETSI
European Telecommunications Standards Institute
A European standards body that publishes the technical specifications for the PAdES, CAdES, XAdES and ASiC signature formats, and for the requirements on trust service and timestamping providers.
Where you meet it
In signature technical references, under numbers such as EN 319 142 for PDF signatures.
03
Digital certificates and certification authorities
The system that issues digital certificates and proves they are valid, and the names of the bodies, documents and fields that govern it.
Terms in this group: 17
PKI
Public Key Infrastructure
The complete system of authorities, policies and technologies that issues, manages and revokes digital certificates, linking each public key to its owner’s identity.
Where you meet it
In any discussion of certificate-based digital signatures, and in the technical specifications of certification authorities and signing systems.
CA
Certification Authority
The body that issues and signs digital certificates after verifying their holders’ identity, and revokes them when needed. This is the general technical term for the role.
Where you meet it
In the details of any digital certificate under the issuer field, and in the offerings of bodies that issue signing tokens.
CSP
Certification Service Provider
A provider of electronic certification certificates and related signature services. In Egypt it refers to the electronic certification providers licensed by ITIDA under Law No. 15 of 2004.
Where you meet it
When buying a signing token or renewing its certificate, and in official correspondence that requires a certificate from a “licensed certification authority”.
TSP
Trust Service Provider
The European term under eIDAS for any provider of electronic trust services, such as certificates, timestamps and signature validation.
Where you meet it
In European providers’ offerings and documents. Do not confuse it with TSP in RFC 3161, where it means the Time-Stamp Protocol.
QTSP
Qualified Trust Service Provider
A trust service provider granted qualified status under eIDAS by the supervisory body of an EU member state, and listed on the European trusted lists.
Where you meet it
In European providers’ offerings for qualified signatures and qualified timestamps.
RA
Registration Authority
The body that verifies a certificate applicant’s identity and documents before the certification authority issues the certificate; it may be part of the certification authority or act on its behalf.
Where you meet it
When you apply for a signing certificate for a token, as your documents are reviewed before issuance.
Root CA
Root Certification Authority
The highest point of trust in a certificate chain, which signs the certificates of the authorities below it. Every certificate derives its trust from its chain ending at a trusted root.
Where you meet it
In the certification path (chain of trust) when checking a signature in a PDF reader or a website certificate in the browser.
CRL
Certificate Revocation List
A list published periodically by a certification authority with the serial numbers of certificates revoked before expiry, for example when a token is lost or a key is suspected to be compromised.
Where you meet it
In signature validation details inside a PDF reader, and within the validation material stored inside the file at the LT and LTA levels.
OCSP
Online Certificate Status Protocol
A way for software to ask the certification authority in real time whether a specific certificate is valid or revoked, without downloading the full list.
Where you meet it
In signature validation details inside a PDF reader, and within the validation material stored in long-term signatures.
CPS
Certification Practice Statement
A document published by a certification authority explaining how it applies its policies in practice: identity verification, issuing and revoking certificates, and protecting its keys.
Where you meet it
On the website of the certification authority that issued your certificate, and in compliance reviews that examine where certificates come from.
CP
Certificate Policy
The set of rules defining what purposes a given class of certificates is suitable for, and the requirements its issuer and users must meet.
Where you meet it
In a digital certificate’s details under the policies field, and on the certification authority’s website alongside its practice statement.
X.509
ITU-T Recommendation X.509
The international standard defining the structure of a digital certificate: its holder, the holder’s public key, the issuer, the validity period and the issuer’s signature.
Where you meet it
In almost every digital certificate: signing token certificates and the TLS certificates that secure websites.
CSR
Certificate Signing Request
A file created on the device that holds the private key, containing the public key and the applicant’s details, sent to the certification authority to issue the certificate. It does not contain the private key.
Where you meet it
When requesting a TLS certificate for your website’s domain, or a signing certificate whose key is generated on your device or token.
CN / DN
Common Name / Distinguished Name
Two fields that identify a certificate’s holder and issuer: the common name is the displayed name, and the distinguished name is the full identification including the name, organization and country.
Where you meet it
In certificate details when opening a signature in a PDF reader or inspecting a website certificate in the browser.
SAN
Subject Alternative Name
A certificate field that adds other names the same certificate is valid for, such as several domains in one TLS certificate, or an email address.
Where you meet it
In the website certificate details the browser shows when you click the site-information icon next to the address.
PKCS
Public-Key Cryptography Standards
A numbered series of standards for public-key operations, the best known being PKCS#7 for signed message structure, PKCS#11 as the interface for working with tokens and HSMs, and PKCS#12 for a file bundling a certificate and its key with a .p12 or .pfx extension.
Where you meet it
In the technical documentation of signing tokens and their drivers, and when moving a certificate from one device to another.
CMS
Cryptographic Message Syntax
An IETF standard for the structure of signed or encrypted data, derived from PKCS#7, on which CAdES and signatures embedded in PDF files are built. The same acronym also means “Content Management System” in a different field.
Where you meet it
In the name of the CAdES format, and in the technical specifications of signatures inside PDF files.
04
Keys and cryptography
Signature and hashing algorithms, key storage devices and their certification standards, and the means of securing connections and sign-in.
Terms in this group: 15
HSM
Hardware Security Module
A dedicated device for generating, storing and using cryptographic keys inside it, designed so that the private key cannot be extracted.
Where you meet it
In security questionnaires asking how signing keys are stored, and in certification and timestamping authorities’ descriptions of their infrastructure.
KMS
Key Management Service
A service, usually cloud-based, that creates and stores cryptographic keys and manages their rotation and usage permissions; many are backed by HSMs behind the scenes.
Where you meet it
In information security questionnaires, and in service providers’ descriptions of their cloud infrastructure.
FIPS 140-2 / 140-3
Federal Information Processing Standard 140-2 / 140-3
A US standard issued by the National Institute of Standards and Technology (NIST) for testing and certifying cryptographic modules at four graded security levels; version 140-3 has replaced 140-2.
Where you meet it
In the specifications of tokens and HSMs, and in government and banking tender documents.
CC EAL4+
Common Criteria – Evaluation Assurance Level 4 augmented
An international framework for evaluating the security of IT products, adopted as the international standard ISO/IEC 15408, with assurance levels from EAL1 to EAL7. The + sign means requirements beyond the stated level were added to the evaluation.
Where you meet it
In the specifications of tokens, smart cards and secure signature-creation devices.
SHA-256
Secure Hash Algorithm, 256-bit (SHA-2 family)
An algorithm from the SHA-2 family that computes a fixed-length hash of 64 hexadecimal characters for any content; the whole hash changes if a single character changes.
Where you meet it
On Wthaiq’s verification page for PDF files uploaded for signing, which shows the SHA-256 hash of the final version of the file; changing a single character produces a completely different hash.
HMAC-SHA256
Hash-based Message Authentication Code using SHA-256
A digital fingerprint computed with the HMAC-SHA256 algorithm from the contract text, the signer's name, and the signing time, using a secret key held by the platform. No one outside the platform can recompute or forge it, and any change to the contract breaks the match.
Where you meet it
In contracts created on Wthaiq from the template library or the editor, whose verification numbers start with WTQ. Any party can check it by comparing it with the fingerprint shown on the public verification page.
RSA
Rivest–Shamir–Adleman
A public-key algorithm used for digital signatures and encryption, named after the initials of its three inventors.
Where you meet it
In digital certificate and PDF signature details, usually alongside the key length, such as RSA 2048.
ECDSA
Elliptic Curve Digital Signature Algorithm
A digital signature algorithm that offers security comparable to RSA with much shorter keys.
Where you meet it
In modern digital certificates and website TLS certificates.
Ed25519
Edwards-curve Digital Signature Algorithm on Curve25519
A modern digital signature algorithm from the elliptic-curve family with short keys and signatures; anyone can verify a signature made with it using the public key alone.
Where you meet it
In Wthaiq’s Trust Center, where the public key is published so that anyone can verify the signature on a completed contract’s evidence record.
HMAC
Hash-based Message Authentication Code
A value calculated from a message’s content and a shared secret key, proving the message came from someone holding the key and was not altered in transit. Only someone holding the same key can verify it.
Where you meet it
In Wthaiq webhooks, where your server verifies the HMAC SHA-256 signature before trusting the payload, and in the “internal seal” among the evidence layers on the verification page.
TLS
Transport Layer Security
The protocol that encrypts the connection between your browser and a website, indicated by a site address that begins with https. It is the correct name for what is commonly called SSL.
Where you meet it
In every connection to Wthaiq, which runs over TLS 1.2 or later; you can check the site’s certificate yourself from the site-information icon next to the address in your browser (a padlock in some browsers).
SSL
Secure Sockets Layer
The older protocol replaced by TLS; all of its versions are obsolete and insecure. The name remains common in phrases such as “SSL certificate”.
Where you meet it
In website certificate offerings and security questionnaires, where TLS is usually what is actually meant.
OTP
One-Time Password
A temporary code valid for a single use and a short time, either sent to a channel the person controls, such as email or phone, or generated by an authenticator app or device they hold, proving that whoever enters it controls that channel or device.
Where you meet it
When signing on Wthaiq, where the code is sent to the signer’s email or phone and signing completes only once it is entered; the successful verification is recorded in the event log.
MFA / 2FA
Multi-Factor / Two-Factor Authentication
Sign-in that requires more than one proof of different kinds: something you know, such as a password; something you have, such as a phone; or something you are, such as a fingerprint.
Where you meet it
In your email account’s security settings. Wthaiq’s Trust Center recommends enabling two-step verification on it, because your email is the recovery key to your accounts.
E2EE
End-to-End Encryption
Encryption in which content stays encrypted from the sender’s device to the recipient’s device, so no intermediary can read it, not even the service provider.
Where you meet it
In information security questionnaires. It differs from connection encryption (TLS), which protects data while it travels between your device and the server.
05
Identity verification
Terms for verifying the identity of individuals and businesses remotely, and the related financial compliance checks.
Terms in this group: 11
KYC
Know Your Customer
The procedures an institution uses to verify an individual customer’s identity before and during the relationship, required by regulators especially for banks and payment companies.
Where you meet it
When opening a bank account or e-wallet, and in onboarding agreements that payment companies conclude with their customers.
eKYC
Electronic Know Your Customer
The same Know Your Customer procedures carried out remotely: photographing an identity document and checking it automatically, then matching the holder’s live face to the document photo.
Where you meet it
In Wthaiq’s “signing with identity verification” step, where the signer verifies their identity with an official document and a live face match before the signing page opens.
KYB
Know Your Business
Verifying businesses rather than individuals: their legal existence, commercial registration, and who actually owns and represents them.
Where you meet it
When banks and payment companies contract with merchants and businesses, and when reviewing the authority of someone signing on behalf of a legal entity.
AML
Anti-Money Laundering
The laws and procedures that prevent financial institutions from being used to hide the source of illicit funds; its tools include screening customer names against sanctions lists and monitoring transactions.
Where you meet it
In the policies of banks and payment companies, and in compliance clauses within agreements with them.
PEP
Politically Exposed Person
A person who holds or has held a prominent public position, a category that also covers family members and close associates; dealing with them requires enhanced due diligence under anti-money laundering procedures.
Where you meet it
In account-opening forms and compliance questionnaires at banks and payment companies.
PAD
Presentation Attack Detection
Techniques that distinguish a person actually present in front of the camera from spoofing attempts such as a printed photo, a screen recording, a mask or a fake video. Liveness detection is among the best known.
Where you meet it
In Wthaiq’s “signing with identity verification” step, where a live selfie is taken with liveness detection, and photos and recorded videos are rejected.
MRZ
Machine Readable Zone
Two or three lines of coded letters and symbols following the International Civil Aviation Organization (ICAO) standard, read by machines to extract the document’s data and check its consistency.
Where you meet it
At the bottom of a passport’s data page, and on some identity cards and visas.
NFC
Near Field Communication
Wireless communication over a few centimeters that lets a phone read the chip in a passport or identity card; it is also used for contactless payments.
Where you meet it
In identity verification apps that ask you to hold the document near the phone, and in card and phone payments.
OCR
Optical Character Recognition
Technology that converts text visible in an image or scanned file into searchable, processable text.
Where you meet it
In extracting data from photos of identity documents, and in converting scanned paper contracts into text.
FAR / FRR
False Acceptance Rate / False Rejection Rate
Two measures of biometric matching accuracy: the first is the rate of accepting someone who is not the identity holder, the second the rate of rejecting the genuine holder. Lowering one usually raises the other.
Where you meet it
In the technical specifications and test reports of face matching systems.
PII
Personally Identifiable Information
Any data that identifies a specific person directly or when combined with other data, such as a name, national ID number, email address or phone number. The term is American in origin; Egyptian Law No. 151 of 2020 and the European regulation use “personal data” instead.
Where you meet it
In information security questionnaires and privacy policies, including the statement of what data Wthaiq collects and why on its compliance page.
06
Compliance and regulation
The bodies, laws and standards governing electronic signatures, data protection and information security, which recur in vendor assessment questionnaires.
Terms in this group: 12
ITIDA
Information Technology Industry Development Agency
The Egyptian agency established by Electronic Signature Law No. 15 of 2004, responsible for licensing electronic certification providers and supervising the electronic signature system in Egypt.
Where you meet it
In legal references on electronic signatures in Egypt, and when checking that the body that issued your token’s certificate is licensed.
MCIT
Ministry of Communications and Information Technology
The Egyptian ministry responsible for the communications and information technology sector, to which ITIDA is affiliated.
Where you meet it
In decisions and regulations on electronic signatures and data protection in Egypt.
PDPL
Personal Data Protection Law
In Egypt, Law No. 151 of 2020, which regulates the collection, processing and transfer of personal data and grants data subjects rights including notice, access, correction and erasure. The same acronym is used for similar laws in other countries, including Saudi Arabia.
Where you meet it
On Wthaiq’s compliance page and privacy policy, and in data protection clauses within contracts.
DPO
Data Protection Officer
The person responsible within an organization for overseeing its compliance with data protection law, handling data subject requests and liaising with the supervisory authority.
Where you meet it
In privacy policies and data processing agreements, where the data protection contact is given.
DPA
Data Processing Agreement
A contract between the organization that controls data and the party that processes it on its behalf, setting out the purpose and limits of processing, sub-processors and incident notification procedures.
Where you meet it
Among Wthaiq’s legal documents; the platform also provides it to enterprise customers on request.
DPIA
Data Protection Impact Assessment
A documented study carried out before starting processing likely to pose a high risk to data subjects, to identify those risks and ways to reduce them. The GDPR requires it in such cases.
Where you meet it
In organizations’ projects that process sensitive or large-scale data, and in vendor assessment questionnaires.
GDPR
General Data Protection Regulation
The European Union’s regulation on the protection of personal data. It can apply to organizations outside the EU when they offer goods or services to individuals in the EU or monitor their behavior there.
Where you meet it
In contracts with European customers and partners, and on a dedicated page among Wthaiq’s legal documents.
eIDAS
electronic IDentification, Authentication and trust Services
The European Union regulation governing electronic identification and trust services, including electronic signatures, seals and timestamps, and defining the simple, advanced and qualified signature levels.
Where you meet it
In international comparisons of signature levels, including Wthaiq’s credibility page, which uses it as a global reference alongside the Egyptian framework.
ISO 27001
ISO/IEC 27001 – Information security management systems
An international standard setting requirements for establishing, operating and improving an information security management system; independent certification bodies grant certificates of conformity after an audit.
Where you meet it
In vendor assessment questionnaires and tender documents. Wthaiq’s Trust Center sets out what the platform actually implements, without claiming any international certification.
ISMS
Information Security Management System
The organized framework of policies, procedures and controls through which an organization manages its information security risks; it is what ISO 27001 certification assesses.
Where you meet it
In organizations’ internal security documents, and in vendor assessment questions on information security governance.
SOC 2
System and Organization Controls 2
A report issued by an independent auditor under the American Institute of Certified Public Accountants (AICPA) framework. It always assesses an organization’s security controls, and its scope may also cover availability, processing integrity, confidentiality and privacy, as the organization chooses. Type II measures how effective the controls are over a period of time.
Where you meet it
In requests from companies, especially US ones, when assessing cloud service providers.
SoA
Statement of Applicability
A mandatory ISO 27001 document listing the reference security controls, showing which are applied and which are excluded, with the justification for each decision.
Where you meet it
In ISO 27001 audit files; an enterprise customer may request it when assessing a supplier that holds the certification.
07
Security, operations and integration
Terms for service continuity and security testing, and the tools for connecting your systems to a signing platform.
Terms in this group: 24
SLA
Service Level Agreement
An agreement defining the committed service level in clear measures, such as availability and response times for incidents, and the consequences of falling short.
Where you meet it
In cloud and enterprise service contracts. Wthaiq’s Trust Center presents its availability figure as an operational target, not a result audited by an outside body.
BCP
Business Continuity Plan
A documented plan setting out how an organization keeps delivering its essential services during crises and major outages.
Where you meet it
In vendor assessment questionnaires and enterprise tender documents.
DR
Disaster Recovery
The procedures and arrangements that bring systems and data back into operation after a major outage or incident, including backups and restore testing.
Where you meet it
In vendor assessment questions about backups. Wthaiq’s Trust Center explains how backups are stored off the server and checked for restorability.
RTO
Recovery Time Objective
The maximum acceptable time a service can be down after an outage before it is back in operation.
Where you meet it
In disaster recovery plans and service level agreements.
RPO
Recovery Point Objective
The maximum amount of data that may acceptably be lost in an outage, measured as the time between the last sound backup and the moment of failure.
Where you meet it
In disaster recovery plans and backup policies.
VAPT
Vulnerability Assessment and Penetration Testing
A two-stage security review: identifying known vulnerabilities in systems, then attempting to exploit them in a controlled way to measure their real impact.
Where you meet it
In tender documents, requests for proposals and vendor assessment questionnaires.
OWASP
Open Worldwide Application Security Project
A non-profit foundation that publishes open guides and standards for web application security, best known for the OWASP Top 10 list of the most critical vulnerability categories.
Where you meet it
In penetration test reports and security requirements in tender documents.
WSTG
Web Security Testing Guide
A detailed OWASP methodology for testing web application security, covering test steps and cases.
Where you meet it
In penetration testing contracts and reports when the methodology used is specified.
ASVS
Application Security Verification Standard
An OWASP standard listing testable security requirements across three levels according to how sensitive the application is.
Where you meet it
In the security requirements organizations set for their applications, and in the scope of penetration tests.
CVSS
Common Vulnerability Scoring System
A scale that gives each vulnerability a severity score from 0 to 10, grouped into five ratings: none, low, medium, high and critical.
Where you meet it
In penetration test reports and security update advisories.
CVE
Common Vulnerabilities and Exposures
A public catalog that gives each disclosed security vulnerability a unique identifier in a format such as CVE-2024-12345, so it can be referred to consistently everywhere.
Where you meet it
In penetration test reports and software security update advisories.
CREST
Council of Registered Ethical Security Testers
An international not-for-profit accreditation body that originated in the United Kingdom, accrediting penetration testing companies and individuals; today it uses its acronym as a name in its own right.
Where you meet it
In tender documents requiring the penetration testing provider to be accredited.
OSCP
Offensive Security Certified Professional
A hands-on professional certification for individual penetration testers issued by OffSec, in which candidates are tested by breaking into real systems.
Where you meet it
In the CVs of penetration testing teams, and in tester qualification requirements in tender documents.
WAF
Web Application Firewall
A protective layer that inspects requests coming into a web application and blocks known attack patterns before they reach it.
Where you meet it
In information security questionnaires and tender documents asking how internet-facing applications are protected.
SIEM
Security Information and Event Management
A system that gathers logs from different systems in one place and analyzes them to detect suspicious patterns and raise alerts.
Where you meet it
In information security questionnaires, and in descriptions of organizations’ security operations centers.
RBAC
Role-Based Access Control
A model in which permissions are granted to roles rather than directly to individuals, so each user receives only the permissions of their role.
Where you meet it
In information security questionnaires, and in team permission settings within enterprise systems.
SSO
Single Sign-On
A single sign-in through the organization’s account that lets an employee access several applications without a separate password for each.
Where you meet it
In enterprise IT departments’ requirements when adopting a new cloud tool.
SAML / OIDC
Security Assertion Markup Language / OpenID Connect
Two protocols through which identity systems and applications exchange sign-in data: SAML is older and common in enterprises, while OpenID Connect is newer and built on OAuth 2.0.
Where you meet it
In single sign-on settings and identity integration requirements from IT departments.
API
Application Programming Interface
A set of documented endpoints that lets one system request another system’s services and exchange data with it automatically.
Where you meet it
In Wthaiq’s developer center: sending contracts for signature from your systems, tracking their status, then receiving the signed file.
SDK
Software Development Kit
A ready-made library in a specific programming language that wraps API calls, so developers write less code.
Where you meet it
In software platforms’ developer centers, when a developer chooses between calling the API directly and using a ready-made package in their language.
Webhook
A request one system sends automatically to a URL on your server the moment an event happens, so your system does not need to keep asking for the status.
Where you meet it
In Wthaiq’s developer center: notifications arrive when a document is opened, signed and completed, signed with HMAC SHA-256 so your server can verify their source.
API Key
A string your system uses to identify itself when calling an API. A secret key must be treated like a password, while a publishable key has restricted permissions and can safely be exposed in the browser.
Where you meet it
In your Wthaiq account: a secret key used only on the server, and a publishable key intended for the browser.
White-label
Offering another provider’s service under your own name and logo, so your customer sees it as part of your product.
Where you meet it
In signing through the Wthaiq API, where your logo and color appear on the signing page the signer sees.
OAuth
Open Authorization (OAuth 2.0)
A standard that lets you grant an application limited access to your account on another service without sharing your password with it, and revoke that access later.
Where you meet it
When connecting an application to your Google or Microsoft account to grant it specific access. The Wthaiq API itself needs only an API key, without OAuth.
No term matches your search
Try a shorter acronym or a different word, or show all terms.
Common sources of confusion
Acronyms that carry more than one meaning, and roles that go by more than one acronym. Confirm the intended meaning before you base a decision on it.
AES
It has two completely different meanings. In electronic signatures it means Advanced Electronic Signature, the middle level between simple and qualified. In cryptography it means Advanced Encryption Standard, an algorithm for encrypting data. So “AES-256” refers to encryption, while “AES signature” refers to a signature level.
It has three common meanings. In electronic signatures it means Certification Service Provider, the provider that issues signing certificates; in Egypt this refers to licensed electronic certification providers. In web development it means Content Security Policy, a header telling the browser which sources it may load. In Windows it means Cryptographic Service Provider, a software component through which programs access cryptographic functions. So confirm the intended meaning whenever the acronym appears in correspondence between legal and technical teams.
In contracts it means Data Processing Agreement, the agreement an organization concludes with whoever processes data on its behalf. In a regulatory context it means Data Protection Authority, the supervisory body for data protection; in Egypt this role belongs to the Personal Data Protection Center established by Law No. 151 of 2020. So if someone asks you for a “DPA”, first check whether they mean a document to sign or an authority to address.
Four acronyms for closely related roles, with vocabulary that varies by framework. CA is the general technical term for a body that issues digital certificates. CSP is a certification service provider; in Egypt it refers to electronic certification providers licensed by ITIDA. TSP and QTSP belong to the EU eIDAS vocabulary: a trust service provider, a broader role covering certificates, timestamps and more, and a qualified trust service provider granted that status by a European supervisory body. So when you read QTSP in a European offer or “licensed certification authority” in an Egyptian context, it means a body recognized within its own legal framework, which is not necessarily recognized automatically in the other. Note also that TSP in RFC 3161 means something different: the Time-Stamp Protocol.
To go deeper into the completion certificate, how contracts are verified and the legal basis of electronic signatures, turn to the Knowledge Center guides.
