sgcSign Sign documents. Sign code. Prove it.

XAdES for XML, PAdES for PDF, CAdES for CMS and ASiC containers for the whole bundle. Authenticode, ClickOnce, NuGet and VSIX for what you ship. From a native Delphi, C++ Builder or .NET component, or from sgcSign Server over REST, with the same signing engine behind both.

Download the trial Explore sgcSign
Centralised signing for your build farm with sgcSign Server →
  • XAdES
  • PAdES
  • CAdES
  • ASiC
  • Authenticode
  • RFC 3161 timestamps
  • Delphi
  • C++ Builder
  • .NET
  • 4ETSI signature families: XAdES, PAdES, CAdES and ASiC
  • 4Baseline levels, from B-B up to B-LTA archival
  • 10Key providers, from PFX files to cloud KMS
  • 21Pre-configured country profiles
  • 0Private keys on your build agents
Watch it sign

Real signatures, recorded on screen.

Narrated, captioned recordings of sgcSign at work. Pick one from the list. Nothing downloads until you press play.

sgcSign quickstart

Digital signatures for XML, PDF and files from Delphi: XAdES, PAdES, CAdES, ASiC, Authenticode and RFC 3161 timestamps.

Two halves, one engine

Documents on one side, code on the other.

The same key providers, the same timestamp client and the same validation pipeline sign a Spanish invoice and a Windows installer. Learn the API once, apply it everywhere.

Document

XAdES

ETSI EN 319 132. XML signatures in enveloped, detached and enveloping modes. The format behind e-invoicing and EU employment contracts.

Document

PAdES

ETSI EN 319 142. Signatures embedded in the PDF itself, with a visible appearance carrying signer name, reason, location and contact. Compatible with Adobe Acrobat.

Document

CAdES

ETSI EN 319 122. CMS / PKCS#7 binary signatures over any file or stream, detached or attached.

Document

ASiC-S / ASiC-E

ETSI EN 319 162. A ZIP container bundling the documents with their XAdES or CAdES signature. Simple for one document, Extended for a manifest plus many.

Code

Authenticode

Windows PE files: .exe, .dll, .sys, .ocx, .cpl and .scr. SHA-256 by default, plus SHA-1, SHA-384 and SHA-512. Nested dual signatures keep legacy verifiers happy.

Code

ClickOnce

Sign .application and .manifest files so Windows clients install your app without a trust prompt.

Code

NuGet

Sign .nupkg packages so the NuGet client can validate publisher identity. Author and repository signatures are both supported.

Code

VSIX

Sign Visual Studio extension packages so the Marketplace and the IDE accept them as trusted.

  • Every document format:
  • B-B basic
  • B-T timestamp
  • B-LT long-term
  • B-LTA archival
  • Every code artifact:
  • SHA-256 default
  • RFC 3161 timestamp
  • Dual signing
  • Hash-only mode

Start at B-B and promote to B-LTA when the archive rules demand it. Code signing runs through sgcSign Server, so the private key lives in one place.

10 key providers

Local files, hardware tokens, cloud KMS.

Every provider implements the same IsgcKeyProvider interface, so a signer works with any key source without modification. Moving from a PFX file to AWS KMS means changing one component.

PFX / PKCS#12

  • TsgcPFXKeyProvider

Local password-protected key files. Native Windows CNG, no OpenSSL DLL required.

PEM Files

  • TsgcPEMKeyProvider

PEM certificates and encrypted PKCS#8 keys, with native PBES2 / PBKDF2 / AES-CBC decryption.

Windows Certificate Store

  • TsgcWindowsCertStoreProvider

Local machine and current user stores, straight into your Windows PKI and Active Directory setup.

PKCS#11 Hardware Tokens

  • TsgcPKCS11Provider

Smart cards and HSMs over the standard PKCS#11 interface, including SafeNet, YubiKey and Nitrokey.

Azure Trusted Signing

  • TsgcAzureTrustedSigningProvider

Microsoft's qualified signing service with OAuth2 client credentials. Private keys never leave Azure.

AWS KMS

  • TsgcAWSKMSKeyProvider

Keys stay in AWS Key Management Service. The document hash goes out, the raw signature comes back.

Google Cloud KMS

  • TsgcGCloudKMSKeyProvider

Service-account authentication against keys hosted in Google Cloud Key Management.

HashiCorp Vault

  • TsgcHashiCorpVaultKeyProvider

The Vault transit signing engine. Hashes travel over an authenticated REST API, keys stay inside Vault.

Certum SimplySign

  • TsgcCertumSimplySignProvider

Qualified Polish e-signature provider. Cloud remote signing for KSeF, ZUS and other public portals.

CSC v2

  • TsgcCSCKeyProvider

Generic Cloud Signature Consortium v2 client for remote QTSPs, including Universign, D-Trust sign-me, A-Trust, FNMT Cl@ve Firma, Evrotrust and Intesi Group.

Swap the provider, keep the signer. All ten providers in detail →

EU compliance

21 pre-configured country profiles.

Each profile pre-tunes hash algorithm, canonicalization, signature level, timestamp and OCSP revocation policy to match the target jurisdiction. Switching country is a one-line change.

E-invoicing profiles (12)

Browse →
  • Spain VeriFactu (AEAT)
  • Spain, Basque TicketBAI
  • Spain Facturae 3.x / FACe
  • Italy FatturaPA (SDI)
  • Portugal SAF-T PT
  • Poland KSeF
  • France / Germany Factur-X / ZUGFeRD
  • Romania e-Factura (ANAF)
  • Hungary NAV Online
  • Croatia Fiskalizacija
  • Belgium & Bulgaria Peppol UBL
  • Greece myDATA (AADE)

EU employment-contract profiles (9)

Browse →
  • Germany B-LT
  • Italy B-LT
  • Spain B-T
  • France B-T
  • Austria B-LT
  • Belgium B-LT
  • Portugal B-LT
  • Netherlands B-T
  • Poland B-T

Czech EET 2.0 sales registration ships as a component of its own, TsgcEETClient. EET 2.0 in detail →

Formats aligned with eIDAS

The profiles target the AdES or QES level each member state expects, with the hash, canonicalization, timestamp and revocation policy already set. Germany asks for a qualified signature under § 126a BGB, Spain accepts AdES for SEPE and TGSS, Poland routes through Profil Zaufany or a qualified certificate for ZUS. The profile encodes those differences, your code does not.

Validation and long-term proof

TsgcEUTrustList parses the ETSI TS 119 612 List of Trusted Lists and the per-member-state Trusted Lists, so any X.509 certificate can be classified against the live EU registry. TsgcTSAClient adds RFC 3161 timestamps that promote a signature to B-T, B-LT and B-LTA, and every verification emits a standardised ETSI TS 119 102-2 XML validation report.

Browse all 21 profiles →

sgcSign Server

Centralised signing for your build farm.

A self-hosted signing daemon with a REST API, a Bootstrap web admin and a Windows-service installer. Build agents ask for a signature, the key provider does the signing, and the key material never lands on a runner.

  1. BuildYour pipeline compiles the artifact on any agent, Windows or Linux.
  2. Request a signatureThe agent calls POST /api/v1/sign over TLS with a bearer API key and an X-Project header.
  3. HSM or KMS signsThe server reaches the configured key provider. Private keys stay in the HSM, in Azure, AWS, Google Cloud or Vault.
  4. Signed artifact returnsThe signed binary streams straight back to the agent, with signer subject and duration in the response headers.
  5. Timestamped and auditedAn RFC 3161 timestamp is applied and the operation lands in a SHA-256 hash-chained audit log, with Prometheus metrics and HMAC-signed webhooks.
Signing a large installer through sgcSign Server from its digest alone
Authenticode, ClickOnce, NuGet, VSIX, XAdES, PAdES and CAdES all share the same endpoint shape.
  • Windows service
  • Multi-tenant projects
  • Two-step approval

sgcSign Server overview →

Code

Sign a PDF, in process or over REST.

The same PAdES signature, produced two ways. Pick the component when the app signs, pick the server when the pipeline signs.

// PAdES with a visible signature and an RFC 3161 timestamp
var
  vKeyProvider: TsgcPFXKeyProvider;
  vSigner: TsgcPAdESSigner;
  vTSA: TsgcTSAClient;
begin
  vKeyProvider := TsgcPFXKeyProvider.Create(nil);
  vSigner := TsgcPAdESSigner.Create(nil);
  vTSA := TsgcTSAClient.Create(nil);
  try
    vKeyProvider.FileName := 'certificate.pfx';
    vKeyProvider.Password := 'secret';
    vKeyProvider.LoadFromFile;
    vTSA.URL := 'https://freetsa.org/tsr';
    vSigner.KeyProvider := vKeyProvider;
    vSigner.TSAClient := vTSA;
    vSigner.Reason := 'Approved';
    vSigner.Location := 'Madrid, Spain';
    vSigner.VisibleSignature.Enabled := True;
    vSigner.SignPDF('contract.pdf', 'contract-signed.pdf');
  finally
    vTSA.Free;
    vSigner.Free;
    vKeyProvider.Free;
  end;
end;
# PAdES-sign contract.pdf through sgcSign Server
curl -X POST https://sign.example.com/api/v1/sign/pades \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Project: production" \
  -F "file=@./contract.pdf" \
  -o contract-signed.pdf
# Headers returned by the server
# X-Sgcsign-Signer-Subject: CN=ACME Corp, O=ACME, C=US
# X-Sgcsign-Duration-Ms: 312

Read the quick start

Licences

Single, Team and Site.

sgcSign is licensed on its own, for Delphi 7 to RAD Studio 13 and C++ Builder. Every licence includes full source code, 1 year of updates, royalty-free deployment and a 70% renewal discount.

Single

1 developer licence. Use on one machine at a time.

€299

Team

2 developer licences. Use on two machines at a time.

€449

Site

Unlimited developers. All company machines.

€749

sgcSign for .NET has the same signature formats at the same prices, delivered as the esegece.sgcSign NuGet package, from €299.

Compare licences and prices
Testimonials

What Developers Say

Trusted by Delphi, C++ Builder, Lazarus and .NET developers around the world.

Thanks so much for your help and support. I love your components.
Mark Steinfeld CTO
sgcWebSockets is amazing and your support is the best!
Christian Meyer Founder & CTO
Your sgcWebSockets library is very useful and easy to setup. Keep up the good work!
Simone Moretti Delphi Developer

Ship eIDAS-compliant signatures today.

Add XAdES, PAdES, CAdES and ASiC signing to your Delphi, C++ Builder or .NET application, or stand up a centralised signing service for your build farm.

Download the trial View pricing

Quick startFeaturesKey providersCountry profilessgcSign ServerComparison

More From eSeGeCe

Other Products by eSeGeCe

sgcSign is one of the eSeGeCe component libraries for Delphi, C++ Builder and .NET. They share conventions, they ship with full source, and they deploy royalty-free.

sgcWebSockets

WebSocket, HTTP/2, MQTT, AMQP, WebRTC, AI and 30+ API integrations. Sign WebSocket and MQTT payloads with the same signing engine.

sgcPDF

Create, edit, view, sign, redact and validate PDF files in pure Object Pascal, with no DLL to deploy. Licensed on its own.

sgcHTML

Server-side HTML and UI components built on Bootstrap 5 and htmx. Give a signing workflow a web front end without a JavaScript stack to maintain.

sgcQUIC

Raw QUIC transport and an HTTP/3 client and server, with WebTransport. Submit signature and timestamp requests over HTTP/3 for faster handshakes.

sgcAI

AI, LLM and MCP components for Delphi and C++ Builder. Seven LLM providers behind one component, plus MCP, embeddings and speech. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcMQ

MQTT, AMQP 0.9.1 and 1.0, Apache Kafka and STOMP client components for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcAuth

OAuth2 client, JWT client and WebAuthn support for Delphi and C++ Builder. Sign in with any OAuth2/OIDC provider, issue and verify JWTs, and add passkey authentication to native apps.

sgcHTTP

HTTP server, HTTP/2 client, gRPC client and Google Cloud Pub/Sub, Calendar and FCM clients for Delphi and C++ Builder. Standalone, with the sgcWebSockets Core runtime bundled in.

sgcREST

REST server, OpenAPI server and OpenAPI client components. Publish REST APIs from an OpenAPI 3.x contract, or consume any OpenAPI-described API.

sgcOpenAPI

OpenAPI 3.x parser, Pascal SDK generator and OpenAPI server, plus 1,195+ pre-built SDKs for AWS, Azure, Google Cloud and Microsoft Graph.

sgcBiometrics

Windows Hello, fingerprint sensors and the Windows Biometric Framework. Unlock a signing key with a fingerprint before the signer runs.

sgcIndy

Updated Indy TCP/IP components with modern TLS, IPv6 and HTTP/2 for Delphi 7 through 13. Trusted transport to TSAs, OCSP responders and EU verifiers.

sgcCrypto

General-purpose cryptography library for Delphi and C++ Builder: symmetric and asymmetric ciphers, hashing and post-quantum algorithms. Ships free from sgcWebSockets Standard up.

sgcSocial

WhatsApp Business Cloud API and Telegram TDLib clients. Standalone, the sgcWebSockets Core runtime is included.

Latest from the blog

· Components

Passkeys in Delphi: Passwordless Login With WebAuthn
· Releases

sgcWebSockets 2026.10
· Components

SAML Single Sign-On in Delphi With Entra ID, Okta and AD FS

View all posts →

You are seeing the sgcSign view of eSeGeCe.

Show me another angle →
30-Day Money-Back GuaranteeNot satisfied? Request a full refund within 30 days of purchase. See refund policy