Is a signature without a token as secure?

Yes. The key is generated and kept in a certified HSM, never leaves the device, and every signature requires your two-factor authentication. A USB token can be lost or stolen together with its PIN; a cloud key cannot.

Does it work at ANAF and REGES without a token?

Yes, through Simplifi Sign, the Windows and macOS app that exposes the cloud certificate as a virtual token. SPV and REGES authentication with the certificate is part of the paid plans, from €1/month.

Can I sign from my phone?

Yes, in the browser, any PDF. Simplifi Sign (virtual token) is for Windows and macOS, for portals requiring a local certificate.

What if I change my phone or computer?

Nothing to reinstall or transfer: the certificate is in the cloud. Sign in to your account from the new device and, if needed, install Simplifi Sign again.

No token

Electronic signature without a token: how cloud qualified signing works

A qualified electronic signature without a token keeps the private key on a qualified device (QSCD) at the provider instead of a USB stick. You sign in the browser from any device, authorising with your phone; where a portal requires a “local” certificate (SPV ANAF, REGES, Adobe Reader), the Simplifi Sign app exposes the cloud certificate as a virtual token on Windows and macOS. It has the same legal value (eIDAS, Art. 25(2)), and at Simplifi the certificate is free.

Same legal value: a qualified signature, whether the key is on a token or in the cloud
Sign in the browser on phone, tablet or computer, no driver, nothing to install
Simplifi Sign (Windows, macOS): the certificate appears in the system like a token, for SPV, REGES, Adobe
Nothing to lose, break or ship by courier
Simplifi: certificate €0 and 5 signatures per year free; portal authentication on paid plans (from €1/month)

Start now, free

How it works without a token

eIDAS requires a qualified signature to be created with a qualified signature creation device (QSCD). A USB token is such a device, but so is a certified hardware security module (HSM) operated by the provider. The Regulation explicitly allows the device to be managed by a qualified provider on the signatory's behalf, provided the signatory keeps sole control of the key (eIDAS, Art. 29 and Annex II, points 3-4).

Sole control is ensured by two-factor authentication on every signature: your account password plus confirmation on your phone. Nobody, not even the provider, can sign in your place.

eIDAS, Art. 29, Annex II points 3-4; Law 214/2024

Where browser signing works

Anywhere you have to submit a signed PDF: ONRC, MySMIS2021, Start-Up Nation, PNRR, courts, partner contracts, HR documents. Upload the PDF, sign, download, send or upload to the portal. The signature shows as valid (green tick) in Adobe Reader and eIDAS validators.

Where you need Simplifi Sign

Some portals do not accept signed PDFs; they require the certificate to be visible in the browser or in an application, for authentication or for signing a smart form: SPV ANAF, REGES-ONLINE, CNAS, AFIR/PNRR smart forms in Adobe Reader, SEAP/SICAP. For these you install Simplifi Sign on Windows or macOS: the app registers your certificate in the system certificate store, and the browser and Adobe see it as a local, token-based certificate. You confirm each use on your phone. Local signing (Adobe Reader, smart PDFs, .p7s) is included in the free plan; certificate authentication in portals (SPV, REGES, AFM) is available on paid plans, from Personal (€1/month billed annually).

This is exactly the setup some comparison tables describe as “cloud not accepted at REGES/SEAP”. The statement holds only for browser-only signing; with a virtual token, the cloud certificate works there like any other.

Cloud vs. USB token, in short

Legal value: identical (both are QES)
Devices: cloud on any device with a browser; token only on the computer with the driver installed
Loss/damage: nothing to lose in the cloud; a token must be replaced (€16-18 plus a new certificate)
Portals requiring a local certificate: cloud through Simplifi Sign (Windows, macOS); token natively
Price: Simplifi €0 (signing) or €12/year (with portal authentication); tokens at other providers €29.90-47/year

Frequently asked questions

Is a signature without a token as secure?: Yes. The key is generated and kept in a certified HSM, never leaves the device, and every signature requires your two-factor authentication. A USB token can be lost or stolen together with its PIN; a cloud key cannot.
Does it work at ANAF and REGES without a token?: Yes, through Simplifi Sign, the Windows and macOS app that exposes the cloud certificate as a virtual token. SPV and REGES authentication with the certificate is part of the paid plans, from €1/month.
Can I sign from my phone?: Yes, in the browser, any PDF. Simplifi Sign (virtual token) is for Windows and macOS, for portals requiring a local certificate.
What if I change my phone or computer?: Nothing to reinstall or transfer: the certificate is in the cloud. Sign in to your account from the new device and, if needed, install Simplifi Sign again.

Qualified signature, no token

Free cloud certificate, browser signing, Simplifi Sign for Adobe and portals. SPV/REGES authentication from €1/month.