> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/architecture-overview.md).

# Architecture Overview

eMudhra's signing services share a common trust core — the eMudhra Certifying Authority, FIPS 140-3 Level 3 HSMs, timestamping and audit — exposed to applications through product-specific gateways.

## High-level architecture

```
 ┌───────────────────────────── Application Service Provider (ASP) ─────────────────────────────┐
 │  Web app  │  Mobile app (+ eMudhra SDK)  │  Back-office / batch systems  │  Relying-party portal │
 └─────┬─────────────────┬──────────────────────────────┬──────────────────────────────┬────────┘
       │ eSign v2 / v3   │ eSign v2 / v3 / Remote KS    │ Remote Signing API           │ Validation API
       ▼                 ▼                              ▼                              ▼
 ┌──────────────────────────────────────── eMudhra Trust Services ──────────────────────────────┐
 │  eSign Gateway (ESP)        Key Management Server (KMS)     Document Signer Service   DSV     │
 │  • ASP auth & XML verify    • Enrolment, AuthPIN flow       • Org certificate profiles Engine │
 │  • Consent & UI pages       • Session token handling        • Hash / PDF signing              │
 │  • eKYC orchestration                                                                         │
 ├──────────────────────────────────────────────────────────────────────────────────────────────┤
 │  eKYC layer:  UIDAI online eKYC (v2)   │   CA eKYC account store (v3, Remote KS)              │
 ├──────────────────────────────────────────────────────────────────────────────────────────────┤
 │  eMudhra CA (eKYC class & Document Signer)  │  TSA (RFC 3161)  │  OCSP / CRL                   │
 ├──────────────────────────────────────────────────────────────────────────────────────────────┤
 │  HSM cluster (FIPS 140-3 L3): one-time keys │ SAM + stored subscriber keys │ org signer keys   │
 ├──────────────────────────────────────────────────────────────────────────────────────────────┤
 │  Audit & evidence store (Form C, transaction logs, 7-year retention)  — DC/DR in India        │
 └──────────────────────────────────────────────────────────────────────────────────────────────┘
```

## Core components

| Component                   | Responsibility                                                                                                                                                                                                                                        |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **eSign Gateway (ESP)**     | Receives signed request XML from ASPs, validates the ASP and its signature, logs the transaction, renders consent and authentication pages, orchestrates eKYC, key generation, certificate issuance and signing, and returns the signed response XML. |
| **eKYC layer**              | For v2, connects to UIDAI as an AUA/KUA for online authentication. For v3 and Remote Key Storage, uses eMudhra's CA eKYC account store (offline Aadhaar, PAN, bank, organisational KYC).                                                              |
| **Certifying Authority**    | Issues eKYC class one-time DSCs, long-term DSCs for Remote Key Storage and organisational Document Signer certificates. The CA's eKYC class systems are segregated from other DSC classes.                                                            |
| **HSM cluster**             | Generates and uses keys. One-time keys are destroyed after use; long-term subscriber keys are stored HSM-wrapped and are never exported in clear.                                                                                                     |
| **KMS & SAM**               | For Remote Key Storage: the Key Management Server handles enrolment and signing orchestration; the Subscriber Authentication Module inside the HSM boundary verifies AuthPINs and issues session tokens.                                              |
| **Document Signer Service** | Signs hashes or PDFs automatically with an organisation's certificate, with policy controls, templates and timestamping.                                                                                                                              |
| **Validation (DSV) engine** | Verifies signatures, chains, revocation status and timestamps for PDF, XML and CMS data.                                                                                                                                                              |
| **TSA / OCSP / CRL**        | Trusted timestamping and revocation services used for LTV-enabled signatures.                                                                                                                                                                         |
| **Audit & evidence store**  | Immutable transaction logs, signed Form C records and audit events retained for at least 7 years.                                                                                                                                                     |

## Request lifecycle (common pattern)

1. The ASP computes the **SHA-256 hash** of each document locally.
2. The ASP builds a request XML, **signs it** with its ASP certificate and sends it to the eMudhra endpoint.
3. eMudhra **validates** the ASP, the XML signature, timestamp (±30 minutes) and transaction uniqueness.
4. The signer **authenticates** (Aadhaar factor, PIN + second factor, or AuthPIN) and **consents**.
5. eMudhra **generates or unlocks** the key in the HSM, obtains/uses the certificate and **signs the hash**.
6. eMudhra returns a **signed response XML** with the signature(s) and the signer certificate.
7. The ASP **embeds** the signature into the document (PDF, XML or detached CMS) and stores `txn` and `resCode`.

## Deployment and availability

* Primary and disaster-recovery data centres located in India, ISO 27001 certified.
* Active-active gateways with HSM clustering and failover; capacity sized above the CCA minimum of 1,000 external eSign transactions per minute.
* Separate **pre-production (UAT)** and **production** environments; ASPs receive separate `aspId` and certificates for each.
* Remote Signing and Validation are also available for on-premises or private-cloud deployment for customers with data-residency requirements.

{% hint style="info" %}
Endpoint URLs, IP allow-lists and environment credentials are shared during ASP onboarding. See [Onboarding as an ASP](/documentation/onboarding-as-an-asp.md).
{% endhint %}