CEI One
RODownload

Docs · Reference

Privacy and security

What CEI One keeps on your iPhone and Mac, what it never keeps, and the only times the app uses the internet.

Available on: iPhoneMacUpdated

All pages
On this page

CEI One works locally: reading your eID, preparing PDFs and signing on the card all happen on your iPhone or Mac. This page sums up what stays on your device and when the app connects to the internet. The full text is in the Privacy Policy and on the Security and local control page.

In short

  • You don’t need an account.
  • The CEI One apps don’t use any servers of their own. Your documents, your eID data and your codes never reach us.
  • The apps contain no analytics, advertising or trackers.
  • The private key stays on the eID. The app only receives the result of the signing.

Your codes

  • PINs (the data PIN and the signing PIN) are used only in the current session and are never saved.
  • The CAN is used only in the current session and isn’t kept, unless you choose to remember it.

You can remember a card’s CAN after a successful read. It stays in the Keychain, only on that iPhone or Mac, isn’t synced, and is read only after Face ID, Touch ID, Optic ID, your passcode or your Mac password. Details in App lock and remembered CAN.

The data read from your eID

  • The data, photo and handwritten signature read from the eID stay only in the app’s memory and are never written to disk: on iPhone while you’re on the result screen, on Mac until you quit the app.
  • They reach the library only if you save an identity report or a proof of address.
  • Data authenticity is checked on your device, without internet access: the issuer-signed data on the card (EF.SOD) is verified against Romania’s CSCA certificates included in the app.

Your documents

On iPhone:

  • Signed PDFs are saved automatically to Local history. Scans, reports and verified PDFs are kept only if you choose to save them.
  • Library files are written with iOS Complete Data Protection: they can be read only while your iPhone is unlocked.
  • When you open a PDF from another app, CEI One copies it into a protected workspace. The original file isn’t changed.
  • When the app goes to the background, its screen is covered by a screen with the CEI One logo. This way, your data isn’t visible in the app switcher.

On Mac:

  • The signed copy and the analyzed PDFs reach Documents only if you check Save a copy to the local library. This option is off by default.
  • Library files are saved with 0600 permissions, which means only your user account can read them.
  • PINs, APDUs and session keys aren’t written to logs.

On iPhone and Mac:

  • The library is excluded from device backups. Without iCloud sync, your documents aren’t restored on a new device.
  • Nothing is deleted automatically. Retention rules apply only after you confirm them.
  • A document deleted without a copy in iCloud is deleted permanently. The library has no trash.

Tip

If you want to keep your documents when you change your phone or Mac, turn on iCloud sync or export the important documents. See iCloud sync.

When the app uses the internet

CEI One connects to the internet only in these situations:

  1. The timestamp, when signing. The app requests a timestamp from DigiCert. Only if DigiCert doesn’t respond correctly does it try GlobalSign, and then Sectigo. The authority receives only the cryptographic fingerprint (hash) of the signature, not the PDF.
  2. The validation evidence, when signing. Before it uses the card, the app downloads the certificate revocation lists (CRLs) and the issuer certificates for your certificate’s chain. After the timestamp, it does the same for the timestamp service’s chain. The evidence is included in the PDF as PAdES-LT evidence.
  3. Online signature verification, only when you ask for it. When you verify a PDF in Verify signature or Analyze PDF, when you open the signatures of a document that has no saved result, or when you choose Verify again. The app contacts the addresses named in the document’s certificates.
  4. iCloud sync, only if you turn it on.
  5. The support and privacy pages, only on Mac and only if you open them from Settings.

Reading your eID doesn’t use the internet. The automatic verification of documents in Local history is also done offline, using only the data in the document.

Note

Without internet access you can’t complete a signature: the timestamp and the validation evidence are required. If they can’t be obtained, the signed PDF isn’t saved.

The servers the app contacts see your IP address and, for OCSP, the identifier of the certificate being checked. Details in the Privacy Policy.

iCloud sync

Sync is off by default. If you turn it on, eligible PDFs and their metadata are stored in the private CloudKit database of your Apple Account. The CAN, PINs, identity data, identity reports and proofs of address are never synced. Details in iCloud sync.

App lock

You can lock CEI One with Face ID, Touch ID, Optic ID, your passcode or your Mac password. The app doesn’t receive or store any biometric data, only the result of the check. See App lock and remembered CAN.

Where to find this information in the app

  • On iPhone: Settings › App › Privacy sums up what stays on the device, the external services and the iCloud status.
  • On Mac: Settings › Privacy sums up how your data is handled and has a link to the Privacy Policy.

See also