Certification authorities · Signature · Machine identity
Your keys.
Your territory.
Your authority.
A state’s root authority, a bank’s internal PKI, or the TLS estate holding your services up: one discipline at three scales. You keep control of the keys. We answer for the result in production.
A technical conversation, not a product demo.
eIDAS Qualified Trust Service Provider
Qualified status under Regulation (EU) No 910/2014
Engagements across 7 countries
Tunisia · Chad · Mauritania · Benin · Togo · Burkina Faso · Libya
Nobody loses control of their keys all at once
It starts with a certificate renewed by hand. Then an estate nobody inventories. Then a root authority whose secrets live with a vendor, under its licence terms and its end-of-support calendar. The day the evidence is challenged, or the day the service stops, it is too late to take back control.
What it costs
- A certificate lapses. The service stops, mid-business-day.
- A signature is challenged. The file reopens, and the burden of proof sits with you.
- An audit asks for the key ceremony. With no record, there is nothing to show.
Most of your estate isn’t where you’re looking
Control of the keys, traceability, continuity: the requirements don’t change from one scale to the next. What changes is what you lose when they give way.
States, regulators, certification authorities
National and sovereign PKI
A root authority operated in your name, on your territory, carrying the evidentiary weight the law grants it, not the weight a foreign vendor is willing to concede.
- Offline root authority and a hierarchy of intermediate authorities
- Certificate policy and certification practice statement
- Digital identity for citizens and public officials
- Digital public procurement and electronic invoicing
- Skills transfer to national teams
Banks, insurers, telecoms, energy, healthcare, industry
Enterprise PKI
An internal authority for your people, your applications and your devices. Your internal uses stop depending on a public authority’s calendar.
- An internal authority for the uses that need not be public
- Employee certificates, smart cards and strong authentication
- Signing and sealing of business and document flows
- Device, IoT and industrial certificates
- A clean separation between internal and public trust
CIOs, CISOs, platform and operations teams
SSL/TLS and machine identity PKI
The largest estate, the least inventoried, and the leading cause of avoidable outages. It gives no warning before it goes down.
- Discovery and inventory of the existing certificate estate
- A private authority for internal TLS, public for what is exposed
- Automated renewal (ACME) and CI/CD integration
- Expiry monitoring and alerting before an incident
- Workload identity: containers, services, APIs
We don’t only integrate. We build.
Three products built in-house, proven in production, deployable on your infrastructure or ours. When a fix is urgent, it doesn’t wait on a third party’s calendar.
Electronic signature and server sealing
NGSIGN
Qualified electronic signature and server sealing. A web application for your teams, an API for your systems. The first web-based electronic signature platform in Africa, homologated by ANCE and certified as an eIDAS Qualified Trust Service Provider.
Visible electronic stamp
QRSecure
The visible electronic stamp: a signed 2D barcode printed on the document itself. It is checked by scanner, on paper as on screen, offline and with no access to the issuing system. Built to 2D-DOC and ISO 22376:2023.
Public key infrastructure
Remote Trust PKI
Your own certification authority, from the offline root through to certificate issuance at scale. The infrastructure stays on your territory.
Building and running your certification authority
From scoping study to key ceremony and on into day-to-day operations. The method is the same for a national authority and for a large group’s internal PKI. Only the regulatory perimeter and the scale differ.
How we work
Four steps, and nothing unplanned between them
- 01
Scoping
Policy and architecture
The document that governs everything else: certificate policy, practice statement, authority hierarchy. We write it before anything is bought.
- 02
Foundation
Infrastructure and HSM
Offline root, intermediate authorities and hardware security modules, on your territory or in your own data centres.
- 03
Ceremony
Key generation
Conducted, recorded and documented, before the secret holders and appointed witnesses. This is the record your auditor will ask for.
- 04
Operations
Issuance and oversight
Enrolment, issuance, revocation, CRL and OCSP, monitoring, then the handover of skills to your teams.
The expensive mistake is building the wrong PKI
A certification authority is operated for a decade. What you settle at scoping (hierarchy, certification level, platform) you carry for all of it. We come in before that, and we train the people who will hold the infrastructure afterwards.
Advisory
We work the decision before it costs anything: what the regulatory framework requires of you, what your existing estate already imposes, and what your teams will still be able to operate in five years.
- Scoping study and authority architecture
- Certificate policy and certification practice statement
- Platform and HSM selection, with no vendor tie
- Inventory and audit of the existing certificate estate
- Preparation for homologation and compliance audit
Training
A PKI your teams cannot operate is a PKI you are renting from someone. We train the people who will hold it, through to full handover.
- PKI and electronic signature fundamentals
- Day-to-day operation of a certification authority
- Key ceremony: roles, secret holders, written record
- Separate sessions for technical teams and for decision-makers
- Skills transfer at the end of a programme
The facts, and where to check them
National programmes
Tunisia
NGSIGN homologated by the National Electronic Certification Agency (ANCE) and certified as an eIDAS Qualified Trust Service Provider.
Chad
PKI and electronic signature training and awareness workshop, run with ANSICE.
Mauritania
Awareness and training workshop on PKI and electronic trust services.
Benin
Deployment of the NGSIGN electronic signature platform at the Port Autonome de Cotonou (PAC).
Togo
Hosted a Togolese delegation on a study mission covering the digitalisation of public procurement.
Burkina Faso
NG Technologies’ first partnership convention in sub-Saharan Africa.
Libya
Strategic partnership with Ebkar to bring digital trust services and PKI to the Libyan market, in line with Law No. 6 of 2022.
Large organisations
Banks, insurers, operators and public bodies run our products in production. These are the organisations whose certificate volumes and continuity requirements justify a dedicated infrastructure.
- Banking
- Insurance and reinsurance
- Telecoms
- Energy and hydrocarbons
- Public health
- Government and agencies
- Ports and logistics
- Registries and public procurement
- Fintech
No vendor agreement steers our recommendation
We are tied to no vendor. The platform we recommend follows from the programme’s constraints: sovereignty, certification level, existing estate, cost of operation. We stay accountable for the result in production whichever product is chosen. The choice follows the requirement, never the other way round.
Standards we build to
The standards that make evidence hold up.
- eIDAS (UE) n° 910/2014
- ETSI EN 319 411-1 / 411-2
- ETSI EN 319 421 / 319 422
- ETSI EN 319 142 (PAdES)
- X.509 · RFC 5280
- Common Criteria (HSM)
Let’s talk about your programme before we talk about product.
Tell us the regulatory framework and the scale you’re aiming at. We’ll tell you what actually needs building, including if it turns out to be less than you thought.