STaaS signing workflow overview
Keyless signing

Signing and Transparency as a Service

STaaS is an open-source service from ExcID for signing data with your login, recording signing events in a transparency registry, and verifying using open-source tools. All operations can be easily integrated and automated using our REST API.

Try it out GitHub
Privacy-first STaaS never learns the contents of your file.
No key custody Sign without managing private signing keys.
Verifiable Trace signatures and detect suspicious activity.

Sign quickly

Use the Web UI or REST API to sign binaries, documents, images, and other release artifacts.

Track every signature

Record signature information in a public transparency registry for later inspection and verification.

Deploy your way

Start with the hosted service, integrate with CI/CD, or run STaaS on premises with Docker Compose.

How it works

A short, auditable path from file to signature.

STaaS combines short-lived certificates with public transparency logging, so each signature can be traced without exposing your file contents.

1

Choose a file

Log in and select a file to sign. STaaS never learns the contents of the file.

2

Sign

STaaS generates an one-time used key pair and a short-lived certificate bound to your email address using an ExcID-hosted Fulcio CA.

3

Track

Signature information is immutably recorded in the Rekor public transparency registry.

4

Verify

Generated signatures can be verified with the Cosign utility.

Build STaaS into your workflow

Learn how to use the REST API from your CI/CD system, verify signatures, and deploy STaaS on premises.

Read the documentation