Answers before you ask.

Class 3 DSC USB tokens exposed through standard PKCS#11 — including ePass2003 / ProxKey-style tokens used by Indian certifying authorities. Sealixa logs into the token, signs, and logs out; it never caches the PIN.

No — unless you choose to send. Signing itself is fully offline: documents, anchor decisions, and signatures never leave your computer, and there is no account, cloud, or telemetry. The only way anything leaves the machine is if you opt in to the confidence-email feature, which sends the director's report and signed documents from the firm's own mail account, through the firm's own SMTP settings. That one feature is turned off by default.

A per-signatory confidence report lists, from the audit trail, every document and page on which that person's DSC certificate was used, when, whether each signature verified, and the source SHA-256. The report can be exported as a package with the signed PDFs, or emailed to the director from the firm's own mailbox. Share it — it is proof, not marketing.

UDIN is optional, not mandatory. You generate the UDIN on the ICAI/ICSI portal as and when your firm requires it; Sealixa stores and associates that UDIN against each signature in the audit trail, and rolls UDIN counts up per client for billing. If your firm enforces UDIN on every sign-off, a setting in the app can make it a requirement before the audit is exported — off by default, always your choice. Sealixa never generates a UDIN; that step stays on the sanctioned portal.

No. Sealixa never sees a document, a signature, an email, or an SMTP credential. If you enable confidence emails, they are sent by your own mail account via your own SMTP settings stored on your machine; the app merely composes and sends them on your behalf.

Sealixa uses your empaneled Class 3 DSC to apply PAdES signatures accepted by MCA-21, and produces the audit trail to support Evidence Act digital signature provisions. Sealixa places and cryptographically verifies signatures; it does not and cannot assert legal validity of any filing — that judgement stays with you and your counsel.

No. You tell Sealixa a signatory's name and page range; it analyzes the actual document to find the signature block. No templates to maintain when the annexure order changes.

Yes — with one honest caveat about quality. For a scanned PDF (an image of a printed page), OCR recovers the text layer so the anchor engine can find signature blocks. It runs only on pages that have no text at all; typed documents are never OCR'd. The catch is that OCR depends on the scan itself: low resolution, blur, faint print, or a signature block already covered by wet ink can make words unreliable. Sealixa flags pages where a block cannot be confidently recovered, and every placement is still shown on the rendered page for your visual confirmation in Step 3 before anything is signed. Treat OCR as a recovery aid, not a guarantee: for documents where the signature area must be verified byte-for-byte, use a clean digital copy.

No. The PIN is passed to the token, used, and never written to disk, logs, or audit files. Private keys stay inside the token at all times.

Windows desktop, the PKCS#11 driver for your Class 3 DSC token, and your empaneled certificate. No internet connection is required or used during signing.

Every activation code is cryptographically signed with Sealixa's private key and verified offline against the public key embedded in the application — then bound to your machine's hardware identity. Nothing ever phones home: the air-gap stays absolute while the license stays enforceable. Because the signing key never ships in the app, even full access to the application binary cannot mint a license; codes come only from us.

Licenses are bound to one physical machine (never to your network), so a move to a new computer needs a new binding — and only we can issue it, contact sales with the machine ID from the License screen. We re-issue your code for the new machine with the remaining validity intact; the swap never extends the license or costs extra seats. Because validation is fully offline there is no remote revocation, so please delete or reinstall Sealixa on the old machine after moving.