Multi-Tenant PKI + eSignature Platform, by nNur Technologies

The trust infrastructure behind every certificate, signature, and seal.

nPKI unifies Root and Sub CA governance, multi-tenant certificate lifecycle automation, regulated eSign workflows, public verification, and evidence-first compliance — so you can launch trust services without stitching six vendors together.

Request a demo Explore the platform
Built for regulators, banks, national CAs, and enterprise trust teams
Deployment readyRoot, Sub CA & tenant operating modes, live today
eSign readyBasic & Advance assurance signing workflows
Audit readySealed evidence packs and public verification
Purpose-built for regulated trust operations across
National & government PKI Banking & financial services Regulated enterprise Sub CA operators Relying-party integrators
Platform coverage

One platform for governed PKI, eSign, and trust operations.

nPKI is built around tenant isolation, policy-controlled certificate workflows, strong operator controls, public validation, and evidence you can hand to a regulator without a scramble.

Root CA governance

Offline-root aligned workflows for root status, generation or import, renewal, root-signed intermediate handoff, package integrity, and readiness evidence.

Multi-tenant operations

Root Authority, Sub CA Tenant, and Platform Admin modes with tenant switching, scoped roles, route guards, and tenant-bound CA settings.

Certificate lifecycle

CSR intake, profile policy, approval, issuance, renewal lineage, revocation, CRL publication, OCSP posture, and public certificate status.

Signing services

Signing profiles, prepared signing sessions, RFC 3161 timestamp tokens, document containers, consent gates, and execution audit evidence.

HSM & key custody

PKCS#11 and SoftHSM provider abstraction, metadata-only HSM inventory, signing-key catalog, custody evidence, and a production fail-closed posture.

RBAC, MFA & quorum

Operator sessions, MFA step-up, tenant roles, critical-operation authorization, and multi-officer controls for sensitive workflows.

Public repository

CRL URLs, issuer and chain downloads, trust-bundle manifests, a public verifier, repository freshness, and publication controls.

API-first integration

REST surfaces for enrollment, issuance, revocation, signing, callbacks, validation, audit, operations reports, and observability.

eSign and e-Signature

From identity proofing to a verifiable signed document.

nPKI covers the full regulated eSign journey in one flow: subscriber enrollment, KYC evidence, authorization devices, consent, document signing, package quotas, callbacks, and public verification — no separate signing vendor to reconcile against.

Basic eSign Advance eSign OTP + PIN Mobile secure-element path PAdES Baseline-B readiness WYSIWYS evidence

Subscriber enrollment

Enrollment, NID or selfie-style KYC evidence, biometric non-retention posture, secondary review, subscriber profile, and device lifecycle controls.

Per-signature authorization

OTP or PIN challenges, replay resistance, device freshness, lost or replaced device handling, and subscriber-bound authorization evidence.

Document signing

Signing requests bind the exact payload hash to consent, authorization, signing profile policy, result retrieval, and callback delivery.

Packages and quotas

Tenant eSign packages, subscriber subscriptions, quota consumption, renewals, manual adjustments, fee schedule import, and usage evidence exports.

Operating model

Root authority oversight with isolated Sub CA execution.

Each tenant carries its own authority posture, policies, operator access, CA bindings, reports, support cases, and release evidence — while nPKI preserves central governance above it.

Root Authority

Core

Controls trust anchors and intermediate handoff packages without turning the online app into the unrestricted root-key holder.

Root readiness, custody, renewal, and ceremony evidence Root-signed intermediate issuance and export Tenant bootstrap and handoff import audit trails

Sub CA Tenant

Core

Runs tenant-scoped certificate, subscriber, eSign, reporting, support, and validation operations under isolated policy.

Tenant CA settings and health posture Certificate profiles, signing profiles, and officers Operations reports, regulator packs, and SLA dashboards

Platform Admin

Scale

Supports shared governance, release evidence, observability, security assurance, maintenance, and production-readiness activities.

Observability summaries and recovery drill acceptance Security, durability, retention, and audit baselines Production deployment and HA operations
Assurance and evidence

Compliance is designed into the workflow, not bolted on at the end.

nPKI records the who, what, policy, evidence references, and integrity digests needed to reconstruct regulated trust operations across CA, enrollment, signing, revocation, and support workflows.

Audit and evidence packs

Normalized audit events, correlation export, SHA-256 manifests, audit sealing, SIEM-ready export, and signed evidence-pack seal envelopes.

Regulator readiness

Sub CA operations reports, regulator evidence packs, release acceptance matrices, pack validation, and external-acceptance posture tracking.

Public verification

Certificate PEM checks, signature-package checks, document-container verification, PAdES verifier posture, trust bundles, and CRL/OCSP freshness metadata.

Retention and durability

Retention policy classes, legal hold, purge-decision manifests, backup manifests, restore drills, DR runbook acceptance, and continuity checks.

Security hardening

TLS/mTLS evidence, secret-manager posture, WAF/network zone evidence, VAPT tracking, external audit preparation, and remediation records.

Operational observability

Health probes, dashboard metrics, callback queues, signing/KYC counters, CRL freshness alerts, HSM posture, and recovery drills.

Why nPKI

Skip the multi-vendor trust stack.

Most teams end up assembling a CA product, a separate eSign vendor, and a homegrown audit layer to satisfy a regulator. nPKI ships all three as one governed system.

What you need
Build in-house
Stitched point solutions
nPKI
Time to a working Root/Sub CA hierarchy
Months of PKI engineering
Weeks, plus vendor onboarding
Available now, tenant-ready
Unified PKI + eSign in one data model
You build the bridge yourself
Two systems to reconcile
Native, single platform
Tenant isolation for Sub CAs or resellers
Custom multi-tenancy work
Rarely supported natively
Built-in operating modes
Regulator-ready evidence packs
Assembled manually, every cycle
Fragmented across vendors
Sealed manifests, generated in-flow
HSM custody with fail-closed policy
Depends on your team's rigor
Vendor-dependent
PKCS#11/SoftHSM abstraction, no key export
Use cases

Coverage for national, financial, and enterprise trust services.

nPKI serves classic certificate authority operations as well as customer-facing eSignature services and relying-application integrations.

Government and national PKI

Sovereign Root/Sub CA governance, public-service identities, regulator evidence, public repositories, and audit-ready trust operations.

Banking and regulated enterprise

Employee, branch, application, device, VPN, TLS, S/MIME, signing, and operational certificate services with tenant-scoped controls.

Relying applications

Client onboarding, signed application requests, domain and callback policy, result retrieval, delivery receipts, retry, reconciliation, and replay controls.

Remote document signing

Document upload, payload-hash binding, WYSIWYS consent, OTP/PIN or secure-device authorization, PAdES readiness, and public verification.

Machine and device identity

Policy-bound certificates for services, infrastructure, devices, IoT, and automated certificate lifecycle operations.

Sub CA operations

Tenant dashboards, support exceptions, SLA posture, operations exports, maintenance actions, CRL publication, and release acceptance evidence.

Deployment readiness

Ready for deployment, with a clear path for continued expansion.

nPKI already brings the core product capabilities needed for a PKI and eSign rollout. Deploy with your selected production integrations, then expand through operational tuning, additional assurance channels, and regulator-specific evidence packages.

Available now

Multi-tenant PKI control plane

Root Authority, Sub CA Tenant, and Platform Admin modes with certificate lifecycle, Root/Sub CA handoff, tenant-bound CA settings, officer roles, MFA step-up, audit, and public repository support.

Available now

eSign and relying-application workflows

Basic and Advance eSign policy support, subscriber enrollment, OTP/PIN authorization, WYSIWYS consent evidence, packages and quotas, signed requests, callbacks, result retrieval, and public verification.

Deployment

Production integration package

Connect your chosen KYC provider, HSM, PAdES signer/verifier, timestamping service, object storage, secret manager, queue, SIEM, and deployment environment for the target operating model.

Operations

Runbook-backed operation

Operate with CRL/OCSP freshness, recovery drills, backup and restore evidence, support exception tracking, security hardening baselines, retention controls, and regulator evidence exports.

Expansion

Configurable growth after go-live

Add more tenants, refine CPS and profile policy packs, extend customer portal experiences, tune authorization channels, and scale infrastructure as adoption grows.

Assurance

Compliance and external acceptance

Support VAPT, external audit, release acceptance matrices, signed evidence packs, retention validation, disaster recovery proof, and regulator-facing submission packages.

Frequently asked

Questions we hear before a first demo.

Can nPKI be deployed on-premises or in a private cloud?+
Yes. nPKI is designed for regulated environments that require control over where key material and evidence live. It runs against your chosen HSM (PKCS#11 or SoftHSM), object storage, secret manager, and deployment environment, so it fits on-prem, private cloud, or a hybrid setup.
What does a typical rollout timeline look like?+
The core PKI control plane and eSign workflows are available now. A rollout is mostly a production integration phase — wiring in your KYC provider, HSM, PAdES signer, timestamp authority, and SIEM — followed by runbook-backed operations. Timelines depend on which integrations you bring; we'll scope this in a demo.
Does nPKI support multiple Sub CAs or a reseller model?+
Yes. The Root Authority, Sub CA Tenant, and Platform Admin operating modes give each tenant isolated policy, roles, CA bindings, and reporting, while your Root Authority keeps central governance over intermediate handoff and trust-anchor custody.
How does nPKI handle key custody and HSMs?+
nPKI abstracts PKCS#11 and SoftHSM providers behind a managed signing-key catalog and multi-officer ceremony gates. Production deployments run under a fail-closed policy for unsafe software custody, and the platform never exports private keys or API keys.
What evidence does nPKI produce for auditors and regulators?+
Every regulated action — key generation, KYC, CSR handling, consent, signing, CA communication, callback delivery — is captured as a normalized audit event. These roll up into correlation exports, SHA-256 integrity manifests, tamper-evident sealed evidence packs, and SIEM-ready NDJSON export.
Can our existing applications integrate with nPKI?+
nPKI is API-first: enrollment, issuance, revocation, signing, callbacks, validation, audit, and reporting are all exposed as REST surfaces, with signed application requests, replay protection, and credential rotation for relying-party integrations.
nNur Technologies

Build trust services that can be operated, verified, and audited.

See the full platform story in one session: multi-tenant PKI, Root/Sub CA governance, eSign and e-Signature workflows, public verification, and evidence-backed operational readiness.

Request a demo Ask a question
Response timeWithin 1 business day
What to expectLive walkthrough of your use case
Deployment modelsOn-prem, private cloud, or hybrid
Contactinfo@nnur.ca