# The trust infrastructure entity of the YORYX group > YORYX TRUST SASU is the trust infrastructure entity of the YORYX group. It operates for the SELLO® platform and does not contract with end users. This site is a regulatory transparency register: the entity's status, its company documents and the publications expected by the State are gathered here and updated at every step we complete. - Institutional contact ## Our regulatory status today YORYX TRUST is preparing its declaration and its application for approval with the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) under Law No. 43-20 on trust services for electronic transactions. As of today, YORYX TRUST is neither declared nor approved. ## The trust services we are working towards Law No. 43-20 lists the trust services. These are the ones YORYX TRUST is preparing for the SELLO® platform; none of them is open today, and none is provided directly to end users. ## Electronic signature creation Creating an electronic signature on behalf of the signatory and issuing the related certificates. ## Electronic seal Applying an electronic seal on behalf of a legal entity to guarantee the origin and the integrity of a document. ## Electronic timestamping Attesting the date and time of an electronic document by means of a timestamp token. ## The steps of our regulatory path This path is presented as a sequence of steps with no announced schedule: each step depends on a decision of the national authority. - Compliance --- # The trust services we are working towards > Law No. 43-20 lists the trust services. These are the ones YORYX TRUST is preparing for the SELLO® platform; none of them is open today, and none is provided directly to end users. What is this? The trust services YORYX TRUST is preparing for the SELLO® platform. Who is it for? For anyone who wants to know what YORYX TRUST will offer. What can I do here? See the four planned services, starting with electronic signature. - See electronic signature ## The three levels of electronic signature Law No. 43-20 distinguishes three levels of electronic signature. A simple electronic signature identifies the signatory and links the signature to the document; a court weighs its evidential value. An advanced electronic signature adds a unique link to the signatory, sole control of the creation data, and detection of any later change to the document. The qualified electronic signature, the only level that carries the presumption of reliability, is not yet offered by YORYX TRUST: it will be once the DGSSI has granted its approval. - Back to top ## Electronic signature creation Creating an electronic signature on behalf of the signatory and issuing the related certificates. In practice: the signer will sign from a phone or a browser, with no USB token and no card to buy, the signature-creation data staying inside the hardware cryptographic module. ## Electronic seal Applying an electronic seal on behalf of a legal entity to guarantee the origin and the integrity of a document. In practice: the seal will be applied by the legal person's own systems through the platform, with no manual step and no carrier handed to an individual. ## Electronic timestamping Attesting the date and time of an electronic document by means of a timestamp token. In practice: every signature will be timestamped, and a timestamp token may also be requested on its own for a document that is not signed. ## Validation and preservation Verifying an electronic signature or seal and preserving the related evidence. In practice: verification will be public and will ask for no account, neither from the recipient of a document nor from anyone else checking it. - Back to top --- # How signing will work > This page describes the target model: what signing will be once the trust infrastructure is in service. Nothing below is open today. The principle fits in one sentence: the signer buys no hardware, installs no software, and signs from a phone or a browser. What is this? How electronic signing will work once the service opens. Who is it for? For anyone wondering how they will sign in the future. What can I do here? See the steps, from enrolment to checking a document. - See enrolment ## Nothing to buy The signer will have no USB token, no smart card and no card reader to obtain, and nothing to install on a computer. The physical carrier disappears from the journey: the hardware cryptographic module operated by YORYX TRUST takes its place. - No signing USB token to buy, to renew, or to replace when it is lost or broken. - No smart card and no reader, and therefore no dependency on one particular workstation. - No software, no browser extension and no driver to install: an up-to-date browser or the platform application is enough. - Back to top ## The signer's keys stay inside the module In the target model, the signer's signature-creation data is generated inside the hardware cryptographic module operated by YORYX TRUST and never leaves it in the clear. It is copied onto no carrier, exported to no computer, and handed to no third party. Article 8 of Law No. 43-20 governs exactly this point: generating or managing signature-creation data on behalf of the signer may be entrusted only to a trust service provider that has obtained approval. YORYX TRUST is preparing that approval; until it is granted, this service is not open. One practical consequence: losing a phone loses no key. It revokes an authentication means, which the signer enrols again; the signature-creation data never left the module. - Back to top ## Prove your identity once, at enrolment Enrolment will happen through the SELLO® platform, and never through this site: YORYX TRUST does not contract with end users and opens no account here. The identity reference is the electronic national identity card (CNIE). The identity check may be carried out face to face or remotely, according to the arrangements the DGSSI référentiel admits. Article 33 of Law No. 43-20 makes verification of the certificate holder's identity a condition of approval. Open item: the remote identity-verification arrangements the DGSSI référentiel admits still have to be confirmed with the national authority. No method is announced here, and no integration with the electronic national identity card exists today: it is described as a target. - Back to top ## Signing from a phone Every signature will be authorised by an action only the signer can perform: from the application on the phone or from a browser session, after strong authentication. Without that action the module produces no signature. This is what sole control means. The key is held by the provider, but it is operated only by the signer, for one specific document and at one specific moment. Strong authentication is therefore not a mere login: it is a component of the signing service itself. This server-signing model is described by the standards CEN EN 419 241-1 and CEN EN 419 241-2, which the DGSSI Ref_QSCD référentiel counts among the texts applicable to signature-creation devices subject to approval. These standards are working targets: no conformity is established today, and no third-party attestation is claimed. - Back to top ## Verifying without an account Verifying a signature, a seal or a timestamp token will be public. Whoever receives a document will need no account, no software and no subscription to check who signed, when, and whether the document has been changed since. This validation service is not open today, because no certificate is issued. It is one of the services YORYX TRUST is preparing for the SELLO® platform. - Back to top ## The three levels of electronic signature Law No. 43-20 distinguishes three levels of electronic signature. A simple electronic signature identifies the signatory and links the signature to the document; a court weighs its evidential value. An advanced electronic signature adds a unique link to the signatory, sole control of the creation data, and detection of any later change to the document. The qualified electronic signature, the only level that carries the presumption of reliability, is not yet offered by YORYX TRUST: it will be once the DGSSI has granted its approval. - Back to top ## Our regulatory status today YORYX TRUST is preparing its declaration and its application for approval with the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) under Law No. 43-20 on trust services for electronic transactions. As of today, YORYX TRUST is neither declared nor approved. - Back to top --- # The applicable legal framework > What is this? Morocco's legal framework for electronic signatures and trust service providers. Who is it for? For anyone who wants to know which laws apply to YORYX TRUST. What can I do here? See the three signature levels the law sets out. - See the signature levels ## Our regulatory status today YORYX TRUST is preparing its declaration and its application for approval with the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) under Law No. 43-20 on trust services for electronic transactions. As of today, YORYX TRUST is neither declared nor approved. - Back to top In Morocco, trust services for electronic transactions are governed by the following texts. Law No. 43-20 on trust services for electronic transactions. Enacted by dahir No. 1-20-100 of 31 December 2020, published in the Bulletin officiel on 18 March 2021. Decree No. 2-22-687 of 21 rabii II 1444 (16 November 2022) issued for the application of Law No. 43-20, Bulletin officiel No. 7162 of 19 January 2023. The DGSSI publishes the requirements framework [Ref_PSCo_AG] applicable to trust service providers subject to approval (version 1.0, 13 July 2023). The competent national authority is the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI). - Back to top ## Approval and declaration: two distinct regimes Law No. 43-20 places trust service providers under two distinct regimes, according to the level of the service provided. ## The approval regime Approval is granted by the DGSSI. Under Article 32 of Law No. 43-20, trust services subject to approval may not be provided, and the corresponding electronic certificates may not be issued or delivered, before it is obtained. Article 33 lists the following conditions, among others: incorporation as a company under Moroccan law, insurance covering professional liability, a business-continuity plan, and verification of the identity of the person to whom the certificate is delivered. The DGSSI publishes an extract of the approval decision in the Bulletin officiel and maintains the register of the providers concerned (Article 53). ## The prior-declaration regime Non-qualified trust services fall under prior declaration. Article 35 of Law No. 43-20 requires anyone intending to provide them to file a prior declaration with the DGSSI, in the manner set by regulation. The DGSSI then carries out ex-post supervision (Article 52) and publishes on its website the list of providers that have filed this prior declaration (Article 53). - Back to top ## The five trust services of Law No. 43-20 Article 3 of Law No. 43-20 lists the following trust services, together with the creation of the certificates relating to them, their validation and their preservation. - The creation of electronic signatures. - The creation of electronic seals. - Electronic timestamping. - Electronic registered delivery. - The authentication of a website. The law bases it on a website authentication certificate, which may be delivered only by a provider that has obtained approval (Article 30). - Back to top ## The three levels of electronic signature Law No. 43-20 distinguishes three levels of electronic signature. A simple electronic signature identifies the signatory and links the signature to the document; a court weighs its evidential value. An advanced electronic signature adds a unique link to the signatory, sole control of the creation data, and detection of any later change to the document. The qualified electronic signature, the only level that carries the presumption of reliability, is not yet offered by YORYX TRUST: it will be once the DGSSI has granted its approval. - Back to top --- # Compliance > What is this? The steps YORYX TRUST must complete before approval. Who is it for? For anyone following our regulatory progress. What can I do here? See the documents already published in the register. - See the document register ## The steps of our regulatory path This path is presented as a sequence of steps with no announced schedule: each step depends on a decision of the national authority. - File with the DGSSI the prior declaration required for non-qualified trust services. - Have our practices assessed by a conformity assessment body. - File the application for approval with the DGSSI. - Publish the certification policy and the certification practice statement. - Open the service to the public once the national authority has ruled. - Submit to the continuous supervision of the national authority and notify it of any security incident. - Back to top ## The standards we target These standards are our working target. No conformity is claimed at this stage. ## ETSI EN 319 401 Target: general requirements for trust service providers. ## ETSI EN 319 403-1 Target: requirements for conformity assessment bodies. ## ETSI EN 319 411-1 Target: requirements for trust service providers issuing certificates. ## ETSI EN 319 411-2 Target: additional requirements for trust service providers. ## ETSI EN 319 412 Target: electronic certificate profiles. ## ETSI EN 319 421 Target: requirements for electronic timestamping services. ## ETSI EN 319 422 Target: timestamp token protocols and profiles. ## CEN EN 419 221-5 Target: trust cryptographic module. - Back to top ## What is in place today - A dedicated legal entity, YORYX TRUST SASU, separate from the group's product companies. - A registered office in Morocco, in Marrakech. - A single point of contact for any regulatory or security question. - This site opens no accounts and has no form asking for your name or contact details. The site application does not measure its audience. However, the systems that deliver pages and protect the site process technical connection data, such as IP addresses. - Back to top --- # Technology and security > This page describes the target architecture of YORYX TRUST: what the trust infrastructure will be when it enters service. Nothing below is presented as already achieved. The components are in preparation, the standards cited are targets, and no third-party attestation is claimed. What is this? The target technical architecture that will protect keys and signatures. Who is it for? For anyone curious how security will actually be ensured. What can I do here? See how keys will be kept inside a dedicated module. - See the cryptographic module ## Target architecture of the trust hierarchy The planned infrastructure rests on a two-tier hierarchy and on separate services, each with its own key and its own log. - A root certification authority kept offline, brought up only for the duration of a key ceremony, which limits its exposure to those operations alone. - Separate issuing certification authorities per service — signature, seal, timestamping — so that an incident affecting one service does not spread to the others. - A timestamping authority fed by a trusted time source, separate from the certification authorities. - A validation service that checks a certificate's state and a signature's validity at the moment it is relied upon. - A remote signing service, which will produce the signature on the signatory's behalf and under the signatory's sole control. - Back to top ## Key protection The authorities' private keys are the most sensitive point of the whole system: whoever holds one can produce a signature in the service's name. The target architecture treats them accordingly. - Keys are generated and held inside a hardware cryptographic module and never leave it in the clear. - No sensitive operation is carried out by one person: key activation and administrative operations require dual control and a quorum of M out of N holders. - Roles are separated — administration, operation, audit — and no one person holds two of them. - Authority keys are generated in a ceremony, following a script written in advance, before witnesses, and recorded in a signed minute. - Audit logs are timestamped and tamper-evident, so that an alteration is detectable after the fact. - Key backups are encrypted and their restoration is itself subject to the quorum, never to an individual decision. - Physical access to the equipment is restricted, traced, and distinct from logical access to the services. - Back to top ## Remote signing and timestamping In the target model the signatory does not physically hold the key: it is held inside the hardware cryptographic module and is activated only on a request that the signatory alone can produce. Strong authentication of the signatory is therefore not a mere site login: it is a component of the signing service itself, and it is what gives effect to the sole control required of a signature creation device subject to approval. The planned timestamping relies on a trusted time source and on a separate authority, so that the date attached to a document depends neither on the user's own clock nor on the clock of the service that produced the signature. How signing actually happens — nothing to buy, keys kept inside the module, identity based on the electronic national identity card, authorisation from the phone — is described on a page of its own. - How signing will work - Back to top ## Continuity and recovery - A secondary site is planned, so that the loss of the primary site costs neither the service nor the evidence already produced. - Backups are encrypted and their restoration is subject to the same quorum as key operations. - Restoration is exercised for real and at regular intervals: a recovery procedure that has never been played out is not a guarantee, it is an intention. - Back to top ## Targeted standards and references The texts below are targets. They describe the level the architecture is preparing for, not a level already reached: no conformity is established as of today, and no third-party attestation is claimed. ## CEN EN 419 221-5 — target protection profile Protection profile applicable to cryptographic modules used as signature or seal creation devices. It is the acquisition target set for the module. ## Common Criteria EAL4+ — target evaluation level Target security evaluation level for the cryptographic module. It is an acquisition target: the exact position of the hardware finally chosen will be verified before any assertion is made. ## FIPS 140-2 and FIPS 140-3, level 3 — target reference United States requirements reference for cryptographic modules, whose level 3 imposes physical intrusion resistance and detection. Targeted on the same footing as the European protection profile. ## ETSI EN 319 401, ETSI EN 319 411-1, ETSI EN 319 411-2, ETSI EN 319 421 and ETSI EN 319 422 — target standards General requirements for trust service providers, requirements specific to certificate issuers, and requirements specific to timestamping. They structure the policy and practices the register will publish. ## DGSSI references Ref_PSCo_AG and Ref_QSCD — target references Requirement references published by the national authority: one for trust service providers subject to approval, the other for signature creation devices. They are what the application will have to satisfy. - Back to top ## What is not published, and why This page describes architectural principles, never equipment. The identity of the hardware — its make, its model, its serial number —, its configuration, and the place where it is installed are not published and will not be. That silence is a security measure, not reticence: whoever knows the exact reference of a piece of equipment also knows the public list of its flaws. Security by design is judged on the principles stated and on the audit that verifies them, never on the publication of an inventory. - Back to top ## Our regulatory status today YORYX TRUST is preparing its declaration and its application for approval with the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) under Law No. 43-20 on trust services for electronic transactions. As of today, YORYX TRUST is neither declared nor approved. - Back to top --- # Document register > This register is the trust service provider's publication repository: policies and practices, general terms, disclosure statements, certificates and revocation lists, forms, guides, pricing and the complaints procedure. Every published file carries its SHA-256 fingerprint. What is this? The register of documents YORYX TRUST publishes, each with its fingerprint. Who is it for? For anyone who wants to check a document or its fingerprint. What can I do here? Download a document or the full list of fingerprints. - See the fingerprints (SHA256SUMS.txt) ## Policies and practices Document Status Document date Version Fingerprint Download Certification policy – electronic signature - Published - 5 September 2026 - v0.1 - 4e92 b8be e30f 98fd 9016 7603 be5d 1329 6de9 01ea f9f3 7642 bcb4 6cd2 bc52 b330 - Download Details 4e92b8bee30f98fd ETSI EN 319 411-1 ; ETSI EN 319 411-2 Document date: 5 September 2026 Version: 0.1 Fingerprint: 4e92b8bee30f98fd90167603be5d13296de901eaf9f37642bcb46cd2bc52b330 Reference standard: ETSI EN 319 411-1 ; ETSI EN 319 411-2 Certification policy – electronic seal - Published - 5 September 2026 - v0.1 - 31aa e8be b2d8 d115 95cf 59c4 7e19 68c4 79c2 6765 9d7c eb0c e248 e807 f38d ef79 - Download Details 31aae8beb2d8d115 ETSI EN 319 411-1 ; ETSI EN 319 411-2 Document date: 5 September 2026 Version: 0.1 Fingerprint: 31aae8beb2d8d11595cf59c47e1968c479c267659d7ceb0ce248e807f38def79 Reference standard: ETSI EN 319 411-1 ; ETSI EN 319 411-2 Timestamping policy - Published - 5 September 2026 - v0.1 - 4fb4 137c eb0a a795 df22 6691 3272 d2f7 601f ef0d 6a4c 71fc 0b1d e703 04e3 54e5 - Download Details 4fb4137ceb0aa795 ETSI EN 319 421 ; ETSI EN 319 422 Document date: 5 September 2026 Version: 0.1 Fingerprint: 4fb4137ceb0aa795df2266913272d2f7601fef0d6a4c71fc0b1de70304e354e5 Reference standard: ETSI EN 319 421 ; ETSI EN 319 422 Certification practice statement (DPC) - Published - 5 September 2026 - v0.1 - 0616 0661 a596 2bc9 a770 8826 ee06 164c 15fa 16b2 7de4 5042 9f00 a186 7d02 ddd9 - Download Details 06160661a5962bc9 ETSI EN 319 401 ; ETSI EN 319 411-1 Document date: 5 September 2026 Version: 0.1 Fingerprint: 06160661a5962bc9a7708826ee06164c15fa16b27de450429f00a1867d02ddd9 Reference standard: ETSI EN 319 401 ; ETSI EN 319 411-1 - Back to top ## General terms Document Status Document date Version Fingerprint Download General terms of use – natural person - Published - 5 September 2026 - v0.1 - 87d2 e342 5259 8b33 c405 b2fb 9335 4721 00b7 692e b5b4 9a87 7cf1 14a9 468a 488a - Download Details 87d2e34252598b33 ETSI EN 319 411-1 Document date: 5 September 2026 Version: 0.1 Fingerprint: 87d2e34252598b33c405b2fb9335472100b7692eb5b49a877cf114a9468a488a Reference standard: ETSI EN 319 411-1 General terms of use – legal person - Published - 5 September 2026 - v0.1 - a633 584d 9c41 3dab 12bf 5436 2e4c 2aa6 7dfb 2aa9 bc5b 7907 74b7 0afb 682b e7ac - Download Details a633584d9c413dab ETSI EN 319 411-1 Document date: 5 September 2026 Version: 0.1 Fingerprint: a633584d9c413dab12bf54362e4c2aa67dfb2aa9bc5b790774b70afb682be7ac Reference standard: ETSI EN 319 411-1 General terms of use – timestamping - Published - 5 September 2026 - v0.1 - 3b57 236f a4a5 0713 c200 3531 5c2d 88b3 98ad a705 848c cfac 5116 6563 8a9e d82f - Download Details 3b57236fa4a50713 ETSI EN 319 421 Document date: 5 September 2026 Version: 0.1 Fingerprint: 3b57236fa4a50713c20035315c2d88b398ada705848ccfac511665638a9ed82f Reference standard: ETSI EN 319 421 - Back to top ## PKI disclosure statements Document Status Document date Version Fingerprint Download PKI disclosure statement – certificates - Published - 5 September 2026 - v0.1 - bd59 036b d2e7 64cf 0a17 4234 3459 547a 582a 9f42 f935 dde4 076f f1a9 1c0e 5c08 - Download Details bd59036bd2e764cf ETSI EN 319 411-1 Document date: 5 September 2026 Version: 0.1 Fingerprint: bd59036bd2e764cf0a1742343459547a582a9f42f935dde4076ff1a91c0e5c08 Reference standard: ETSI EN 319 411-1 PKI disclosure statement – timestamping - Published - 5 September 2026 - v0.1 - 3f35 ff7d 5d8b 2d0e 274a 05ea 6622 3304 7b16 558e 71ef f131 4133 d5fd ae64 868f - Download Details 3f35ff7d5d8b2d0e ETSI EN 319 421 Document date: 5 September 2026 Version: 0.1 Fingerprint: 3f35ff7d5d8b2d0e274a05ea662233047b16558e71eff1314133d5fdae64868f Reference standard: ETSI EN 319 421 - Back to top ## Certificates and revocation Document Status Document date Version Fingerprint Download Root and intermediate certificates - After approval - — - — - — This document will be published here once the DGSSI has granted its approval. Details ETSI EN 319 412 Document date: — Version: — Fingerprint: — Reference standard: ETSI EN 319 412 Revocation list (CRL) - After approval - — - — - — This document will be published here once the DGSSI has granted its approval. Details ETSI EN 319 411-1 Document date: — Version: — Fingerprint: — Reference standard: ETSI EN 319 411-1 OCSP service - After approval - — - — - — This document will be published here once the DGSSI has granted its approval. Details ETSI EN 319 411-1 Document date: — Version: — Fingerprint: — Reference standard: ETSI EN 319 411-1 - Back to top ## Forms Document Status Document date Version Fingerprint Download Subscriber registration form - Published - 5 September 2026 - v0.1 - fb6a 3391 6470 4088 f8ce 08a2 c61f b26a 23aa f9eb c49d 19c3 2ed4 485b 44b3 11d5 - Download Details fb6a339164704088 Document date: 5 September 2026 Version: 0.1 Fingerprint: fb6a339164704088f8ce08a2c61fb26a23aaf9ebc49d19c32ed4485b44b311d5 Reference standard: — Legal representative registration form - Published - 5 September 2026 - v0.1 - 1cff b807 9447 277d b56d 23d1 8144 23d5 fc4f b88c e422 6069 232b 658d 94c5 3989 - Download Details 1cffb8079447277d Document date: 5 September 2026 Version: 0.1 Fingerprint: 1cffb8079447277db56d23d1814423d5fc4fb88ce4226069232b658d94c53989 Reference standard: — Revocation request form - Published - 5 September 2026 - v0.1 - 4caf 8446 c20b dcac 43d7 7752 f52f 1281 aa58 f764 7ec4 a2ac 758f a212 3dd0 40a2 - Download Details 4caf8446c20bdcac Document date: 5 September 2026 Version: 0.1 Fingerprint: 4caf8446c20bdcac43d77752f52f1281aa58f7647ec4a2ac758fa2123dd040a2 Reference standard: — Mandate and collection authorisation - Published - 5 September 2026 - v0.1 - 706c 6c8a 8d53 b66e bc9d 1a01 5e6b 1f3a 0d0c 72a2 bbed 92fe f4de b19f 3e7c d811 - Download Details 706c6c8a8d53b66e Document date: 5 September 2026 Version: 0.1 Fingerprint: 706c6c8a8d53b66ebc9d1a015e6b1f3a0d0c72a2bbed92fef4deb19f3e7cd811 Reference standard: — - Back to top ## Guides Document Status Document date Version Fingerprint Download Online enrolment and request guide - Published - 5 September 2026 - v0.1 - 3706 e436 9cfa 3bc9 3cec ddf0 9e11 360c 8b79 4cee c28f f219 63fe 0d45 5fcb 6fde - Download Details 3706e4369cfa3bc9 Document date: 5 September 2026 Version: 0.1 Fingerprint: 3706e4369cfa3bc93cecddf09e11360c8b794ceec28ff21963fe0d455fcb6fde Reference standard: — Identity verification guide - Published - 5 September 2026 - v0.1 - 4eb4 862a 6dfa d8c4 d593 3114 6ffa 7603 13ce 2277 9ce8 1265 f4a5 6a21 37c4 0832 - Download Details 4eb4862a6dfad8c4 Document date: 5 September 2026 Version: 0.1 Fingerprint: 4eb4862a6dfad8c4d59331146ffa760313ce22779ce81265f4a56a2137c40832 Reference standard: — Installation and use guide - Published - 5 September 2026 - v0.1 - 587b 59fd ee9f f0ab da5f c230 fa76 37bc 122d b121 4b88 8a97 1527 6b19 a682 5d36 - Download Details 587b59fdee9ff0ab Document date: 5 September 2026 Version: 0.1 Fingerprint: 587b59fdee9ff0abda5fc230fa7637bc122db1214b888a9715276b19a6825d36 Reference standard: — - Back to top ## Pricing and complaints Document Status Document date Version Fingerprint Download Pricing - Published - 5 September 2026 - v0.1 - ce73 b456 3b6a 91d3 c6d6 9826 2ce6 ed7a 4d22 5c57 0818 effc 568b bee7 1b5b 8481 - Download Details ce73b4563b6a91d3 Document date: 5 September 2026 Version: 0.1 Fingerprint: ce73b4563b6a91d3c6d698262ce6ed7a4d225c570818effc568bbee71b5b8481 Reference standard: — Complaints procedure - Published - 5 September 2026 - v0.1 - e2c1 9417 3874 ed5c b062 3e26 ce4f fd97 da23 32c9 5f47 fa88 f4de 526a 9941 f245 - Download Details e2c194173874ed5c ETSI EN 319 401 Document date: 5 September 2026 Version: 0.1 Fingerprint: e2c194173874ed5cb0623e26ce4ffd97da2332c95f47fa88f4de526a9941f245 Reference standard: ETSI EN 319 401 - Back to top ## DGSSI regime Document Status Document date Version Fingerprint Download Applicable regulatory references (DGSSI) - Published - — - — - — - Official text on the DGSSI website Details Document date: — Version: — Fingerprint: — Reference standard: — Declaration receipt - In preparation - — - — - — Document in preparation. Details Document date: — Version: — Fingerprint: — Reference standard: — Approval decision - After approval - — - — - — This document will be published here once the DGSSI has granted its approval. Details Document date: — Version: — Fingerprint: — Reference standard: — - Back to top SHA-256 fingerprint of the published file - Fingerprints of all files (SHA256SUMS.txt) Date printed on the document itself; "—" when it carries none. --- # The company > YORYX TRUST SASU is a simplified joint-stock company with a sole shareholder under Moroccan law, entered in the Marrakech commercial register. Its sole shareholder is YORYX HOLDING, a company of the same group. Its registered office is in Marrakech. Its mission is to carry, for the group, the electronic trust infrastructure: key management, certificate issuance, timestamping and evidence preservation. It has no commercial activity of its own. YORYX TRUST operates for the SELLO® platform, which is the group's product for businesses and individuals. YORYX TRUST does not contract with end users: the contractual relationship belongs to SELLO®. --- # Frequently asked questions > What is this? Answers to the questions asked most often about YORYX TRUST. Who is it for? For anyone in a hurry who wants a quick, clear answer. What can I do here? Browse the questions, or start with the first one. - See the first question ## Signing What are the levels of electronic signature? Three in total. Three levels: simple, advanced and qualified. Only the qualified electronic signature carries the presumption of reliability, and it is not yet offered by YORYX TRUST. Do I have to buy a USB token or a card? No. In the target model the signer buys no carrier and installs no software: the signature-creation data is generated and kept inside the hardware cryptographic module operated by YORYX TRUST, and every signature is authorised from the phone or the browser after strong authentication. This service is not open today. How do I prove who I am? Through the SELLO® platform. Enrolment will happen through the SELLO® platform, with an identity check whose reference is the electronic national identity card (CNIE), face to face or remotely according to the arrangements the DGSSI référentiel admits. Those arrangements still have to be confirmed with the national authority, and no integration with the electronic national identity card exists today. - Back to top ## Verifying How is a signed document verified? By the certificate. Verification rests on the certificate attached to the signature and on the preserved evidence. YORYX TRUST issues no certificate today, so no verification service is open. - Back to top ## Status and legal framework What is the legal value of an electronic signature in Morocco? Set by Law 43-20. Law No. 43-20 on trust services for electronic transactions sets the applicable regime. It was enacted by dahir No. 1-20-100 of 31 December 2020 and came into force on 13 July 2023. Is the qualified electronic signature on the roadmap? Yes. The qualified electronic signature, the only level that carries the presumption of reliability, is not yet offered by YORYX TRUST: it will be once the DGSSI has granted its approval. What is the DGSSI? The national authority. The Direction Générale de la Sécurité des Systèmes d'Information is the national authority competent for trust services. It sets the applicable references, examines applications for approval and supervises providers. What is a trust service provider? A legal entity. It provides one or more trust services: electronic signature or seal creation, electronic timestamping, electronic registered delivery, certificate issuance, validation and preservation. Where does YORYX TRUST stand today? In preparation. YORYX TRUST is preparing its declaration and its application for approval with the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) under Law No. 43-20 on trust services for electronic transactions. As of today, YORYX TRUST is neither declared nor approved. Does this site collect personal data? Yes. Technical connection data, such as IP addresses, browser information, the page requested and technical headers, are processed to deliver pages and protect the site. The provider that delivers the site and provides network protection also processes these data when the connection passes through its services. This site opens no accounts and has no form asking for your name or contact details. Its application does not measure its audience and sets only two functional cookies: yx_lang for language and yx_theme for theme. How can we be reached? By e-mail. At the address given in the footer. It is this site's only contact channel. What is the relationship with SELLO®? Operates for SELLO®. YORYX TRUST is the trust infrastructure entity of the YORYX group: it operates for the SELLO® platform, which is the product for businesses and individuals. YORYX TRUST is preparing the infrastructure that SELLO® will be able to consume once the authorisations are obtained. Does YORYX TRUST provide services to businesses or individuals? No. YORYX TRUST does not contract with end users. Businesses and individuals use the SELLO® platform, which will consume YORYX TRUST's trust infrastructure once the authorisations are obtained. - Back to top --- # Legal notice > Site publisher: YORYX TRUST SASU Legal form: Simplified joint-stock company with a sole shareholder (SASU) Publication director: Yassine Challal, President Registered office: 57 rue Mauritania, BP 2609, Guéliz, 40000 Marrakech, Morocco Commercial register: RC Marrakech 184667 ICE: 004013324000019 Tax identifier: 73266987 Professional tax: 45117956 Share capital: 100 000 MAD Capital fully paid up in cash. Hosting: YORYX HOLDING SAS, Marrakech Contact: trust@yoryx.com YORYX®, SELLO®, SALDO® and ORDO® are registered trademarks; YORYX® is used under licence (OMPIC No. 298652). --- # Personal data > This is a corporate site. As with any website, the systems that deliver pages and protect the site process technical connection data: IP addresses, browser information, the page requested and technical headers. The provider that delivers the site and provides network protection also processes these data when the connection passes through its services, to deliver and protect the site. Its retention of these data is governed by its terms. Technical information about requests may be recorded in operational logs. No user account is created on this site. No form here asks for your name or contact details. The display form lets you choose the theme. The site application uses no audience measurement, advertising tracker or third-party browser script. It records technical request information, such as the page requested and the response outcome. ## Cookies yx_lang stores the chosen language. yx_theme stores the chosen light or dark theme. Personal-data processing is subject to Law No. 09-08. The rights of access, rectification, objection and erasure are exercised with the contact given below. For any question about personal data, write to the site's contact address. ## Contact trust@yoryx.com