NR certificates with dual digital signature

Regulatory Standard (Norma Regulamentadora, NR) content in Brazil often requires the completion certificate to be signed by both the participant and a qualified technical responsible. Eduvem offers this dual digital signature flow directly on the platform: the participant signs electronically, with identity verification, and the technical responsible signs with their own digital certificate. The certificate is only released once both signatures are in.

How the dual signature works

Every NR certificate needs two signatures before it is released:

The participant’s signature - electronic, completed inside the platform itself, with identity verification (CPF, a selfie with a liveness check, a code sent by e-mail, IP and geolocation). The NR Signature section (see below) shows which of these checks are active for the institution; the Eduvem team sets them. Under Brazilian Law 14.063/2020, this is a simple electronic signature.
The technical responsible’s signature - completed with that person’s own ICP-Brasil digital certificate (e-CPF), which makes it a qualified signature.

While either signature is missing, the certificate stays withheld: even once the content is completed and approval is already recorded, it is not available for download.

The class’s technical responsible

Every class with Regulatory Standard content has a single technical responsible, who signs every certificate it issues. Once the Eduvem team enables NR signing for the institution, with a contracted number of certificates (see the quota below), assigning and changing the technical responsible becomes the institution administrator’s own job: on the class’s Administrators tab, they pick the person - or remove the current assignment - with no need to contact support.

Contracted NR certificate quota

The number of NR certificates the institution can issue is controlled by a quota, set by the Eduvem team (the Contracted NR certificates field), which also tracks current usage, in the form Used: X of Y.

Institution Configuration screen showing the Enable NR certificates with dual digital signature field, the Contracted NR certificates field and the Used note

Once the contracted number is reached, further NR certificates are withheld until the Eduvem team raises the quota.

The quota and usage stay on this tab. The NR Signature section, described next, only shows how many licenses are still left.

NR Signature: the participant’s checks

The NR Signature section is in the institution’s side menu, under the General group. It appears only while dual signature for NR certificates is enabled for the institution. Institution administrators can open the section and see what is configured, but the fields are read-only: the Eduvem team is the one who sets the checks. A notice in the section itself explains this and points to contacting support to request a change.

At the top of the section, the text NR licenses available: N shows how many licenses of the contracted quota are still unused. A license is consumed as soon as a certificate is first sent to the signature provider - even if the signature has not been completed yet; reissuing a certificate that already consumed a license does not spend another one. When no quota has been configured, the text reads No NR license quota configured, and that does not block issuance (see the quota above).

Right below are four switches, one for each check the participant goes through when signing. All of them come turned on, which is the platform’s default behavior:

Require a selfie from the participant? - the participant takes a photo with the device camera while signing.
Require proof of life? - the camera confirms that a real person is in front of it at the moment of signing. Like the selfie, it needs a camera.
Require the participant’s location? - the browser asks the participant to share their location. While this option is on, anyone who refuses cannot sign.
Send a code to the participant’s e-mail? - the participant types a code sent to their registered e-mail. It is turned off when the registered e-mails are not valid and the code never arrives.

At least one of selfie, liveness check and e-mail code always stays on, so the signature keeps proving who signed and not just the CPF that was typed. When only one of them is on, its switch appears locked, with a note explaining why. Location does not count toward this, because it shows where the person was, not who they are. With DataValid on, the rule is already met, because it keeps the selfie and the liveness check required.

Only the Eduvem team can turn any of them off, on the institution’s request - the most common reason is a participant who signs on a computer without a camera, or who denies the browser’s location prompt: with the check required, they cannot complete the signature. To request a change, contact support.

Changes apply to certificates sent for signature after they are saved. Certificates that were already awaiting signature keep the checks they were sent with.

Every change is recorded in the institution’s audit history.

The e-mail code choice and the DataValid check, described next, used to be on the institution’s Configuration tab. They are now in this section - but, like the other checks in this section, they stay with the Eduvem team only: none of them can be changed by the institution administrator.

Face check against the federal CPF base (DataValid)

Optionally, the Eduvem team can turn on one more check on the participant’s signature for the institution: the selfie taken while signing is compared with the photo in the federal CPF database. The option is in the NR Signature section, in the Verify the participant’s face against the federal CPF base (DataValid)? field - the institution administrator can see whether it is on, but only the Eduvem team can change it.

Because the comparison uses the selfie, while DataValid is on the selfie and the proof of life stay required: the two switches appear turned on and locked, with a notice explaining why.

The change applies to certificates sent for signature after it. Certificates that were already awaiting signature keep the checks they were sent with, even if the option is turned on or off in the meantime.

How the participant signs

After completing the content and being approved, the participant sees the status Awaiting your signature in place of the download button - both on the completed content screen inside the class and on their own profile’s Certificates tab (or My development, once the institution enables the feature). Clicking Sign certificate opens a signing window right on the platform, where the participant confirms their identity and completes the electronic signature.

After signing, the status changes to Awaiting the technical responsible: the participant’s own signature has already been recorded, and the certificate is released as soon as the assigned technical responsible signs too.

How the technical responsible signs

The person assigned as technical responsible finds the certificates awaiting their signature on their own profile page, under the Certificates tab (or My development, once the institution enables the feature), in a separate list called Certificates awaiting your signature (Technical Responsible). Each row shows the participant, the class, the completion date and - when the signing provider reports a deadline - how long that signing link stays valid.

Clicking Sign certificate on one of these rows opens the same signing window, and the technical responsible completes the signature with their own ICP-Brasil digital certificate (e-CPF).

Verification code and QR code on the certificate

Every certificate the platform issues - including NR certificates - has a verification code with 16 characters, in the format XXXX-XXXX-XXXX-XXXX, that anyone can use to confirm the document’s authenticity, with no login needed (see How to validate a certificate).

On an NR certificate, the code, a QR code and the notice Validate at… with the institution’s address are printed: on the Training information page, when the certificate has that page, or, when it does not, in a corner of the certificate’s main page.

Besides what any certificate shows on validation, an NR certificate’s page also shows the training’s place and format, the instructor and their qualification, the technical responsible and, once the certificate has been digitally signed, the notice digitally signed (ICP-Brasil).

NR certificates issued before this feature existed get the code the next time they are downloaded individually; those that already have an ICP-Brasil digital signature keep being verified through the link they already had.

Tracking a class’s certificates

The class’s Administrators tab also shows the NR certificates in progress list: who has not received their certificate yet, whose signature is missing (the participant’s or the technical responsible’s), and how many days the certificate has been in that state.

When a signature cannot be completed because of a temporary provider issue, the platform retries automatically, up to three times. After that limit, the certificate is parked and the list shows a manual reissue option, which opens a new signing process - requiring both signatures again.

Evidence pack

The Evidence pack gathers, in a single ZIP file, the certificates of a class (or of one person) and the status of each enrollment, so you can hand them to an NR inspection or audit without assembling anything by hand.

Who can use it

Institution administrators (or higher roles) in institutions where NR certificate signing is enabled. In other institutions the feature does not appear, and the platform refuses the request with the message The evidence pack is not enabled for this institution. Any administrator of the institution can download a pack generated by another one.

Where to generate it

For a class: in the class’s Reports tab, on the Evidence pack row, click Generate.
For a person: on the person’s page, in the header of their enrollments list, click Evidence pack. The pack covers all of that person’s enrollments.

How generation works

Generation runs in the background, so you can leave the screen. While the pack is being built, the row (or the strip, on the person’s page) shows progress in the format Generating… N of M. When it finishes, the platform sends an e-mail to whoever requested the pack, saying it is ready or, if something went wrong, that generation failed. That e-mail goes only to the requester.

When the pack is ready, the state changes to Ready and the Download link appears, along with available until and the deadline date. If generation fails, the state is Failed and the platform shows the reason; use Generate again.

Download validity

The pack stays available for download for 7 days. After that, the state becomes Expired and the file is removed; use Generate again to create a new pack with the current status of the enrollments.

If a person in the institution is anonymized while a pack is being generated, generation is cancelled, and the institution’s packs that were already ready expire. Generate them again.

Limits

Up to 20,000 enrollments per pack. A class with more than 20,000 enrollments cannot generate a pack; the platform shows This class has too many participants for one pack. Limit: 20,000 enrollments.
Anonymized person: their individual pack cannot be generated (This person has been anonymized; there is no evidence to export).

What is inside the ZIP

File	What it contains
`LEIA-ME.pdf`	Cover page in Portuguese: institution, class or person, generation date, who requested it, enrollment counts by status, NR training data, and whether an attendance list and policy acknowledgements are included.
`participantes.csv`	One row per enrollment, with a single status (see below), plus completion, validity, grade, workload, venue, modality, instructor and verification code.
`assinaturas.csv`	Who signed each NR certificate, with role, date and signature level. Only present when there are signed NR certificates.
`certificados/`	One PDF per enrollment. Signed NR certificates are included exactly as they were signed, never regenerated, together with the signature provider’s evidence report when it is available. Other certificates are generated on the spot.
`presenca.csv` and `ciencia-politicas.csv`	The class’s attendance list and policy acknowledgement records. Only included when the class has such records.
`manifest.csv`	Index of every file: path, size in bytes, sha256, origin and verification result.
`PACOTE-COMPLETO.txt`	Always the last file. Records the date, the number of files and the integrity result.

File names, column headers and pack statuses are always in Portuguese, whatever language the platform is set to. Participants’ access logs are not part of this version of the pack.

Statuses in `participantes.csv`

Each enrollment gets exactly one status:

Status	Meaning
`emitido`	Certificate issued and included in the pack.
`assinado`	NR certificate with both signatures, included as signed.
`assinado (sem hash de referência)`	Signed NR certificate, but without a reference hash to check the file against.
`arquivo assinado indisponível`	The certificate is recorded as signed, but the file could not be read.
`aguardando assinatura (trabalhador)` or `(responsável técnico)`	The indicated signature is still missing; there is no certificate yet.
`não concluído`	The participant has not completed the content yet.
`bloqueado: campo NR-1 ...` or `bloqueado: sem nome`	A field required to issue the certificate is missing.
`emitido antes da adesão NR`	Certificate issued before the institution enabled NR signing.
`certificado não elegível para emissão` or `falha ao gerar certificado`	There is no certificate file for this enrollment.
`removido (titular anonimizado)`	The person was anonymized. The enrollment is still listed, but with no files and no personal data.

How an auditor verifies integrity

Open PACOTE-COMPLETO.txt. If it is not in the ZIP, the pack is incomplete and must not be used. If it is, the INTEGRIDADE line gives the result: OK (everything checked), FALHOU (a signed certificate differs from the original recorded at signing) or NÃO VERIFICÁVEL (a file has no reference hash or is unavailable).
In manifest.csv, compute the SHA-256 of any file and compare it with the sha256 column. For signed certificates, the verificacao_sha256 column shows the result of the check against the hash recorded at signing time: conferido, divergente or sem hash de referência.

Common questions

Can the participant and the technical responsible be the same person? No. The two signatures on a single certificate must come from different people.

Does this replace the institution’s ICP-Brasil digital signature (the “Digitally sign certificates?” option)? No - these are two different mechanisms. That one automatically signs every certificate the institution issues with the platform’s own ICP-Brasil certificate, attesting that Eduvem issued the document. This one applies only to classes with Regulatory Standard content, and additionally requires the participant’s and the technical responsible’s own personal signatures.

Where is the data collected during signing (selfie, liveness, IP) kept? Identity verification is performed by the signature provider Eduvem works with, which keeps that evidence under its own policy and the LGPD. When a person is deleted, Eduvem removes the selfie and the evidence report it holds; the signed certificate is the exception: when retention is on, it is retained, as described below. The provider’s copy is not erased with them. For this kind of request, contact support.

My institution does not have this feature enabled. How do I request it? Contact Eduvem support.

What happens to the NR certificate when the participant is deleted? The institution is the data controller and has to keep proof of the training. So when the participant is deleted, Eduvem keeps a copy of their NR certificate (the signed PDF, when it was signed), with the name and CPF shown on the document, for a period set for the institution: 5 years by default. Only the institution’s administrators can access these copies, in the Retained NR certificates list, and every view and download is logged. The CPF is masked in the list. The verification code keeps answering that the certificate is authentic, without showing the name (Authentic certificate - holder data removed (LGPD).). When the period ends, the file is deleted, the holder’s data is removed and the code starts showing Revoked Certificate.

A former participant asked to have their NR certificate erased. What should I do? The request must be directed to the company (the controller), not to Eduvem. If the company decides to grant it, Eduvem deletes the copy through the Delete now action in the Retained NR certificates list; the deletion completes within a few minutes, on the next run of the retention routine. If the company decides to keep it, the copy stays until the end of the period.

Who decides the retention period? The setting belongs to the institution and is changed by Eduvem (platform administrator), between 0 and 20 years; 0 turns retention off. The period counts from each person’s deletion and does not change for people already deleted. See Retained NR certificates.