How OneSpan secures digital signatures with AI & passkeys

Keith Shaw: Hi everybody, welcome to DEMO, the show where companies come in and show us their latest products and platforms. Today, I’m joined by Will LaSala, Field CTO at OneSpan. Welcome to the show, Will. Will LaSala: Thank you so much, Keith. It’s great to be here.

I’m happy to meet with you and talk through what OneSpan’s doing. Keith: For those who might not be familiar with OneSpan, what field are you in? What do you guys do? Will: Sure. OneSpan is a digital agreements and electronic signature security company.

We’re one of the leading providers — just behind DocuSign — in the space. We help replace paper documents with secure, digital signatures. These are protected by certificates that ensure the authenticity of the signature and the overall process.  

Keith: And digital signatures have been around for a while. What’s new in this space? What are people concerned with, and what are you going to show us today to solve those problems? Will: Absolutely.

OneSpan has been around since the early ‘90s — we were one of the first to do this. Historically, it was about user convenience — click-to-sign PDFs instead of piles of paper. But now, it's more about securing the identity of the user and the document.

We're focused on verifying who the user is before they sign and ensuring the document can't be tampered with afterward. Notarization is also shifting — about 30 states now allow remote online notarization, and we support that too.  

Keith: So it's about identity authentication. Kind of like two-factor — but not just digital anymore. There’s a physical aspect too, right? Will: Exactly. There are two layers here: identity verification (is this person who they claim to be?) and authentication (is this person the one doing the transaction?).

We offer both — identity verification and multi-factor authentication.   Keith: Without these solutions, what are companies doing? Still relying on paper? Will: Some are, yes. Others rely on less secure methods like SMS OTPs, but that method has known security flaws.

OneSpan helps organizations go beyond SMS into FIDO-based security and passkeys — true next-level identity verification.  

Keith: Let’s jump into the demo. Will: Sure. What we’re going to look at is a loan application. It’s long and tedious — typical of mortgages. With OneSpan, we digitize and simplify this process. First, we onboard the user.

In this case, we’re simulating a loan application using a sample identity — "Connor Sample" from the Massachusetts DMV.  

On the left side of the screen, you’ll see the bank’s website. On the right, the user’s mobile phone. The user (Connor) enters personal information and selects options — like whether they want a free checking account.  

The forms use our Smart Forms technology — drag-and-drop elements that allow the bank to prefill information. This reduces the need for users to enter the same data over and over.  

Before signing, we need to verify that I’m Connor. That’s where identity verification comes in. I receive a text message to my phone, click the link, and start the process. I select the type of ID (e.g., driver’s license), the issuing country (United States), and the state (Massachusetts).  

The point here is not just to extract data, but to verify that the information submitted matches the identity document. I scan the front and back of the ID. The system uses AI to analyze it — checking for authenticity, tampering, and machine-readable data.  

It can detect if the ID isn’t laminated or missing holograms—or even if it's a photoshopped fake.  

Next is facial verification. The system ensures I’m a real person—not AI-generated or manipulated — and checks that my face matches the ID. It also looks for suspicious context (e.g., duress).

We take a selfie, and the AI evaluates the image to ensure it's real, that it matches the ID photo, and even checks naming consistency (e.g., “Will” vs. “William”).  

Once submitted, the system verifies all the data in about 30 seconds. Now that I’m verified, we can move into authentication.  

We issue a passkey to the user using FIDO standards. The user scans a QR code, links their phone, and confirms their fingerprint. This sets up a secure, phishing-resistant method for logging in.  

Now we can sign the NDA and the onboarding form. The form is prefilled with the user’s information. No retyping needed.  

The final step is our Evidence Summary — a behind-the-scenes audit trail. It logs: Who created the transaction Timestamps Geo-location IP address Identity verifications (IDV) OFAC checks This ensures you can prove the transaction was valid and secure.  

If someone claims, “That wasn’t me,” you can point to this audit trail and prove otherwise.  

Moving forward, the user doesn’t need to repeat identity verification. They can use their passkey to log in again. It’s all linked securely through biometric authentication.   Multiple signatures?

No problem. With digital signing, one click can apply to all required fields.   Keith: For companies looking to implement this, is it hard to set up? Will: Not at all. Everything is cloud-based and drag-and-drop. You set up the forms, assign authentication, and go.

Our customers are typically in banking, healthcare, or retail — anywhere strong identity verification is crucial.  

Keith: You showed a lot of great features. Where can people go to learn more? Will: Visit onespan.com. You can even sign up for a free sandbox to test everything yourself. It’s fully white-labeled — you won’t see any OneSpan branding if set up correctly.

Keith: You already answered my next question about the demo. You’re awesome. Will: Thanks! Great being here.  

Keith: That’s all the time we have for this episode of DEMO. Be sure to like the video, subscribe to the channel, and leave a comment below. We’ll see you next week. I’m Keith Shaw — thanks for watching.