Going paperless with HR contracts and documents: signature and digital safe

Quick answer. The employment contract can be concluded and signed electronically, with an eIDAS signature usually at advanced level (Civil Code art. 1366). The payslip can be issued via a digital safe, unless the employee objects (Labour Code art. L3243-2). It must stay accessible for 50 years, or until the age set by article L1237-5 plus six years (around 76, the compulsory-retirement age (article L1237-5) being 70), and the employer keeps a duplicate for 5 years.

Going paperless with HR contracts and documents lightens administration, speeds up hiring and secures retention. Many companies make the move without checking two points that actually decide the legal value of the operation: the signature level chosen and the period for which the payslip stays available. A poorly signed contract or a badly kept payslip turns against the employer the day a labour dispute or an inspection arises. Here is the method, the thresholds and the trade-offs to know to do it properly.

Electronic writing has the same evidential force as paper writing, provided the person it comes from is identified and the document is drawn up and kept under conditions that guarantee its integrity (Civil Code art. 1366). This rule, not mere custom, underpins all HR dematerialisation. Employment contracts, amendments, final settlements, internal notes and charters can therefore be signed electronically, just as a company's articles are today: the logic is the same as the one we detail in our article on the electronic signature of articles online.

The electronic signature itself is governed by the eIDAS Regulation (EU) no. 910/2014, which distinguishes three levels: simple, advanced and qualified. Each level corresponds to a rising requirement for signatory identification and technical reliability. The choice matters: it determines how easily the employer can prove, if challenged, that the employee did sign a given document on a given date.

The most common reflex is to take the highest level "to be safe". That is rarely the right trade-off: the qualified signature requires face-to-face identity verification or an equivalent, heavy and costly, disproportionate for an ordinary employment contract. Conversely, the simple signature (a ticked box, a typed name) offers weak proof, easy to contest. The right level almost always sits between the two.

For the employment contract and most HR acts, the advanced signature is usually the right balance: it creates a reliable link between the signatory and the act, detects any later change and stays operationally light. The qualified signature is reserved for very high-stake situations or when the signatory's identity is hard to establish otherwise.

Which level for which document: the reference table#

To turn this trade-off into concrete decisions, here are the choices we most often make by type of HR document. This table is indicative: a document with an unusual stake (a contested settlement agreement, a director abroad) may justify moving up a level.

Our view: proof matters more than the software#

In the files we support, the question is never "which signature tool to choose" but "what will I be able to prove in two years". A contract signed with a simple signature, with no audit trail, carries little weight before the labour court if the employee disputes having signed it. We therefore recommend favouring the advanced signature for any document that creates or changes an employment relationship, and requiring the provider to supply a time-stamped, storable evidence file. The marginal cost between simple and advanced signature is low; the cost of an unenforceable contract is not. This sits at the boundary of accounting and legal work, which we handle alongside our legal advisory offering.

The payslip is the dematerialised HR document par excellence. Since late 2016 (decree of 16 December 2016), the consent logic is reversed: the employer can issue the payslip electronically, unless the employee objects (Labour Code art. L3243-2). The employee no longer has to give prior consent, but keeps the right to refuse, at any time, without justification and free of charge, and to return to paper. The employer must inform them of this right before the switch and handle an objection within a reasonable time.

The electronic payslip is deposited in a digital safe, a secure and personal space attached to the employee. Three technical requirements define it: integrity (the payslip cannot be altered), availability (the employee can access it at any time) and confidentiality (only they, and no one else in the company, can access it). In practice, two standards structure the market: NF Z42-020 qualifies the digital safe component, while NF Z42-013 (equivalent to ISO 14641-1) targets a complete electronic archiving system.

Checking NF Z42-020 compliance: the questions to ask#

"Asking the provider which compliance it claims" is a good filter, but you still need to know what to verify. Three concrete checks are enough to tell a serious safe from a mere storage space rebranded for the occasion.

• Request a copy of the NF Z42-020 certificate (or equivalent specification), with its validity date and the exact scope covered. A provider claiming to be "compliant" but unable to produce the document is a warning sign.
• Verify the scope of the audit trail: the safe must time-stamp and log the deposit, the accesses and any export, and keep this traceability in an unalterable form. Ask for a sample event log.
• Confirm the reach of integrity and reversibility: a digital fingerprint (sealing) of each payslip, and a guarantee of export of all documents in a structured format, without loss of evidential value.

This is the most often misunderstood point. Two periods coexist, and they do not concern the same party.

Accessibility for the employee therefore runs for 50 years, or until they reach the age set by article L1237-5 of the Labour Code plus six years, whichever is longer. As article L1237-5 refers to the legal retirement age (64 in 2026), this second ceiling sits in practice around 76. This very long requirement means choosing a durable safe: if the service closes, the provider must warn users at least three months in advance so they can retrieve their payslips. In parallel, the employer remains required to keep a duplicate of the payslips (paper or electronic) for five years (art. L3243-4). Confusing these two periods, or believing the safe relieves the employer of its own obligation, is a frequent mistake.

The danger is almost never the signature or the initial deposit: it is the exit. What happens if you change safe provider, if the publisher ceases business, or if an employee wants to retrieve ten years of payslips? Many provider contracts stay vague on this point. Before signing, check that you can retrieve all documents in a structured, commonly used electronic format, at any time and without complex handling, exactly as article D3243-8 requires for the employee. Dematerialisation without a clear reversibility clause creates a dependency that can be costly on migration day.

Two questions come up systematically: what is the extra cost of aiming for a higher signature level, and how long does the rollout take. On the signature, the gap between a simple and an advanced signature is most often a matter of a few tens of cents to a few euros per signed document depending on market offers (to be checked with the provider), so negligible against the hiring volume of an SME. The digital safe is usually billed per employee per year, at a modest level. Against the cost of an unenforceable contract or an untraceable payslip during an inspection, the trade-off clearly favours the higher security level.

On timing, a controlled rollout for a workforce of twenty to fifty employees usually fits within a few weeks: the time to map the documents, set up the signature levels, formally inform employees of their right to object to the electronic payslip (respecting a reasonable period before the switch) and review the provider contract. The step that takes the most time is never technical: it is the legal review of the safe contract and the traceability of the information given to employees. Anticipating these two steps avoids having to postpone the switch.

A 40-employee services SME wanted to move contracts and payslips to digital to streamline hiring and cut paper archiving. Three points structured the project. First, for employment contracts and amendments, we chose an advanced eIDAS signature with a time-stamped evidence file, rather than the simple signature offered by default in its HR tool: the annual cost gap was marginal, the legal-security gap considerable. Second, for payslips, the company informed all 40 employees of their right to object via an internal note; two asked to keep paper, which was respected without difficulty. Third, the safe contract was reviewed to check NF Z42-020 compliance, the 50-year accessibility period and a reversibility clause allowing export if the provider changes. The result: a faster HR process, secured retention, and no legal grey area.

In practice: the check-list before going paperless#

• Map your HR documents and set, for each, the appropriate signature level (advanced for contracts, simple acceptable for low-stake internal use).
• Require from the signature provider a time-stamped, exportable and storable evidence file, not just a ticked box.
• Formally inform employees of their right to object to the electronic payslip before any switch, and keep a trace of that information.
• Check the safe's compliance (NF Z42-020 or equivalent): copy of the certificate, scope of the audit trail, export guarantee.
• Insert a data reversibility and portability clause in the provider contract.
• Frame the whole through a processing contract compliant with article 28 of the GDPR, since payslips and contracts are personal data.

• Do not confuse the 50-year accessibility (borne by the safe) with the 5-year duplicate kept by the employer: both obligations coexist.
• The simple signature offers weak proof: reserve it for internal documents with no contractual stake.
• The employee's objection to the electronic payslip must be honoured at any time, free of charge and without justification, and has no effect on the employment contract.
• HR dematerialisation handles sensitive personal data: a GDPR processing contract (art. 28) and checking the data location are essential. Confidentiality, which we also address for AI and professional secrecy, fully applies here.
• The absence of a reversibility clause creates dependency on the provider and complicates any future migration.
• As with backing up accounting data, do not delegate blindly: keep a controlled copy of the most sensitive acts.