Trust service provider (TSP)
A trust service provider (TSP) offers eIDAS trust services such as certificates or timestamps - qualified or not. What it means and how it is supervised.
A trust service provider (TSP) is the general term eIDAS uses for any natural or legal person that offers one or more trust services. The regulation splits the category in two: a qualified trust service provider (QTSP) has passed an independent audit and appears on the EU Trusted List, while a non-qualified TSP offers the same kind of service without that status - though it still carries baseline eIDAS duties such as incident reporting and a duty of care, and remains under the RDI's lighter, ex-post supervision.
In practice a TSP is one or more of the following:
- a certificate authority, issuing certificates for electronic signatures, electronic seals or website authentication
- a time-stamping authority, binding data to a point in time
- a registered delivery operator, running an electronic registered delivery service
- an archiving or ledger operator, preserving electronic data in a qualified electronic archiving service or recording it in sequence in a qualified electronic ledger
- an attestation provider, issuing electronic attestations of attributes or qualified electronic attestations of attributes
- a remote signing operator, managing a qualified signature creation device on a signer's behalf so they can sign or seal remotely
Anyone may set up as a non-qualified TSP; becoming qualified is a formal process supervised in the Netherlands by the Rijksinspectie Digitale Infrastructuur (RDI), as described in full at qualified trust service provider.
Note: the name alone says nothing about status. A great many commercial certificate authorities and e-signature vendors are trust service providers in the eIDAS sense without ever becoming qualified, so their signatures and seals stay at the 'advanced' level rather than 'qualified' - a real difference in the legal presumption a court will give them.