HR & hiring

Employee onboarding and right-to-work checks

Verify work authorisation and licences, then sign the contract, in one flow.

Use case
Employee onboarding
Wallet data
PID · EAA · QES
Authbound capability
Digital Signatures
Flow
Sign
What changes

Before and after the wallet

Today

  1. Emailed scans
  2. HR glances at them
  3. Separate e-sign tool
  4. Day one

With the EUDI Wallet

  1. Present attestations
  2. Authbound verifies
  3. Sign with QES
  4. Day one

The wallet changes how the evidence is collected. The step at the end stays yours.

The problem

Why this is worth changing

For the business
New hires cannot start until the paperwork is done, and regulated roles carry licence risk.
For the user
New hires send the same documents to several people in different formats.
For operations
HR glances at scans, files them and rarely rechecks licences that later expire.

Why the wallet helps

Work authorisation and licences are attestations from bodies that already hold the record. Request them and you get verified status with validity dates attached, so an expired licence fails at verification rather than at audit. The contract is then signed with a qualified signature tied to the identity you just verified.

  • Onboarding evidence that is verified rather than glanced at
  • Expired licences caught at verification, not at audit
  • A contract signature tied to a verified identity, not an email address
User journey

What actually happens

  1. 01

    You request identity and supporting attestations

  2. 02

    The user gets the request by QR or deep link

  3. 03

    The wallet shows the data and the document

  4. 04

    The user approves on their device

  5. 05

    The wallet presents credentials and signs

  6. 06

    Authbound verifies presentation and signature

  7. 07

    Your backend receives the result and signed document

  8. 08

    Your existing workflow continues

How it works

Three steps with Authbound

  1. Step 01

    Verify work authorisation

    Request the attestation and receive verified status with its validity period.

  2. Step 02

    Check role licences

    For regulated roles, request the professional licence credential and validate it against the issuing body.

  3. Step 03

    Sign the contract

    The new hire signs with a qualified signature bound to the identity verified moments earlier.

Technical flow

  1. Your application
  2. Authbound API
  3. Wallet request
  4. Presentation and signature
  5. Trust and revocation checks
  6. Your backend
Technical details
const verification = await authbound.verifications.create({
  policyId: 'pol_…',      // the claims this flow requests
  customerUserRef: user.id,
});

// Your webhook then receives verification.completed
// with the verified result and its audit record.
  • Request: an OpenID4VP presentation request built from your policy.
  • Hand-off: QR code on desktop, deep link on mobile.
  • Checks: issuer against the EU trust lists, status list revocation, device binding.
  • Result: structured claims plus an audit record, delivered by webhook.
Who does what

What Authbound handles, what you handle

Authbound handles

  • The wallet request, with QR on desktop and a deep link on mobile
  • Verifying the presentation the wallet returns
  • Checking the issuer against the EU trust lists
  • Revocation and device binding checks
  • A structured result delivered to your backend
  • An audit record of every verification

Your application handles

  • Choosing which attributes the flow requests
  • Your business logic and account creation
  • Day one
  • Risk and fraud decisions
  • How long you keep the result
  • A path for users without a wallet
What's involved

Credentials, standards and rules

Wallet presents

  • PID
  • EAA
  • QES

Regulatory context

National employment and right-to-work law, eIDAS 2.0, GDPR

Right-to-work and professional licensing rules are national, and so are retention periods for employee records. eIDAS 2.0 makes authority-issued attestations and qualified signatures available through the wallet. The employer’s duty to check and keep evidence stays with you.

Onward demo
Live demo

See the complete flow in Onward

Employee and contractor onboarding with right-to-work proof, licences, and wallet-based contract signing.

What it asks the wallet for

  • work_authorization
  • professional_license
  • contract_signature

What the business gets back

Contract
Signed
Licence status
Verified
Equipment shipment
Released
Open the Onward demo

Onward is a fictional company built by Authbound. The wallet integration in it uses the real Authbound SDK.

Questions

What buyers ask

Does this cover non-EU nationals with work permits?

Where a member state issues residence or work permit attestations into the wallet, yes. Coverage varies by country and permit type, so keep the document route as a fallback.

Can we recheck a licence periodically?

Yes. Credentials carry validity periods and revocation status, so a scheduled recheck is an API call rather than another document chase.

Is a wallet-signed employment contract enforceable?

A qualified signature has the legal effect of a handwritten one under eIDAS across the EU, which puts it ahead of most e-signature tools used for employment contracts today.

Can we keep our HR system and e-signature tool?

Yes. Verified results and signed contracts land in your HR system through the API and webhook, and your existing tools keep handling everything else.

What does our HR system receive?

Verified work authorisation and licence status with validity dates, the signed contract, and a verification ID for the employee file.

What if the new hire has no wallet?

Use your current document process. The wallet makes the common case fast without removing the fallback.

Does it work for hires from other member states?

Yes. Identity and attestations from any EU wallet are verified the same way.

What happens if a licence has been revoked?

The revocation check fails at verification, so the problem surfaces before the start date rather than at audit.

Who pays for the signature?

Wallet QES is free for non-professional use. An employee signing their own contract is generally treated as private use, but member state rules can differ.

When can we start using it?

Every member state has to offer a wallet by 24 December 2026. Private services that are legally or contractually required to use strong user authentication have to accept it from December 2027 when the user asks. Attestation coverage for licences and permits will grow country by country.

Next step

Have a different wallet use case in mind?

Tell us what you are trying to build. We will map the user journey, the credentials and the wallet interaction to an implementation.