Using Your DSC Safely
It is a legal signature on a USB stick. Most offices treat it like a spare key, and that is the whole problem.
What the risk actually is
Anything signed with your certificate is signed by you. Not by your office, not by whoever was holding the token — by the person named on it. If a filing is made in error or a payment authorised that should not have been, the record shows one name.
That is not a theoretical exposure. Company filings, tax returns, tender bids and bank authorisations all carry consequences, and the signature is what attaches them to a person.
The habits worth having
- Do not share the token or the PIN. If several people file, buy several certificates.
- Do not write the PIN on the token. This is common and it removes the only protection a lost token has.
- Do not leave it plugged in. A token in a machine anyone can reach is available to anyone who reaches it.
- Stop after two wrong PIN attempts. Tokens lock permanently and there is no reset.
- Report loss immediately so the certificate can be revoked, before arranging a replacement.
- Revoke on departure when someone who held a company certificate leaves.
Written 5 September 2026. Government requirements and portal behaviour change — message us to confirm before you rely on any date or figure here.
And one about where drivers come from
Install token drivers only from the vendor or the certifying authority. Guides that offer a driver download from their own site, or tell you to disable antivirus, are asking you to run unverified software on the device holding your legal signature.
If you are not sure which vendor made your token, ask us rather than guessing at a download.
Common questions
Send us your case
Tell us how the certificate is currently being used in your office. We will tell you straight whether it is a problem.
WhatsApp +91 89823 80224Related on this site
Other certificate questions people arrive with, and the portals they need one for.