The key never leaves the workstation
A1 and A3 certificates are read where they live, by a service on the machine itself. Nothing exportable crosses the network, and no certificate is copied to the Server to be signed with.
TrustBridge
On-premises signing platform
Signatures that never move
the certificate.
TrustBridge signs documents with the certificates already installed on the workstations your people use. The private key stays on the machine that holds it — a hash goes out, a signature comes back.
The holder authorises every session
Signing needs a PIN typed by the person sitting at the workstation. The session that PIN opens is bound to one holder and one certificate, and expires on its own when the signing stops.
Deployed inside your own network
One Server, one port, your database. The console, the machine channel and the published contract are all served from the same host you already control.