AesirX ComplianceOne | Vietnam Electronic Transactions Law 20/2023/QH15

readiness, and data-message certification records so teams can maintain a governed evidence trail rather than disconnected spreadsheets. Review and approval records show how eligibility, licensing, and certification decisions were made.

For Decree 23, the platform brings the three verified official forms, provider licensing and readiness evidence, and certificate and signature lifecycle records into one controlled workspace. For Circular 19, teams maintain technical-audit scope, control records, findings, and remediation evidence. For Circular 53, the platform supports data-message certification and integrity evidence without claiming unverified forms or certification outcomes. For the technical-reference cluster, each circular carries one internal working template — applicability, the two software inventories, interoperability, certificate-format evidence, QCVN readiness, and foreign e-signature recognition — filled and reviewed as records rather than run as registers. Recognition itself is not a dossier the platform assembles: what it holds is the position your organization has recorded about a provider on that provider's own record, with the date it was checked and the source it was checked against, and not established available as an answer rather than a default in either direction.

Evidence packs and audit history provide a reviewable record of completed work. Where Electronic Transactions Law activity overlaps identity, data governance, or labor-contract obligations, the same underlying evidence can be linked to the relevant framework without losing its original context.

Trust Service Evidence Under Decree 23's Regime

Decree 23 declares a trust regime, and ComplianceOne reads it from the frameworks an organization has installed. The decree recognises four trust service types – timestamp issuance, data message certification, and public digital signature certification, each requiring a licensed provider, plus the safe specialised electronic signature, which the decree states is not a licensed trust service. The mechanism is not specific to Vietnam: any framework whose pack declares a trust regime is read the same way, so a new instrument arrives as a content update rather than a product change.

Providers are held as records of what the organization has established about each one's standing under the regime. ComplianceOne does not determine whether a provider holds a licence (the supervising authority's published register is the source of truth ) and "not established" is a legitimate recorded answer for an organization that has not yet checked.

A credential carries a lifecycle rather than a status field: issue, activation, suspension, revocation, expiry, and renewal are recorded events with a reason, a time, an actor, and evidence. Revocation and expiry are terminal, so a renewal produces a successor record linked to its predecessor. Signature, seal, timestamp, and data-message checks are recorded as verification events with the algorithm metadata exactly as the verifying tool reported it.

A dossier filed to an authority is recorded as an electronic submission – the channel that carried it, the hash of the payload sent, the receipt that came back, and any later amendment, which never overwrites the original. ComplianceOne records that a filing was made; it does not transmit one, issue any certificate, hold key material, sign anything, or verify a signature itself.