Indonesia's e-signature framework rests on the Electronic Information and Transactions Law (UU ITE, Law No. 11 of 2008), amended by Law No. 19 of 2016 and again by Law No. 1 of 2024, together with its main implementing regulation, Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions.

Article 11 sets a technology-neutral validity test rather than naming a required method. A signature is legally valid if the signature-creation data relates only to the signer, that data was under the signer's sole control at the time of signing, any later change to the signature or the signed document is detectable, there is a specific way to identify the signer, and there is a specific way to show the signer agreed to the content. Any signing method that satisfies these conditions counts as a legally valid electronic signature, whether or not it comes from a licensed provider.

Indonesian law then splits electronic signatures into two categories. A Certified Electronic Signature is issued through a licensed Penyelenggara Sertifikasi Elektronik (PSrE), typically using PKI-based cryptography, and carries a stronger evidentiary presumption because the PSrE has already verified the signer's identity. An Uncertified Electronic Signature, which covers standard click-to-sign and email-verified workflows like Firma.dev's, is equally valid under Article 11, but the party relying on it carries the burden of proving signer identity and document integrity if a dispute reaches court. In practice, that proof comes from the same audit trail, timestamp, and authentication data that a compliant e-signature platform already records.

PSrE licensing only gates the Certified tier, not the right to offer e-signature software in Indonesia at all. A foreign provider without an Indonesian PSrE license can still serve Indonesian businesses; its signatures are simply Uncertified. Ministerial Regulation No. 11 of 2022 requires a PSrE to be an Indonesia-domiciled legal entity meeting a substantial asset threshold, which is why most foreign platforms operate as Uncertified providers rather than seeking local certification. A separate registration duty, for Electronic System Operators (PSE) under Ministerial Regulation No. 5 of 2020, applies more broadly to almost any digital service reaching Indonesian users and sits outside the signature-certification question entirely.

Law No. 1 of 2024 added Article 17(2a), which requires a Certified Electronic Signature for transactions the law treats as high risk. Komdigi and the OJK have since confirmed this covers non-face-to-face digital financial transactions, including buy-now-pay-later products. The carve-out is narrow. It reaches specific financial products, and an ordinary SaaS agreement, NDA, or vendor contract falls outside it entirely.

A separate set of transactions sits outside the ITE Law altogether because Indonesian law requires a notarial deed with the signer physically present: land and property transfers through a Land Deed Official (PPAT), corporate deeds of establishment, and secured-lending instruments such as mortgages (Hak Tanggungan) and fiducia security. No electronic signature, certified or not, substitutes for the physical notarial process in these cases.

For most SaaS companies and their commercial counterparties, this leaves a wide lane: an audited, identity-verified Uncertified Electronic Signature is legally sufficient for the great majority of B2B contracts in Indonesia. The exceptions are specific and predictable rather than broad, covering notarized transactions and a narrow slice of regulated financial products.