Security

A signing platform holds two things worth protecting: the documents themselves, and the evidence that a signature is genuine. This page describes how we handle both.

Documents at rest

Uploaded documents are encrypted on disk using AES-256 in GCM mode, an authenticated cipher — decryption fails outright if the stored bytes have been altered, rather than silently returning corrupted data.

Each document is stored under its own identifier and never under its original filename, so the storage layout does not reveal what a file contains. A SHA-256 hash is recorded at upload and checked when the file is read back.

Documents in transit

All traffic is served over HTTPS. Signing links are delivered by email and open over TLS.

Signing links

Every signer receives a unique, randomly generated link. These links are:

• Single use — once a signature is submitted, the link stops working
• Time limited — links expire 30 days after they are issued
• Stored as a hash, so the database does not need to hold a usable link
• Scoped to one signer and one document

Account protection

• Passwords are hashed with Argon2id, a memory-hard algorithm designed to resist GPU cracking
• Older password hashes are upgraded automatically on next sign-in
• Repeated failed sign-ins lock the account temporarily
• Sign-in attempts are rate limited by IP address
• Two-factor authentication is available on accounts that enable it

Audit trail

Every meaningful action against a document is recorded: upload, signer invitation, link opened, signature captured, and completion. Each entry stores a timestamp and the IP address it came from.

When all signers have completed, a certificate of completion is generated recording who signed, when, and how they were authenticated, along with a hash of the final document so any later change is detectable.

Access control

Documents are readable only by the account that owns them, or — for documents submitted through the partner API — by authenticated staff of the receiving organisation. Requests carry a session token that is validated on every call; document identifiers alone are never sufficient to retrieve a file.

Reporting a vulnerability

If you believe you have found a security issue, please contact us before disclosing it publicly. We will confirm receipt, keep you updated on the fix, and credit you if you would like. See the contact page for how to reach us.