Security you can verify.

Document integrity

• Cryptographic signatures. When an envelope completes, the sealed PDF is signed with a detached PKCS#7/CMS signature using a private key held in AWS KMS, under a certificate authority we publish. The signature proves both authenticity (it came from us) and integrity (the file hasn't changed).
• Independently verifiable. Upload a document to verify it, or download our CA certificate and verify with standard tools like OpenSSL.
• Tamper-evident sealing. The SHA-256 of the sealed document is recorded; re-hash the downloaded file and compare at any time.
• Certificate of completion. Every finished envelope includes a certificate listing each party, timestamps, IP addresses, signing method, and the document hashes.
• Full audit trail. Creation, viewing, consent, signing, approval, reassignment, decline, void, and completion are all recorded with actor, time, and IP.
• Consent capture. Signers affirmatively consent to electronic records and signatures before signing, aligned with the U.S. ESIGN Act and UETA.

Encryption

• In transit. All traffic is HTTPS only, with HSTS enabled.
• At rest. Documents in object storage and data in the database are encrypted. Sensitive secrets — SSO client secrets, webhook signing keys, and TOTP seeds — are additionally encrypted with a dedicated customer-managed key (AWS KMS) before storage.

Authentication & access

• Strong passwords. Hashed with scrypt; logins are rate-limited per account and per network.
• Two-factor auth. TOTP authenticator-app MFA, with session listing and revocation.
• SSO & SCIM. OpenID Connect single sign-on (authorization-code flow with PKCE, verified ID tokens) and SCIM 2.0 provisioning, so deactivating a user in your IdP revokes their access.
• Role-based access. Organization roles (admin, sender, viewer) with per-envelope authorization and tenant isolation.

Application hardening

• Strict Content-Security-Policy (no inline scripts) with Subresource Integrity on third-party scripts.
• HttpOnly, Secure, SameSite cookies; CSRF-resistant by design.
• Server-side validation on every input; outbound webhook and SSO requests are SSRF-guarded against internal/metadata targets.
• Signed, retried webhook delivery via a durable queue with a dead-letter queue.

Infrastructure

• Serverless on AWS with least-privilege IAM per function.
• 100% infrastructure-as-code (Terraform) with encrypted, locked remote state.
• Point-in-time recovery on the database and versioning on document storage.

Found a security issue? We want to know. Please report it to the security contact published by the operator of the Service.