Security, in plain terms
No badges, no “bank-grade” slogans. Here is what actually happens to a document, and where we are still short.
Signing your own document
The PDF is opened, filled and re-saved inside your browser. It is never uploaded, so there is no copy of it on our servers to leak, subpoena or lose. That is also why this tier can be free and uncapped. It costs us nothing but static hosting.
Sending a document for signature
This one needs a server: the recipient has to fetch it. The file is encrypted in transit (TLS) and at rest, reachable only through a single-use link, and deleted 30 days after the envelope completes. You can delete it earlier at any time.
What makes a finished document tamper-evident
Completed PDFs are sealed with a PAdES digital signature (ETSI.CAdES.detached) applied to the final bytes, plus an RFC 3161 timestamp when the timestamp authority answers. Change one byte afterwards and any reader that checks signatures will say so.
A certificate of completion is appended as a real page: every event, who signed, when, from which address, the consent text they agreed to, and the final document hash.
Who can read your data in our database
Every table is behind row-level security, so a query can only ever return rows belonging to the requesting account. The isolation is enforced by the database itself, not by application code that could forget a filter.
What we deliberately do not collect
No analytics SDK, no ad tracking, no third-party session recording. Errors and usage counts go to our own database with no IP address, no user agent and no cookie attached. The cookie banner says “first-party only” because that is the whole list.
Where we are still short
- No publicly trusted signing certificate yet. Adobe Acrobat shows a “validity unknown” banner on our sealed files: the seal and the audit trail are real, the issuer simply is not in Adobe’s trust list. Buying one is on the list; until then we would rather you hear it here.
- No third-party security audit. Two people build this. Claiming otherwise would be the first dishonest thing on the site.
- Local law decides what may be signed electronically. That limit applies to every provider, us included.
Found something we got wrong, or something that worries you? Tell us. We would rather fix it than have you quietly leave. See also the privacy policy.