Security and data protection

Security and data protection

• Files do not sit in a public folder

  Uploaded documents are kept on private storage outside the public part of the site and cannot be opened by a direct address. Every download goes through a check of which company the document belongs to. There is no external cloud storage.

• A link and a PIN

  On top of the personal link, the signer also receives an 8-character PIN. Without it the document does not open, and the PIN is stored encrypted in the database rather than as plain text.

• Limited PIN attempts

  Five attempts are allowed per IP address every 15 minutes, and at most 50 attempts for the link as a whole. Failed attempts are recorded and appear in the certificate.

• What is recorded for every signature

  The signer's name, the date and time, the IP address and the browser used. The name, the time and the IP address are also printed under the signature itself in the finished PDF.

• Certificate of electronic signing

  A separate PDF for the administrator only: who uploaded the document and when, when the link was sent, when it was opened, when the PIN was entered, when it was signed, from which IP address and with which browser, plus the deadline and the failed attempts.

• Audit log

  Uploading, sending, signing, declining, deleting, changing a setting — every action is recorded with a timestamp and an IP address. The log is available to administrators only.

• Isolation between companies, and roles

  Each company's data is separated — a request from one account cannot reach another company's document. Inside a team, administrators, managers and members have different rights, and the platform will not let a company end up without an administrator.

• HTTPS, HSTS and CSP

  All traffic runs over an encrypted connection, HSTS forces the browser to use it, and the content security policy limits what the page may load. Documents are never sent around as email attachments.

• GDPR-compliant processing

  Signers' personal data is processed solely for the purposes of that document. Deleting is reversible — a document goes through the trash rather than vanishing without trace. The full terms are in the privacy policy.