Security and Trust
How a finished file proves itself, what we keep and where, and the standards the product follows.
How the Seal Works
A signed file carries its own evidence, so it can be checked years later without asking us.
- A Signature for Each Signer
- At the advanced level each signer gets a certificate made for that signing, and a PAdES signature over the document exactly as it stood when they signed. The key is created on our server for that one signing, used once and destroyed, and never stored.
- A Trusted Timestamp
- Every signature carries an RFC 3161 timestamp from an independent timestamp authority: Sectigo, then DigiCert when Sectigo does not answer, and freetsa.org only as a last resort. The authority receives a hash of the signature and nothing else. The finished file carries a document timestamp and the platform's seal.
- The Certificate of Completion
- Each finished envelope comes with a certificate that lists every signer and when they signed, with a QR code that opens the verify page for that envelope.
- A Hash-Chained Audit Trail
- Every event from upload to completion carries the hash of the event before it. The trail is append only: a database trigger refuses any change or deletion, and a removed or altered entry shows as a break in the chain, or as a head hash that no longer matches the certificate.
Adobe Acrobat does not list our seal among the authorities it already knows, so it shows a yellow bar on a file that is intact. Trust This Seal explains why, and how to add the seal to Acrobat.
What We Keep and Where
What you send stays private to your workspace, and the providers that run the product are named.
- Encrypted at Rest
- Documents are encrypted under a key that belongs to your workspace, and that key is itself encrypted under a key the application holds. Passwords are kept as one-way hashes, and signing links as hashes, never as the links themselves.
- A Private Bucket
- Uploaded and signed files live in private storage. Nothing produces a public link to them: every download goes through the application, which checks who is asking first.
The Providers We Use
- Supabase
- The database and encrypted document storage, in the United States.
- Railway
- Runs the application, in the United States.
- Cloudflare
- The network in front of the site and its protection against attacks.
- Resend
- Delivers the emails the product sends: the address, the subject and the links.
- Stripe
- Processes payments for paid plans. Card details go to Stripe directly and never reach us.
The Privacy Policy names every provider and what each one receives, including the timestamp authorities and the cloud drives you choose to connect.
Standards We Follow
The product is built to the controls these standards describe. Whether they meet your own obligations is for you and your advisers to decide.
- eIDAS Article 26 Controls
- 21 CFR Part 11 Controls
- RFC 3161 Timestamps
- Long-Term Validation
- GDPR Data Requests
- WCAG 2.2 AA Target
How It Holds Up says what the product does for each one, and where it stops. Questions about any of this, or a security review to complete? Write to [email protected] and a person answers.
Verify Any File
Anyone holding a sealed file can check it: upload it, or enter the envelope id and hash from its certificate. No account needed.
Send a Document You Can Prove
Start on the Free plan. No card needed.