Security
How SignVault is being built to protect documents and the people who sign them.
Private links
Each signer gets a long, unguessable link that expires. A link only opens the one document it was created for.
Documents are kept private
Uploaded and signed PDFs are stored outside the public part of the website, so they can't be reached by guessing an address. They are served only through checked requests.
Protected staff accounts
- Every staff account must use two-factor authentication with an authenticator app.
- Passwords must be at least 12 characters, and repeated wrong attempts lock the account for a time.
- Sessions end after a period of inactivity.
- Passwords, database logins and keys are kept outside the website's files.
Secure connections
The site is served over HTTPS and sends standard security headers to protect against common attacks.
Evidence you can rely on
Every signing records who signed, when, from where, and a fingerprint of the document before and after, so tampering can be detected.
Collecting only what's needed
To get a document signed we need the signer's name and email address. We don't ask signers to create an account.
Before we open to customers
We plan independent security testing, a tested backup and restore process, and published terms and data-processing arrangements before SignVault accepts customers' documents.