Security

What is true today

Area	Measure
Encryption in transit	TLS on every connection to the service, with HSTS for two years, preloaded
Encryption at rest	AES-256 on the database and on every file store: documents, exports and data room files
File access	Files are never public. A link to a file made while you are on the page expires within 15 minutes; a link we email you, to open a signed document or an export later, lasts seven days. Both are issued only to somebody entitled to that file at that moment
Signing links	184-bit random tokens, unique per recipient, rotated when a document is resent, void once the document is complete, voided, or declined
Codes	A data room guest types a six-digit code sent to their address, once on each device; it lasts ten minutes and allows five tries, and only a hash of it is kept. A sender can ask for a code texted to a signer's phone before their document opens
Audit trail	Every event on a document is written to a table the database will not let anyone change, and each row is hash-chained to the one before, so a break in the chain is detectable. A trail is removed only with its document: when a deleted document is purged after 30 days, or its workspace is deleted
File integrity	Original file fingerprints are printed on the certificate of completion. The completed PDF has its own SHA-256 fingerprint recorded and checked at /verify. Each night, independent timestamps are requested from DigiCert and Sectigo; verification shows the authorities that have responded and any proof still pending
Isolation	Every record belongs to a workspace; every read is scoped to the caller's workspace and role
Data region	Documents, signatures and exports of European workspaces stay in the EU (Frankfurt), and of others in the US (N. Virginia). The database is in the EU for every workspace, and data room files are kept in Western Europe for every workspace. Where a feature reads a document for you, such as a contract's dates, the passages it reads are sent to TypeSafe in the US, which does not train on them
Files coming in	Documents to sign, templates and new versions need a clean virus-scan verdict before acceptance, including Word files before conversion to PDF. Guest downloads require a clean verdict too; an unavailable scanner or unreadable file is withheld. Guest-submitted room files are inspected for active content, macros and hidden files, and findings are shown for review. These content checks inspect up to the first 8 MB and are not a guarantee that a file is safe
API keys and webhooks	A key is shown once and stored only as a hash, limited to the scopes you choose, and can expire or be revoked. Every webhook is signed with HMAC-SHA256, with two secrets accepted while you rotate
Rate limiting	Signing, files, sign-in codes, verification and billing are rate limited per address
Headers	Content sniffing disabled, framing denied except for an embed you grant, referrer suppressed on signing pages so tokens never leak
Secrets	Held in our hosting platform's encrypted configuration and our build pipeline's secrets, never in code or logs
Backups	Point-in-time recovery on the database, and a daily copy in a separate bucket protected against change or deletion for 28 days, followed by daily permanent cleanup within the 30-day deletion window. Older copies already locked for 30 days retain their original lock. A restore is rehearsed every month
Access by us	Support looks into a workspace only when you ask: read-only, for 30 minutes at a time, with the reason written down, and shown in your workspace's own activity
Status	status.sharesign.co, run apart from the service so it stays up when the service does not

What is planned

SOC 2 Type 1, followed by Type 2, and an independent penetration test.

Reporting a vulnerability

Send details through the support form. We acknowledge within two working days, do not take action against good-faith research, and credit reporters who want it.