Security at SigningUS
Last updated: 10 October 2026
SigningUS handles signed documents and the files signers provide. This page summarizes how we protect them. Our contractual commitments are in Annex II to our Data Processing Agreement.
Infrastructure
The application and database run on Amazon Web Services in the United States. Documents are stored with Cloudflare, which also delivers our website and application and provides DNS and DDoS protection. Customer data is logically separated by organization.
Encryption
| In transit | HTTPS on every connection with TLS 1.2 or higher, and HTTP Strict Transport Security |
| At rest | Stored documents are encrypted at rest |
| Passwords | Stored only as bcrypt hashes, never in plain text |
| Downloads | Served through signed links that expire within minutes |
Access
- Senders sign in with email and password, or with Google Sign-In.
- A sender can require a signer to enter a one-time code sent to their email before opening a document.
- Signers open documents through a unique link and do not need an account.
- Bot protection at signup.
- Production access is limited to authorized engineering staff, and staff actions in our administrative console are logged.
Signing records
Each document keeps an audit record of who signed, when, and from which IP address. Any document can be downloaded from your dashboard.
Your control
You decide who receives each document and what files a signer is asked to provide. You can remove a document from your dashboard at any time, and request permanent deletion of your data at privacy@signingus.com.
Reporting a security issue
Email security@signingus.com. We aim to acknowledge reports within 3 business days and ask that you give us reasonable time to fix an issue before disclosing it publicly.
Vulnerability disclosure policyIncident response
If a personal data breach occurs, we notify affected customers without undue delay and, where feasible, within 72 hours of becoming aware of it.
Privacy and compliance
| E-signature laws | See our E-Signature Legality page |
| Data protection | Privacy Policy and Data Processing Agreement, with standard contractual clauses |
| Subprocessors | Listed at signingus.com/subprocessors |
| AI | Customer content is never sent to an AI provider or used to train models |
| Certification | SigningUS does not yet hold SOC 2 or ISO 27001 certification |
Questions: security@signingus.com
Legal documents