The short version
- Documents, signatures and field answers are encrypted end to end, in the sender's and signer's browsers. We never receive the keys, so we cannot read them, and neither can anyone who breaks into our servers.
- Every envelope has a tamper-evident audit trail and a certificate of completion, and every workspace has a hash-chained audit log you can export and verify.
- We tell you plainly which certifications we hold and which are in progress below. We don't claim an audit we haven't passed.
1. Security model
eDocYouSign is built so that the service itself can't read your documents.
- Encryption in the browser. Each document gets a random 256-bit key and is encrypted with AES-256-GCM before upload. Field values, signatures, attachments, comments and markups are encrypted the same way.
- Access codes. Each document key is wrapped with a 20-character access code (100 bits of randomness, stretched with PBKDF2-SHA-256, 310,000 rounds). The sender shares the code with signers by phone or text; it never reaches our servers.
- Two-person recovery (optional). A workspace can turn on recovery so that two of its own administrators together can recover a lost key. We hold no recovery key.
- What we can see. Document titles, sender and signer names and email addresses, envelope status, and the audit trail. We need these to deliver documents and keep records.
- Verification without disclosure. Anyone can check a signed PDF against its QR code or fingerprint on our public verification page, without the document's content being shown.
2. Compliance status
| Framework | Status | Notes |
|---|---|---|
| U.S. ESIGN Act and UETA | Supported | Signers consent to electronic records, can download what they sign, and every step is recorded in the audit trail and certificate of completion. See our E-Sign Disclosure. |
| SOC 2 Type I / Type II | [In preparation: readiness assessment complete, audit planned for Q_ 20__] | Our controls are mapped to the AICPA Trust Services Criteria (security, availability, confidentiality). We will publish the auditor's report here when it is issued, available under NDA. |
| ISO/IEC 27001 | [Not certified] | Our information security policies follow ISO 27001 Annex A controls. |
| HIPAA | Business associate agreement available | On Business and Enterprise plans. Because documents are end-to-end encrypted, protected health information inside documents is not readable by us. Read our BAA template. |
| CCPA / CPRA and state privacy laws | Supported | See the Privacy Policy. We don't sell or share personal information for targeted advertising. |
| GDPR | [Data processing agreement on request] | Data is stored and processed in the United States. |
| PCI DSS | Handled by Stripe | Card details are entered on Stripe's pages and never touch our servers. |
3. Controls in place
A summary is below. The full security controls matrix maps each control to SOC 2 and says where the evidence is.
| Area | What we do |
|---|---|
| Sign-in | Passwords of 12+ characters, with breached-password detection and brute-force lockout through our identity service; multi-factor authentication with an authenticator app is required for every account; single sign-on (SAML/OIDC) on Business and Enterprise; sign-in alerts and session review. |
| Access control | Workspace roles (owner, admin, member); support staff can't open documents and need the customer's approval to view a workspace. |
| Encryption | End-to-end encryption for documents and answers; TLS 1.2+ in transit; HSTS; secrets in a private folder outside the web root. |
| Application security | Strict Content Security Policy, CSRF protection, rate limiting, input validation on every request, no third-party scripts in the app or on documents, encrypted uploads checked before storage. |
| Logging | Hash-chained, tamper-evident audit log for each workspace, exportable with a verification report; envelope audit trails on every certificate. |
| Availability | [Daily encrypted backups kept for 30 days; restore tested quarterly]; health checks and automatic updates with one-click rollback. |
| Change management | Every release is tested with automated end-to-end tests before it ships; update packages are checked file by file with SHA-256, and automatic updates require an Ed25519-signed manifest. |
| People | [Background checks, security training at hiring and yearly, least-privilege production access] |
4. Signer identity
Every signer needs their access code. Senders can add more checks: a one-time code texted to the signer's phone, a photo ID check with a selfie through Stripe Identity, or signing in person on the sender's device. The certificate of completion records which checks each signer passed. For photo ID checks we keep only the verified name, the country and whether it matched; Stripe holds the images under its own privacy policy.
5. Subprocessors
These companies help us run the service. None of them can read your documents, because documents are encrypted before they leave your browser.
| Company | Purpose | Data they process | Location |
|---|---|---|---|
| GoDaddy Operating Company, LLC | Web hosting and database | Account and envelope records (no document files) | United States |
| Backblaze, Inc. (B2 Cloud Storage) | Document storage, backups and snapshots | End-to-end encrypted documents and signed copies; encrypted backups | United States |
| Stripe, Inc. | Payments; photo ID checks (if used) | Billing details; ID images and selfies for signers who are asked for an ID check | United States |
| Twilio Inc. (SendGrid) | Email delivery; text message codes (if used) | Email addresses, message metadata; signer phone numbers | United States |
| Google LLC | Website analytics, only with consent | Pseudonymous website usage. Never used in the app or on documents | United States |
We give customers 30 days' notice by email before adding a subprocessor that processes customer data.
6. Data retention and deletion
- Envelopes and templates are kept until the workspace deletes them or closes its account.
- When an account is closed, its documents, templates and forms are deleted from live systems within 30 days and from backups within [60] days.
- Audit logs are kept for [7] years to support legal records, then deleted.
- Owners can export their audit log at any time from the Audit log page.
7. Incident response
We keep a written incident response plan with roles, severity levels and a communications process. If we confirm a security incident affecting customer data, we notify affected customers without undue delay and within 72 hours, with what happened, what data was involved and what we are doing about it. Because documents are end-to-end encrypted, a server breach doesn't expose document contents.
8. Reporting a vulnerability
If you find a security issue, email support@edocyousign.com with the details and steps to reproduce. Please give us reasonable time to fix it before disclosing it publicly, and don't access other people's data or disrupt the service. We won't take legal action against good-faith research that follows these rules. Our contact details are also in security.txt.
9. Documents you can request
- Security controls matrix: each control mapped to SOC 2, with where the evidence is
- Service level agreement: availability, support response times, backups and service credits
- Evidence pack: workspace admins download it from the Compliance page
- Business associate agreement (HIPAA) template
- Data processing agreement
- Completed security questionnaire (SIG Lite or CAIQ)
- Penetration test summary [once available]
- SOC 2 report [once issued, under NDA]
Email support@edocyousign.com to request any of these.
This page describes how eDocYouSign protects customer data. It is not a contract; the Terms of Service and any signed agreements govern. Items highlighted in yellow must be completed by the operator before publishing.