Security overview · Updated August 22, 2026

How SignApprove protects early-access workflows

This page describes controls currently implemented in the SignApprove service. It is not a certification or promise that risk can be eliminated.

Transport and application access

Production traffic uses HTTPS with modern TLS. Workspace routes require authenticated, expiring sessions; roles and tenant checks limit access. Passwords are one-way hashed. Users can change passwords and revoke sessions, and team role or status changes revoke affected sessions.

Documents and signing links

Uploaded PDFs are kept outside the public web root and are served only after an authorization or active-token check. Uploads have byte, MIME, structure, page, encryption, active-content, attachment, and parser-time limits. Signing links are random, stored as hashes, single-workflow scoped, and revoked when an envelope completes, expires, is declined, or is voided.

Signing evidence

The completion workflow records the consent version, signer intent, relevant timestamps, document hashes, and audit events. Completed evidence can include a verification code and integrity digests. SignApprove does not claim notarization, biometric identity proofing, immutable storage, or guaranteed legal validity.

Operations and recovery

The service uses container health checks, a background-worker heartbeat, queue monitoring, bounded logs, and scheduled backups. Release changes retain a rollback point. Backups are verified and restore-tested. These controls reduce risk but do not replace a customer's own document-retention and continuity plan.

Integrations and secrets

API keys are shown once, stored as hashes, and can be revoked immediately. Outgoing webhook secrets and queued email bodies are encrypted with the application key; delivery uses signed events, retries, and bounded failure states. Provider credentials remain restricted to server configuration.

Data encryption limits

HTTPS protects data in transit. SignApprove does not currently claim end-to-end encryption, customer-managed keys, or per-document encryption at rest. Authorized application processes and infrastructure administrators may access stored data when required to operate, support, secure, or recover the service.

Reporting a concern

Send suspected vulnerabilities or incidents to security@signapprove.com. Include a description and safe reproduction details; do not access other people's data or disrupt the service. We will acknowledge actionable reports and coordinate remediation.