Security at Signyd
Last updated: October 24, 2026 Signing an agreement means trusting a platform with sensitive documents, identities and evidence. This page describes how Signyd protects that trust. It summarizes the measures we use today, and it will change as we improve them. For how we handle personal data, see our Privacy Policy. For how signatures and seals are produced, see the Signature and Sealing Practices Statement.1. Our approach
- Security by design: protection of documents, signatures and audit evidence is built into the product, not added afterwards.
- Data minimization: we collect only the data needed to run the Service and keep it only as long as needed.
- Defense in depth: several independent layers (network, application, identity, cryptography and process) so that no single failure exposes your documents.
- Transparency: we name the providers we rely on and tell customers when something affects them.
2. Infrastructure and data location
The Signyd application at app.signyd.com runs on Cloudflare’s global network. Documents and other Customer Content are stored in Cloudflare R2 object storage located in the United States, and application data is stored in Cloudflare D1. Our marketing website and corporate email are hosted with Gellum. Our product documentation is hosted with Mintlify. The full list of providers is in section 11.3. Encryption
- In transit: all connections to the Service use TLS.
- At rest: documents and application data are encrypted at rest by our infrastructure providers.
- Document integrity: every document is fingerprinted with a cryptographic hash when it is sent and when it is completed, so any later change can be detected.
4. Cryptographic sealing and audit trail
When all parties have signed, Signyd generates the completed PDF and a Certificate of Completion, then cryptographically signs and seals the file.- Platform signature and seal: a detached PKCS#7 signature (RSA-SHA256). Private keys are held in an HSM and are not stored in application code or the application database. The PDF signer name is Signyd.com.
- Certificates and time: Signyd’s certificates are AATL. A trusted TSA applies an RFC 3161 timestamp.
- Tamper evidence: if a sealed document is modified after completion, compatible PDF readers show that the platform signature is no longer valid.
- Audit trail: the Certificate of Completion records key events, timestamps, IP addresses, the document hash and a hash of each signer’s email address.
5. Authentication and access control
- Login: account authentication and session management are handled by Clerk, a specialized identity provider, rather than by custom-built login code.
- Signer access: signers can access documents through secure, single-use magic links sent to their email address.
- Team access: owners and admins control who is on the workspace (Member or Admin). Members cannot open Settings, billing, or API keys.
- Internal access: access to production systems is limited to the people who need it for their role.
6. Identity verification (Signyd Verify)
When a customer turns on Signyd Verify, identity document and biometric checks are carried out by Didit (didit.me). Signers are told what will be collected and asked for consent before the check starts, where required by law. Biometric data and document images are not sold, are not used for advertising, and are deleted according to the retention schedule in our Privacy Policy.7. Payments
Payments are processed by Stripe. Signyd never sees or stores full card numbers. Stripe is responsible for the security of card data under its own security programs.8. Email
Signature requests, notifications and other transactional messages are sent through Cloudflare Email Service. Emails contain secure links rather than the documents themselves.9. Application security and monitoring
- Secure development: changes are reviewed via GitHub Pull Requests before release, and dependencies are kept up to date using automated tools.
- Input protection: the application protects against common web attacks such as cross-site request forgery, injection and abuse of public endpoints, with additional protection from Cloudflare’s network.
- Logging and monitoring: we keep security-relevant logs and monitor the Service for errors and suspicious activity.
- Backups and resilience: data is stored on infrastructure designed for high availability.
10. Data retention and deletion
Customers can export their documents before leaving the platform. After an account is closed, and after the export period described in our Terms, we delete Customer Content except where we must keep it by law. Signed agreements and their Certificates of Completion may be retained so that their authenticity can be verified. Details are in our Privacy Policy.11. Providers (subprocessors)
We choose providers with established security programs and bind them to confidentiality and data protection obligations. We will update this list when it changes.
12. Incident response
We have a process to detect, investigate, contain and learn from security incidents. If an incident affects customer data, we will notify the affected customers without undue delay and in line with applicable law, including the notification deadlines in the GDPR and U.S. state laws, and we will tell them what happened, what data was involved and what we are doing about it.13. Reporting a vulnerability
We welcome reports from security researchers. If you believe you have found a vulnerability in Signyd, send the details to [security@signyd.com]. Please:- give us reasonable time to fix the issue before disclosing it publicly;
- avoid accessing, changing or deleting data that is not yours, and avoid disrupting the Service;
- do not run denial-of-service, social engineering or physical attacks.
14. Your part in security
Security is shared. We recommend that you:- protect the email accounts that receive signing links and keep them under strong authentication;
- review the members of your team regularly and remove people who no longer need access;
- check that the name and email address of each signer are correct before sending;
- turn on Signyd Verify for documents where confirming identity matters;
- tell us quickly at support@signyd.com if you suspect unauthorized access.