Draw n Sign

Legal

Security

Last updated [10 August,2026]

This page describes how Draw n Sign protects accounts, documents, signatures, and audit evidence. It is informational and does not create contractual security SLAs beyond our Terms of Service unless we agree otherwise in writing.

1. Our approach

Draw n Sign is designed so completed signatures leave a durable, inspectable trail: append-only audit events, content hashing, Document IDs for verification, and public verify pages that expose metadata without offering public PDF downloads.

2. Authentication & sessions

  • Account access uses hosted authentication ([AUTH PROVIDER]).
  • Sessions persist across visits with an inactivity timeout of [SESSION IDLE PERIOD] (currently aligned to product settings).
  • Soft-deleted accounts cannot continue to use the dashboard.
  • You are responsible for protecting your credentials and for activity under your account.

3. Access control

  • Document access is enforced with database row-level security (RLS).
  • Signers use secret, typically single-use signing links rather than requiring an account.
  • Admin access is limited to users with profiles.role = admin.
  • Signed documents cannot be deleted by end users or admins via normal product flows (enforced in the data layer).

4. Audit trail & integrity

  • Key lifecycle events (for example created, sent, opened, signed, closed) are recorded with actor, time, and, when available, IP address and user-agent.
  • Audit events are append-only.
  • Hash chaining / content hashes support integrity checks on the public verify page.
  • Attempts to forge or misrepresent audit evidence are prohibited (see Terms).

5. Storage & encryption

  • PDFs and signature assets are stored in private object storage buckets, not public web folders.
  • Signed PDFs are retained for verification and owner re-download in line with our retention policy.
  • Data in transit should use HTTPS/TLS in production. Data at rest relies on our cloud provider encryption. [CLOUD / STORAGE PROVIDER] [⚠ LAWYER REVIEW / ops confirmation]

Treat signing links as secrets. Forwarding a link allows the recipient to open or sign. Links may expire or become single-use after completion according to product rules.

7. Operational practices

  • Prefer least-privilege API keys (publishable/anon vs service role).
  • The service role key must never be exposed to browsers or public clients.
  • Review who holds admin role carefully.
  • Separated environments for development and production where practical.

8. Incident response & vulnerability reporting

If you believe you found a security issue, email [SECURITY CONTACT EMAIL] with steps to reproduce. Please allow reasonable time for investigation before public disclosure. We may notify affected users and regulators where legally required. [⚠ LAWYER REVIEW]

9. Limitations (shared responsibility)

No system is 100% secure. You must: choose strong credentials; verify recipient emails before sending; protect signing links; and decide whether electronic signatures meet your legal needs. Certificate-based or Adobe-trusted features (where offered on paid tiers) depend on correct certificate and deployment configuration.

10. Contact

Security: [security@drawnsign.com]. General: [info@drawnsign.com]. [Draw n Sign].