Security & Trust

✓Encryption in transit

Every page, upload, and download uses HTTPS (TLS), and browsers are told to always use HTTPS for docautosign.com (HSTS).

✓Encryption at rest

Your account data, documents, and signature images are stored with Supabase (database and private file storage), which encrypts stored data at rest.

✓Access control

You must sign in to see your workspace. Database rules (row-level security) let each account read only its own documents, and document files sit in a private storage bucket, not on public URLs.

Each signer gets a unique, randomly generated link that opens only the document they were invited to sign. Passwords are handled by our sign-in provider and stored only as a secure hash, and new accounts must confirm their email.

✓Audit trail

Each document keeps an activity record (created, edited, sent, viewed, signed, completed, downloaded) with the time, and the IP address and browser for signing events. Only the document owner can read it, and it can't be edited from the app.

Completed documents get a signing certificate page with each signer's name, email, time, IP address, and a SHA-256 fingerprint of the original PDF.

✓Data deletion

You can delete your documents in the app at any time; permanently deleted documents are removed from your workspace and storage.

To delete your whole account and its data, email support@docautosign.com from the address on your account. We confirm and complete requests within 30 days.

✓We don't sell your data

We never sell your personal information or documents, and we don't use your documents for advertising.

AI features send only the area or photo you choose to OpenAI's API, and only when you use them. Payments are processed by Stripe; we never see or store your full card number.