Security
Security by design
We’re a young, agile company. Instead of spending on auditors first, our resources go straight into technical security. Our measures are oriented at ISO 27001 and BSI IT-Grundschutz — and we document them openly here so you can verify them.
No certificate badges — a plain list of what we actually do, so you can check it against your own requirements. The same measures are part of our data processing agreement, where they are a contractual commitment to you.
Identity & access
- Two-factor authentication (TOTP) with recovery codes for every account
- Sign in with Google or Apple, or email + password hashed with bcrypt
- Sessions in HttpOnly, Secure, SameSite cookies; you are told about every new sign-in
- Roles — owner, admin, editor, viewer — so nobody holds more than their job needs
Least privilege
- API keys reach only the workspaces you choose, can expire, are shown once and stored hashed
- Services run as unprivileged users in separate containers; the renderer talks to the app only with a shared secret
- The database is reached through a restricted role; Postgres row-level security blocks cross-account reads even if the application had a bug
- Every administrative action is written to the audit log
Data protection & isolation
- Hosted in the EU (Hetzner, Nuremberg); DPA with technical and organisational measures included
- Stored secrets — webhook signing keys, registry and backup credentials, two-factor secrets, template passwords — are encrypted with AES-256-GCM
- Documents are private; downloads use short-lived signed links
- You control retention and can export or delete everything; deletions have a grace period
- Documents and the database run on Hetzner servers in Germany; daily database backups go to Hetzner object storage in the EU, kept 30 days, separate from the application data
Document integrity
- Every completed e-signature document is locked against editing, sealed with a digital certificate and gets a SHA-256 fingerprint
- Signers confirm a consent statement; the audit trail is hash-chained so nothing can be altered unnoticed
- Anyone holding a PDF can verify it on our public verification page — without uploading it Open the verification page →
- Webhooks are signed (HMAC-SHA256) and retried automatically
Resilience & abuse protection
- Rate limits per plan and sign-up throttling
- Hard limits on document size and pages; the renderer runs isolated with timeouts, so one bad document never takes the service down
- Outbound fetches (images in templates) are restricted to allowed hosts — no server-side request forgery
- Error monitoring and daily backups with off-site copies
- A strict Content Security Policy: no inline scripts, no eval on public pages, scripts only from our own origin and allow-listed services
- Incident response: reports are triaged within one business day; affected customers are notified within 48 hours of a confirmed breach, as our DPA commits
Standards we align with
- Security measures oriented at ISO 27001 and BSI IT-Grundschutz, written into our data processing agreement as a contractual commitment
- Cryptography following the BSI technical guideline TR-02102: AES-256-GCM, SHA-256, RSA-3072 document seals, TLS 1.2 or newer
- State of the art as required by Art. 32 GDPR
- E-signatures as simple electronic signatures under eIDAS — we say plainly what they are and aren’t
What we don’t claim
We are not ISO 27001 or SOC 2 certified yet, and we don’t claim to be. Until we are, we publish our measures here and update this page whenever they change.
Responsible disclosure
Found a vulnerability? Write to us — we read every report and won’t take legal action against research done in good faith. Our security.txt points to the same address. [email protected]
Need more detail?
Our data processing agreement lists the technical and organisational measures as a contractual commitment, and the security team answers questions directly.