Trust

Security Policy

Effective July 18, 2026

SignWorkflow is designed with security-focused application patterns for document workflows that need controlled access, reliable audit context, and careful operational handling. This policy summarizes the product controls and shared responsibilities that support secure use of the platform.

Security principles

SignWorkflow separates public and private application surfaces, limits sensitive actions through workspace authorization, records security-relevant document events, and designs retention-aware workflows so important records are not removed prematurely. Security outcomes also depend on deployment configuration, vendor controls, and customer access practices.

Application security controls

Authentication and sessions

SignWorkflow uses authenticated sessions, refresh-session tracking, secure cookie handling, CSRF controls, and session revocation patterns to protect private application areas.

Workspace access control

Workspace membership, role-aware checks, team boundaries, and plan gates help restrict sensitive actions to users with the right authority.

Auditability

Document and governance events are recorded so teams can review signing activity, status transitions, retention decisions, and administrative actions.

AI review boundaries

AI-assisted summaries, translations, clause explanations, and risk analysis are access-controlled and should be treated as review assistance rather than legal advice.

Implementation details

Authenticated application routes separate public marketing pages from private workspace actions.
Workspace roles and plan gates limit sensitive actions such as audit exports, retention changes, billing, and member administration.
Document events are written into audit-oriented records so teams can review status changes, signer activity, and governance actions.
AI document review features are gated by workspace access and plan entitlements before summaries, translations, explanations, or risk analysis are generated.
Retention and legal-hold workflows are designed to prevent premature deletion when a record still needs to be preserved.
Google Drive and Dropbox exports use per-user connections so completed PDFs are exported only when an authorized user initiates the action.

Data protection

SignWorkflow is built to protect documents through authenticated access, scoped workspace permissions, controlled storage access, and secure transport between the browser and the application. Completed documents, signing metadata, and audit-oriented records should be handled according to the retention and access settings chosen by each workspace.

Document integrity and audit trails

Signing flows are designed to preserve document context, signer activity, timestamps, status changes, and governance actions. These audit-oriented records help customers understand what happened during a document lifecycle and support internal review after a document is completed.

Availability, backup, and recovery

Availability and recovery depend on the production deployment, database configuration, storage provider, backup policies, monitoring, and incident response process used for the environment. Production operators should maintain backups, recovery procedures, alerting, and access controls appropriate to their risk profile.

Operational security

Secrets, API keys, payment credentials, and storage credentials should be managed through deployment environment controls.

Production storage, database, email, and cloud export providers should be configured with least-privilege access.

Customers are responsible for inviting only authorized users, removing stale access, and reviewing workspace membership regularly.

Regulated workflows may require additional contractual, compliance, and vendor-review steps before sensitive data is uploaded.

Compliance positioning

SignWorkflow is designed with GDPR-oriented privacy controls, auditability, role-aware access, and retention-aware product behavior. This page does not claim SOC 2, ISO 27001, HIPAA, eIDAS, or other independent certification unless a separate, current report or agreement explicitly states that certification or commitment.

View the Trust Center

Customer responsibilities

Customers should configure workspaces carefully, use strong passwords and MFA where available, invite only authorized users, review role assignments, manage connected cloud accounts, and avoid uploading regulated or highly sensitive data until the correct agreements and internal approvals are in place.

Responsible disclosure and questions

If you believe you have found a vulnerability, or if your team needs a security review, contact SignWorkflow through the contact page. Please include enough detail for the team to reproduce and assess the issue, and do not access, modify, or disclose data that does not belong to you.