Where your data is, and how it is backed up
All SignSpry data is hosted in Mumbai for every customer. How backups work, how often, and what leaves Mumbai.
All customer data lives in one place: Amazon Web Services in Mumbai, India (ap-south-1). That includes the database, the documents, the audit trails and the backups, for every customer in every country. This is a decision, not a default. There is no other data region, and none is planned.
What is stored in Mumbai
- your organisation's account, people and settings
- envelopes, documents, signatures and sealed PDFs
- audit trails and certificates of completion
- the search index and the text SignSpry extracts for summaries and clause review
- backups of all of the above
How it is backed up
| Layer | How often | What is kept |
|---|---|---|
| Full encrypted bundle (database, documents, keys and configuration) | Every night | The newest 30 |
| Database snapshots | Every hour | The newest 48 |
| New document files | Copied every hour | Stored with server-side encryption |
| Restore drill | Every week | Automatic test of the newest bundle |
- Bundles and snapshots are encrypted with AES-256 before they leave the server, and the passphrase is deliberately kept out of the backups themselves.
- They go to storage in the same AWS region, Mumbai.
- The weekly restore drill takes the newest backup and restores it in a scratch area that never touches live data. It checks the database, confirms that every document file is present, runs the migrations, and starts a copy of the application on it. If the drill fails or has not run for more than 8 days, SignSpry's operators are alerted.
- If a disk is lost, recovery is to the last hourly snapshot, so at most about an hour of changes could be affected. Point-in-time recovery is on the roadmap and is not available yet.
Releases and your data
New versions replace the application code and never write over your data. Before each release SignSpry snapshots the database, rehearses the changes on a copy first, and rolls the code back automatically if the health check does not pass. Changes to the data structure only add; they never drop or rename.
What leaves Mumbai
Some services have to talk to outside providers. Other than the emails you ask SignSpry to send, documents are not among them.
- Email. Invitations, reminders and completion emails go through the email-delivery provider. A completion email can carry the signed PDF.
- Timestamps. Only the SHA-256 hash of a sealed document goes to the timestamp authority. See Trusted timestamps.
- WhatsApp and SMS. Where SignSpry has switched these channels on, the message content passes through Meta (WhatsApp) or AWS (SMS, sent from the Mumbai region).
- Support tickets. If automatic ticket translation is on (it is off by default), ticket text goes to a translation service.
- Payments. Razorpay handles card and UPI details. They never reach SignSpry's servers.
Deleting data and backups
Retention policies and deletions remove the documents from the live system straight away. Backups age out on their own cycle: the nightly bundles keep the newest 30, so older copies are replaced as new ones are made. See Retention and automatic purging.