Trust & security overview: a guided tour for security questionnaires
Where to find each security answer on SignSpry's /trust page, what is true today, and what SignSpry does not hold.
The Trust & security page explains in plain language how SignSpry protects documents and proves what happened. This article is a map to it for a security or legal team filling in a vendor questionnaire.
Quick answers
| Question | Answer | More |
|---|---|---|
| Where is data hosted? | Amazon Web Services in Mumbai, for every customer worldwide, and nowhere else | Where your data is |
| How are documents protected from tampering? | A PKCS#7 seal over the whole PDF, an RFC 3161 timestamp from an independent authority, and a hash-chained audit trail | How sealing works |
| What is on the certificate of completion? | Who signed, from where, when (UTC and local time), how identity was checked, document hashes and the event trail, in English and the signers' language | The audit trail |
| Can a third party verify a document? | Yes. Anyone can use the Verify page without an account | Checking a signed PDF |
| Encryption? | TLS for every connection, strict transport security and content security headers, AES-256 encrypted backups | Backups |
| Account protection? | Two-factor authentication with backup codes, login rate limiting and lockouts, password policies set by your admin, session management, a security log | Security log |
| Access control? | Viewer, Member, Manager and Admin roles plus per-user grants, enforced on the server; SSO (SAML 2.0, OpenID Connect), SCIM, access reviews | Access reviews |
| Is AI used on our documents? | Summaries, clause review, obligation extraction and search run on SignSpry's own servers. Document text is not sent to outside models or used for training | Where your data lives |
| Certifications? | None yet. There is no SOC 2 report and no certification against ISO 27001 | see below |
| Data processing agreement? | Available once published, with the EU Standard Contractual Clauses for transfers | The GDPR / DPDP toolkit |
| Availability reporting? | Public status page with 90 days of uptime and incident history | The status page |
What SignSpry does not claim
SignSpry has no SOC 2 report and no certification against ISO 27001. It documents its controls against the SOC 2 Trust Services Criteria (access, change management, incident response, backups and restore tests, vendors) and shares its security policies and answers questionnaires on request, under NDA where needed. Ask through the contact page.
Who else handles your data
The Trust page lists sub-processors. The complete picture:
- Amazon Web Services (Mumbai) for hosting, storage, backups and outbound email delivery.
- Razorpay for payments for plans and payments collected at signing. Card details never reach SignSpry's servers.
- An RFC 3161 timestamp authority, which receives only the hash of a sealed document.
- Google, for website analytics and advertising measurement, only as your cookie choices allow.
- Meta (WhatsApp) and AWS (SMS), only where those channels are switched on.
- A machine-translation service, only if automatic support-ticket translation is switched on.
Legal recognition by country
The page sets out how the law in India, the United States, the European Union, the United Kingdom, Singapore, the United Arab Emirates, Australia and Canada treats electronic signatures. It is general information, not legal advice. See also Are electronic signatures legally valid in India?.
Reporting a vulnerability
Email support@signspry.com with the subject "Security report" and enough detail to reproduce the issue. The machine-readable policy is at /.well-known/security.txt. Please do not access other customers' data or disrupt the service while testing.