Security you can verify, not just read about
An agreement is only as good as the evidence behind it. This page explains, in plain language, exactly how SignSpry protects your documents and proves what happened — and what is still on the roadmap.
Evidence
Hash-chained audit trail
Every event on an envelope — sent, viewed, signed, paid, declined, reminded — is recorded with the actor, IP address, device and a UTC timestamp, and each record carries the hash of the one before it. Alter or remove one and the chain breaks visibly.
Sealed PDFs
When the last party signs, the PDF is sealed with a PKCS#7 digital signature covering every byte, and an RFC 3161 timestamp from an independent authority fixes the moment in time without anyone having to trust our clock.
Certificate of completion
Appended to every completed document: who signed, from where, when (UTC and local time), how identity was checked, the document hashes and the full event trail — in English and the signers' language.
Public verifier
Anyone can drop a SignSpry PDF on our verifier — no account, no fee — and confirm that it is sealed, unchanged since sealing, and when. A court, auditor or counterparty never has to take our word for it.
Signer identity
Email-verified signing links, optional per-signer access codes, IP and device records, and explicit consent captured before the first field. Global SMS codes, ID-document checks and eIDAS advanced signatures are on the roadmap.
Time that means the same everywhere
All timestamps are stored in UTC and shown alongside each person's local time, so an agreement signed across three time zones carries one unambiguous sequence of events.
Platform security
Encryption
TLS for every connection, strict transport security and content security headers on every response, and AES-256-encrypted nightly backups stored off the production server.
Account protection
Two-factor authentication with backup codes, login rate-limiting and lockouts, password-age policies set by your admin, active-session management and a security log of sign-ins and sensitive changes.
Access control
Viewer, Member, Manager and Admin roles plus per-user grants, enforced on the server for every request. Team folders, locked templates and retention policies keep documents where they belong — and only as long as they should be.
Hosting & data residency
Production runs on Amazon Web Services in India (Mumbai). Documents, audit trails and backups stay in that region. EU and US data regions, so that European and American customers can keep their data at home, are the next infrastructure step on our roadmap.
AI that stays on our servers
Agreement summaries, clause review, obligation extraction and full-text search are computed on infrastructure we run. Your document text is never sent to an outside model and never used for training.
Reliability
Automated health checks, nightly encrypted off-site backups, and a deployment process that refuses to go live if a check fails. A public status page is on the roadmap.
Privacy
Privacy by design
We collect what the service needs and nothing more; signers are never marketed to. Our Privacy Policy sets out what we hold, why and for how long, and how to exercise your rights.
Consent before cookies
No analytics or advertising cookie is set until you agree. Consent is recorded, honoured through Google Consent Mode v2, and can be changed at any time from the footer. Fonts are served from our own servers, so no request leaves the page before you choose.
GDPR, DPDP and beyond
Built with India's Digital Personal Data Protection Act and the GDPR in view: data minimisation, retention controls and export of your data on request. A self-service GDPR toolkit — data processing agreement, consent records, export and erasure — is next on the roadmap.
Legal recognition by jurisdiction
SignSpry produces standard electronic signatures backed by a sealed audit trail. The laws below recognise such signatures for contracts that may be formed electronically; each excludes a few document types (for example wills or certain property transfers). This is general information, not legal advice.
| Jurisdiction | Law | What it means for SignSpry documents |
|---|---|---|
| India | Information Technology Act, 2000 (section 10A) | Contracts formed electronically are valid; the sealed PDF and audit trail serve as the electronic record. |
| United States | ESIGN Act (2000) and UETA (adopted by 49 states) | A signature may not be denied legal effect because it is electronic; intent, consent and attribution are evidenced by the audit trail. |
| European Union | eIDAS Regulation (EU) 910/2014 | Standard electronic signatures are admissible as evidence; advanced and qualified levels are on our roadmap with a qualified trust-service partner. |
| United Kingdom | Electronic Communications Act 2000; UK eIDAS | Electronic signatures are admissible and generally valid for contracts, as confirmed by the Law Commission (2019). |
| Singapore | Electronic Transactions Act 2010 | Electronic signatures satisfy a signature requirement where a reliable method identifies the signer and shows intent. |
| United Arab Emirates | Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services | Electronic signatures and records have legal effect; certain documents are excluded. |
| Australia | Electronic Transactions Act 1999 (Cth) and state equivalents | A requirement for a signature is met by a reliable electronic method with the signer's consent. |
| Canada | PIPEDA Part 2; provincial electronic commerce acts | Electronic signatures are recognised; some federal documents require a secure electronic signature. |
Who else touches your data
We keep the list short. Each provider processes only what its job requires.
- Amazon Web Services — hosting, storage and backups in the Mumbai (ap-south-1) region; outbound email delivery.
- Razorpay — payment processing for subscriptions and for payments collected on signing. Card details never reach our servers.
- Google — analytics and advertising measurement, only after you consent to those cookies.
- RFC 3161 timestamp authority — receives only the hash of a sealed document, never the document itself.
Reporting a vulnerability
If you believe you have found a security issue, please email support@signspry.com (subject "Security report") with enough detail to reproduce it. We acknowledge reports, fix confirmed issues promptly and credit researchers who wish to be named. Please do not access other customers' data or disrupt the service while testing.
Questions from your security or legal team?
We are happy to walk through the architecture, complete a security questionnaire or discuss a data processing agreement.