Security

How SignEnvoy protects your documents, signatures, and the record of who signed what.

How your documents are protected

• The production signing key is generated inside AWS KMS hardware and never exists as a file. SignEnvoy holds permission to *use* it, not a copy of it.
• The signer interface takes a document digest and returns a signature. The signing backend never receives document contents.
• Each document's audit trail is a hash chain: every entry includes the hash of the one before it, so an altered or removed entry breaks verification for every entry after it.
• A sealed document carries a cryptographic seal covering the whole file. Any modification after sealing is detectable, and we verify that with two independent validators plus a nine-attack tamper suite.
• Every query against document data is scoped to one workspace at the layer that talks to the database, not by callers remembering to filter.
• Test-mode and live-mode data are separated by the same mechanism as workspace isolation. A live key cannot reach a test document, or the reverse.
• Document bytes are addressed by keys prefixed with the owning workspace, and the storage interface exposes no path or directory listing.
• Stored documents are encrypted at rest with AES-256 under keys that we control in AWS KMS, and the bucket refuses unencrypted connections. The database and its backups are encrypted the same way.
• Every connection to SignEnvoy uses TLS 1.2 or 1.3 with modern authenticated ciphers; TLS 1.0 and 1.1 are refused. Traffic between our edge and our servers is encrypted and certificate-verified, and our servers verify the database's certificate too.

Reporting something

If you believe you have found a security problem, tell us before telling anyone else. Write to security@signenvoy.com. The same contact is published at /.well-known/security.txt.

Include what you found, where (the address and the steps to reproduce it), and what you think it allows. If you have a proof of concept, send it; if it involves someone else's data, describe it rather than sending the data.

We will not pursue research done in good faith within these bounds: do not disrupt the service, do not access data that is not yours (if you reach it by accident, stop and tell us), and do not use social engineering against our people or our customers. Testing against your own account, and the sandbox, is welcome.

A person reads this inbox on business days. We acknowledge a report within two business days, tell you what we found, and tell you when a fix ships. We do not run a bounty program. We will credit you if you want to be credited.

Current status

Live component status is at status.signenvoy.com.