Security
Built with security and compliance requirements in mind.
Sign10X is designed so that the safe path is the default one. Below is how the platform is architected — not a certification claim.
Document protection
- Documents stored in private object storage — never publicly listable
- Access granted through short-lived signed URLs
- Original and completed versions retained separately
- Deletion and retention rules per organization
Data isolation
- Every record scoped to an organization
- Row-level security enforced in the database, not the browser
- Server-side authorization on every privileged action
- Role-based access: owner, admin, member, viewer
Identity & sessions
- Email and password with email verification
- Secure password reset flows
- Google and Microsoft sign-in architecture
- MFA-ready design and session management
API security
- API keys stored hashed — secrets shown once at creation
- Separate test and production environments
- Signed webhook deliveries with retry history
- Rate limiting and per-key usage tracking
Auditability
- Append-only audit log of sensitive activity
- Per-document trail: created, sent, delivered, viewed, signed, completed
- IP address and user agent recorded where appropriate
- Downloadable audit trail for completed requests