Security

Built with security and compliance requirements in mind.

Sign10X is designed so that the safe path is the default one. Below is how the platform is architected — not a certification claim.

Document protection

Documents stored in private object storage — never publicly listable
Access granted through short-lived signed URLs
Original and completed versions retained separately
Deletion and retention rules per organization

Data isolation

Every record scoped to an organization
Row-level security enforced in the database, not the browser
Server-side authorization on every privileged action
Role-based access: owner, admin, member, viewer

Identity & sessions

Email and password with email verification
Secure password reset flows
Google and Microsoft sign-in architecture
MFA-ready design and session management

API security

API keys stored hashed — secrets shown once at creation
Separate test and production environments
Signed webhook deliveries with retry history
Rate limiting and per-key usage tracking

Auditability

Append-only audit log of sensitive activity
Per-document trail: created, sent, delivered, viewed, signed, completed
IP address and user agent recorded where appropriate
Downloadable audit trail for completed requests

Security by design

Sign10X is built with organization isolation, audit logging, encrypted storage, and least-privilege access controls.