Security

Found something we should fix? Email security@signfile.io. Please include:

• The URL or feature affected
• A short description of the issue and its impact
• Steps to reproduce (screenshots are great)
• Your name and whether you’d like to be credited in our release notes

We acknowledge reports within 3 business days and aim to ship a fix within 30 days for high-severity issues. We’ll keep you updated as we investigate.

• TLS 1.2+ for all data in transit
• SHA-256 fingerprints on every signed document — any post-signing edit is detectable
• Per-signer signing locks to prevent stamp races
• Server-derived URLs on all signing links — no direct Appwrite storage URLs ever exposed
• HttpOnly + Secure + SameSite session cookies
• Strict baseline CSP; HSTS with includeSubDomains and preload
• Database and file storage in the EU (Frankfurt, fra region)
• Error reporting via Sentry with sendDefaultPii: false — no request bodies, signature data URLs, or uploaded PDF content leave the server unless a researcher opts in to share it

In scope: any signfile.io subdomain and the api endpoints backing it. Vulnerabilities that affect signers, account owners, workspace admins, or the audit-trail / certificate generation pipeline.

Out of scope: denial-of-service (rate-limited at the edge), social engineering against our team, physical attacks, and vulnerabilities in third-party services we integrate with (please report those to the third party directly — we’ll happily forward if you ask).

We don’t currently run a paid bug-bounty program. With your permission we’re happy to credit you in the release notes for any fix you help us ship. If you’d prefer to stay anonymous, that’s fine too.

We ask that researchers give us a reasonable window to fix before public disclosure — typically 90 days from acknowledgement, or sooner if a fix ships earlier. We won’t pursue legal action against researchers who act in good faith, stay within scope, and avoid privacy violations, service disruption, and destruction of data.