How we protect your signed documents

An NDA, an offer letter, a lease, a patient consent form: signed agreements carry names, salaries, addresses, account numbers and sometimes health information. They're also the documents you'll need to prove what was agreed, years later. So an e-signature platform has two jobs. It has to keep your documents private, and it has to keep them intact.

Here's how Parapho does both, in plain terms, and where we are on SOC 2.

Every account uses two-factor authentication

Most breaches start with a stolen password. Many e-signature tools offer two-factor authentication as a setting that most people never turn on. In Parapho it's mandatory: nobody reaches any data until they've set it up.

• Use an authenticator app, or a 6-digit code emailed at each sign-in.
• Codes work once. Emailed codes expire after 10 minutes and stop working after 5 wrong guesses.
• Recovery codes are single-use and stored only as hashes.
• Changing your password, generating new recovery codes or deleting your account asks for a fresh code, so a borrowed laptop with an open session isn't enough.

Passwords are hashed with scrypt, accounts lock with exponential back-off after repeated failures, and sessions expire after 30 idle minutes or 12 hours at most. You can see and sign out your other sessions yourself.

Workspaces are separated by the database, not just the code

In a multi-tenant app, the scariest bug is one that shows one customer another customer's data. Most apps prevent it by remembering to add "where workspace = yours" to every query. That works until someone forgets.

Parapho adds a second wall. Every customer table in our PostgreSQL database uses row-level security, and the app connects as a restricted database role that can't switch it off. Each request runs in a transaction scoped to one workspace, so the database itself refuses to return or change another workspace's rows, even if our application code has a bug. Signers get even narrower access: a signing link can see only its own recipient record.

Encrypted, locked down and logged

Your documents are encrypted in transit with TLS 1.2 or newer, and at rest with AES-256 using AWS KMS keys that we manage and rotate yearly. Signing links, API keys and recovery codes are never stored in a usable form, only as hashes.

Encryption only helps if access to the keys and files is tight, so we restrict who can open a stored document at all:

• Only two identities can read stored files: the application itself, and an emergency-access role that requires multi-factor authentication, expires after an hour, and is logged every time it's used.
• No long-lived cloud keys. The app uses short-lived credentials, and so do our deploys.
• Staff tools never show your documents. Our operator console, used for things like billing support, can't display documents, recipients, field values or signatures for any workspace. Using it needs a fresh two-factor code, and every action needs a written reason that's logged.
• Every read is recorded. AWS CloudTrail logs every read and write of a stored document and every change to our infrastructure. The logs are digitally signed, encrypted, and locked against deletion for six years.

The database runs across multiple availability zones with 35 days of encrypted backups and point-in-time recovery, and a web application firewall with rate limits sits in front of the app.

Every document is tamper-evident

A signature is only useful if you can prove the document hasn't changed since it was signed. When the last person signs, Parapho:

1. Flattens the filled-in values into the PDF, so they can't be edited as form fields.
2. Appends a certificate of completion with each signer, their consent, IP address, device and the full audit trail.
3. Digitally signs the PDF, so readers such as Adobe Acrobat flag any later change.
4. Records a SHA-256 fingerprint of the final file.

Anyone can check a file on our verify page. The check runs in your browser, so the document is never uploaded. Change a single byte and verification fails. Our guide to verifying a signed PDF walks through it.

What we don't do

• No ad trackers, and no third-party scripts in the app or on signing pages.
• No selling your data, and no training AI models on your documents.
• No upload for Quick Sign. When you sign your own PDF with Quick Sign, it never leaves your device.

Where we are on SOC 2

SOC 2 is an independent audit of how a service provider protects customer data. A Type II report, the one security teams ask for, tests that controls actually worked over several months.

We're preparing for a SOC 2 Type II audit. We haven't been audited yet, and we don't have a report to share. We'd rather say that plainly than hide behind a badge.

What we can show you today is our SOC 2 page. It maps every Trust Services Criterion to our controls in two columns: what's in place today, such as everything described above, and what we're rolling out for the audit, such as quarterly access reviews, required code review on every change, and yearly restore tests. Our written security policies cover access control, change management, incident response, vendor management and more, and are available to customers on request under an NDA. We'll update the page as the audit progresses.

Security is shared: your side

Some protections depend on how you use any e-signature tool, Parapho included:

• Remove people from your workspace when they leave, and give admin rights only to those who need them.
• Keep API keys in a secret store, never in code, and use test keys outside production.
• Add an access code to sensitive documents, so a forwarded email isn't enough to open them.
• Check signers' email addresses before you send.
• If you handle patient information, sign our BAA and use a HIPAA workspace first.

Run your own review

Read our Security page for the technical detail and our SOC 2 page for the control mapping. If you have a vendor questionnaire, email us and we'll answer it directly. Or start free: every protection in this post is on every plan, including the free one.