How we keep your documents safe.

1. Where your data lives

Every document, signature, audit log and account record is hosted on servers physically located in Australia. There is no replica, mirror, or backup of customer data outside Australia. This is the data sovereignty pitch the US-headquartered platforms can't make.

2. Encryption

3. The tamper-evident audit log

Every event in a document's lifecycle — sent, viewed, disclosure accepted, signed, completed — is recorded with:

• An ISO 8601 timestamp,
• The actor's IP address and approximate geolocation,
• A parsed device summary (browser, OS),
• A SHA-256 hash of the event's contents,
• A reference (prevHash) to the hash of the previous event.

This chains every event to the one before it. If a single byte of the audit log is altered after the fact — including by us — the chain breaks and the audit page flags it. This is how SignPad makes audits court-defensible by default.

4. Email authentication

Every signing email we send is signed with DKIM, aligned with SPF and DMARC, on the signpad.com.au domain. This is what stops your signing links being marked as phishing.

5. Authentication

Passwords are hashed with Argon2id (memory cost 64MB, time cost 3, parallelism 4). We never store, log, or transmit your password in plain text. On Business plans, SSO with Google Workspace and Microsoft Entra is available.

6. Backups

We take continuous database snapshots and store them in a separate Australian-region location. Snapshots are encrypted with the same key hierarchy as production data.

7. Vendor list

The only third parties we share customer data with are:

• Stripe — payment processing on paid plans (your billing address only, never document contents).
• An Australian transactional email provider — to deliver signing emails. The email body is the only contents shared; the document itself is never attached.
• ipify and ipapi.co — to resolve the signer's IP and geolocation as part of the audit log. These services receive the signer's IP only; no document metadata.

8. Responsible disclosure

If you've found a security issue, please email sign@signpad.com.au with the subject line "Security: [short summary]". We respond within 2 business days. We don't yet run a paid bug bounty but we'll send a thank-you and a credit on the page if you'd like.

9. What we're working on

Targets for the next 12 months:

• ISO/IEC 27001 certification
• SOC 2 Type II
• Customer-managed encryption keys for Business plans
• Public audit log of major security events

10. Contact

Security questions: sign@signpad.com.au.