Current Safeguards
FileSign stores original documents, rendered pages, and signature assets in private storage. Authenticated application routes and token-scoped signing routes control access to those files.
The application enforces HTTPS and site-wide browser security headers. FileSign records security-relevant workflow failures without exposing document contents or credentials in client-facing error messages.
Authentication & Access
Sender accounts use Supabase Auth. Email and password authentication is available, and configured OAuth providers may also be offered on the sign-in screen.
Recipients do not need a FileSign account. Signing links use expiring tokens, and FileSign stores a hash of each token rather than the raw signing credential. Voided or expired links are rejected.
Documents & Signing Evidence
FileSign records document and signing events, including timestamps and the workflow evidence needed to review a completed agreement. Completed documents include an audit certificate page and a recorded SHA-256 hash.
DOCX files are converted through an authenticated Cloudflare Worker and a network-disabled LibreOffice container. The service applies file-size, rate, and execution-time limits to that conversion boundary.
Infrastructure Providers
FileSign currently relies on the following providers:
- Vercel for the Next.js application and edge delivery
- Supabase for managed PostgreSQL, authentication, and private file storage
- Resend for transactional signing and account email
- Cloudflare for the bounded DOCX conversion service
Current Assurance Status
FileSign does not currently claim its own SOC 2 Type II certification, HIPAA compliance certification, enterprise SSO, or SAML support. An external certificate-provider upgrade and broader production monitoring remain on the product roadmap.
Contact FileSign before using the service for regulated or organisation-specific workloads so the current controls can be reviewed against your requirements.
Responsible Disclosure
If you believe you have found a security vulnerability, use the contact page and select the Security & Vulnerability channel. Include enough detail to reproduce the issue, avoid accessing other users’ data, and allow reasonable time for investigation before public disclosure.
Customer Responsibilities
- Use a strong, unique password and protect account credentials.
- Review recipients and signing-link expiry before sending.
- Upload only documents you are authorized to process.
- Report suspected unauthorized access promptly.
Security Contact
For security questions or vulnerability reports, use the FileSign contact page.