Security & Trust
An electronic signature is only as strong as the evidence around it. ArmorSign records the four things that make a signature stand up under the U.S. ESIGN Act and UETA — and stores them so they can't be quietly changed.
Every signer affirms consent to use electronic records and signatures, and that their typed name is their signature. The exact language they saw is recorded verbatim on the certificate.
We compute a SHA-256 hash of the document before and after the certificate is appended. The hash is printed on the certificate and stored in the audit log, so any later alteration is detectable.
Consent and audit events are written to a hash-chained, append-only ledger. There are no update or delete paths — the record is tamper-evident by construction.
Completed records carry a SHA-256 hash and a Certificate of Completion, so a later change is detectable. ArmorSign's policy is to keep them for up to seven years.
Compliance Scorecard
Every control below is enforced at the code level and verified by our secure-development process.
ESIGN / UETA informed consent
Every signer explicitly consents before any action is recorded. The verbatim consent text is stored with the audit event.
ESIGN Act 15 U.S.C. § 7001 · UETA
SHA-256 document integrity anchor
A SHA-256 hash of the finalized signed PDF is recorded on the certificate and stored in the immutable audit ledger.
ESIGN Act 15 U.S.C. § 7001
Append-only consent ledger
Consent events are written via DB triggers to a hash-chained ledger with no UPDATE or DELETE path — tamper-evident by construction.
ESIGN Act · UETA
Verbatim consent language preserved
The exact disclosure text the signer saw is embedded in the signing certificate, not a reference to a policy version.
ESIGN Act 15 U.S.C. § 7001(c)
JWT issuer + audience validation
Every API request validates iss and aud claims on the access token — forged or mis-scoped tokens are rejected at the middleware layer.
Access control
Single-use signer magic-links
30-day TTLSigning links are unguessable, single-use tokens that expire after 30 days from the send date.
Access control
Per-IP rate limiting
All API surfaces are rate-limited at the edge (240 req/min global; tighter on auth and signer routes) to prevent credential stuffing and abuse.
Abuse protection
HTTPS-only API
All API traffic is TLS-terminated at the Fly.io edge — no plain-HTTP surface exists. HSTS is sent on every response.
Transport security
Completed-record retention
The completed PDF is stored with a SHA-256 hash and a Certificate of Completion, so a later change is detectable. Keeping completed records for up to seven years is a retention policy.
Retention
Per-account data isolation
Every database query is scoped to the authenticated account ID — no cross-account data leakage path exists at the query layer.
Access control
Real-time error tracking
Application errors are captured and alerted via Sentry with no PII in payloads. Consent-chain verification failures are flagged as warnings.
Monitoring
Append-only audit log
Every envelope action (sent, signed, declined, voided, downloaded) is recorded to a tamper-evident audit log. DB-level triggers block UPDATE and DELETE.
ESIGN Act
Fly.io — compute & database
Application runtime and managed Postgres, hosted in a SOC 2 Type II data center.
Hosting
Cloudflare — CDN, DNS, DDoS
Global CDN, DNS, WAF, and DDoS protection.
Edge network
Cloudflare R2 — object storage
Completed PDFs can be copied to object storage alongside the database record.
Object storage
Mailgun — transactional email
DMARC-protected transactional email delivery for signer magic-links.
Email delivery
Hosted in a SOC 2 Type II data center.
Engineering practices
ArmorSign is built and reviewed under the Armorstack secure-development process (aligned to NIST SSDF).
Every signed document is sealed with a real embedded PKCS#7/CMS digital signature — not just a recorded hash. The signature is applied last, after your document, fields, and Certificate of Completion are final, so it covers the entire artifact. RFC-3161 timestamping — independent, cryptographic proof of exactly when a signature was made — is available on request. Signatures anchored to a publicly-trusted certificate authority (AATL) are available as a later option for transactions that require them.
Start free