OKSigned

Security and trust

How we protect your documents

This page describes how the service actually works today. It isn't a certification, and we'll say so plainly where something is still in progress.

Pilot status

We haven't completed an independent security audit or any certification (such as SOC 2 or ISO 27001). We target OWASP ASVS 5.0 Level 2 and track our progress against it. An independent security and privacy review is required before we accept real insurance client data.

Document integrity

  • When you send, the PDF bytes, field assignments, and signing order are frozen into a version. We record the SHA-256 fingerprint of the PDF and of the configuration.
  • Sent versions can't be edited. Changes require voiding and sending a revised copy, and the two are linked in the history.
  • We keep the original PDF and produce one completed PDF per version. Both are fingerprinted and stored as write-once objects. We check the fingerprint every time a file is served.
  • The audit trail is append-only and hash-chained: each event includes the fingerprint of the one before it, so changes are detectable.

What our signatures are — and aren't

We provide electronic signatures with an audit trail. We don't apply cryptographic (PKI) digital signatures, qualified electronic signatures, or notarization. By default, signers are verified only by access to the email address the sender entered, and the certificate says exactly that. Delivery and "opened" events are recorded as observations, not proof of identity.

Access control

  • Every database table uses default-deny row-level security. Account data is isolated, and access is checked on the server for every request.
  • Files live in private storage and are never public. Downloads require an authorized session and aren't cached.
  • Signing links are personal, expire, and can be revoked or reissued. We store only a keyed hash of each link token. Opening a link in an email preview or security scanner doesn't use it up or sign anything: you have to select Continue.
  • Passwords are hashed with scrypt. Sessions use secure, HTTP-only cookies. Sign-in, sign-up, and link requests are rate-limited.

Uploads

Every PDF is treated as untrusted. We check type, size (20 MB), and page count (100), and parse it in an isolated worker with memory and time limits. We reject encrypted PDFs and those containing JavaScript, embedded files, launch actions, or interactive media. Previews are drawn as images in your browser with scripting turned off.

Privacy and data handling

  • We collect what's needed to run the service. Document contents and signing links are kept out of analytics and logs, and we don't use third-party tracking scripts.
  • Emails contain private links, never your PDFs.
  • See our Privacy Policy and subprocessors for where data is stored and who processes it.

Report a security issue

Email security@oksigned.com (goes live once the domain is set up). Please don't include real personal information in your report.