How Sovrasign keeps documents safe

Signatures

• Each signature is made on the signer's own device, with a one-time key made for that signature and that document only.
• The signer's identity is confirmed by Google, Microsoft or Apple and tied to that exact document, so the confirmation cannot be reused for another one. The sender's preparation is confirmed the same way by Sovrasign's own identity service, for the account that sent it.
• Sovrasign checks every signature again on its own copy of the document before accepting it, and the signed PDF can be checked by anyone, without Sovrasign. See What verification proves.
• The signing page is locked down. It loads its code only from Sovrasign, checks the signing engine's fingerprint before running it, and refuses any script it does not know.

Documents

• Every document is encrypted with its own key, and those keys are protected by keys held in Microsoft Azure Key Vault. Sovrasign's servers store only encrypted files.
• Every uploaded file is scanned for malware before anyone can open it, and scripts and other active content are removed from PDFs before anyone signs. A file that fails the scan, or whose scan does not finish, is blocked.
• Signing links are personal. Sovrasign stores only a fingerprint of each link, and the signing page removes the link from the address bar as soon as it opens. Links expire, stop working when an envelope is voided or an address is fixed, and can open only a limited number of signing sessions.

Accounts

• No Sovrasign password. You sign in with Google, Microsoft, Apple, a code sent by email, or a passkey, so there is no password of ours to steal or reuse.
• Passkeys cannot be phished and count as a second factor. See Settings, passkeys, signed-in devices and workspaces.
• You see every signed-in device and can sign out any of them at once.
• Our pages load no scripts from other companies: no trackers, no advertising, no chat widgets.
• We email you when a new device signs in, when a passkey or a sign-in method is added or removed, and when your address changes. Removing a sign-in method, changing your address and deleting the account need a sign-in from the last 15 minutes. See Lost access, sign-in methods and your email address.
• Recovery by email waits 72 hours when your account has a passkey, and you can cancel it from any signed-in device.

Running the service

• Monitoring and alerts. Every 15 minutes, Sovrasign sends, signs and verifies a test document through its own public service, and alerts the person on call when something fails.
• A public status page fed by the same checks is built and waits for publication.

Backups are kept, and a restore is tested every month.

Planned. A security test of the whole service before the public launch.

The verifier and open source

Sovrasign is built on its own signing engine. Sovrasign decided to publish the verifier and the description of the signed-document format as open source, so anyone can check documents without us; they are not published yet. The signing engine itself is not published. Today, the verifier runs in your browser for free, without an account and without uploading the file.

Report a security problem

Write to security@sovrasign.com. Please do not test on other people's accounts or documents. The draft responsible disclosure policy says what is in scope and how we answer.