Trust center
What security reviewers and buyers ask first, in one place, with a link to the full document each time. Sovrasign is in development and not open to customers yet: this page says only what is true today.
Security overview
- The document proves itself. Each signed PDF carries its signatures, each signer's name with the evidence that they controlled their email address or sign-in account, and its history. Anyone can check it with our verifier, which runs in the browser without our servers.
- Signatures are made in the signer's browser, with a key made for that one signature and discarded straight after.
- Encryption in transit with TLS, and at rest with Azure's encryption plus our own: every document has its own key, locked by a key that belongs to its organization.
- Isolation between customers in the database itself (row-level security), not only in our code.
- No standing access for our staff. Operators hold no standing right to change production: they activate a role for a task, with a reason, and it expires. Support never sees document contents.
The security page: what a breach of our systems could and could not do, and the known limits
Where your data is stored
- United States. Microsoft Azure, East US 2, with backups in Central US.
- The EU region is not open yet. Until it opens, customer data is stored in the United States.
- Each region is a separate deployment with its own database, storage, keys and logs. A small global directory routes sign-ins to the right region and holds no documents.
- The network edge (Azure Front Door) routes traffic through Microsoft's locations worldwide. It does not cache documents, signing or identity traffic; request logs are kept as our privacy policy describes.
What sovereign means here
We use the word narrowly. It means:
- Documents stay in their region, with stated exceptions. An organization's documents, records and keys are stored in the region it chose when it signed up, the EU region too once it opens. Authorized US access, support processing, global billing and routing records and email delivery can involve other locations; our privacy policy and DPA list them. Moving the storage to another region is a separate step the organization asks for.
- Each organization's documents are locked by its own key. After the 14-day undo period for deleting the organization, we destroy that key, which makes every copy of its documents and attachments we store, backups included, unreadable, unless a legal hold requires us to keep it; other records in backups expire within 35 days. Copies already downloaded or delivered to others are not affected.
- It does not mean a European provider. Sovrasign runs on Microsoft Azure, a US company, in every region, and our encryption keys are kept in Azure Key Vault.
Subprocessors
The companies that would process customer data for us, from our subprocessor list.
| Subprocessor | What it does for us | Where |
|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosts the whole service: servers, database, document storage, encryption keys, messaging, logs, the network edge (Azure Front Door), malware scanning of uploads (Microsoft Defender for Storage), and sending email (Azure Communication Services Email) until Mailgun replaces it | United States: East US 2, with backups and copies in Central US. The network edge routes traffic through Microsoft's locations worldwide. Caching is off on API, signing and identity routes; request logs are kept as our privacy policy describes. EU region (Sweden Central, backups in Germany West Central and Sweden South) when it opens |
| Stripe, LLC | Billing and payments for account holders' plans and packs | United States and other countries where Stripe operates |
| Timestamp authorities: DigiCert, Inc. during the private beta | Trusted timestamps that prove when a document was signed | United States |
| Mailgun Technologies, Inc. (Sinch) | Sending email: invitations, reminders, notices, completed copies and account email. Replaces Azure Communication Services Email | United States region for the US region of Sovrasign; EU region for the EU region |
| Microsoft Corporation (Microsoft Foundry) and Anthropic, PBC | The AI support assistant: Claude models made by Anthropic, accessed through Microsoft Foundry and run on Anthropic's infrastructure. Both process the conversations for us | United States (Microsoft's US Data Zone) for every conversation from an account in the EU, EEA, UK or Switzerland. Other conversations: also the US Data Zone |
Service status
- No public status page yet: the service is not open to customers.
Report a vulnerability
- Write to security@sovrasign.com. Our draft responsible disclosure policy says what is in scope and gives a safe harbor for research in good faith.
Documents and certifications
- Legal documents: our data processing agreement, privacy policy and subprocessor list apply to beta customers under the terms of service.
- Accessibility statement: we aim for WCAG 2.2 AA.
- Certifications: none.
If something happens to us
Sovrasign is a small company, run today by its founder. Customers rightly ask what happens to their documents if something happens to us. In short (the continuity page says more):
- Your signed documents do not depend on us. They prove themselves. We publish the full history of the public keys signatures are checked against, so they stay verifiable after keys change; keep a copy of the verifier and that history and you can check them without our website.
- You can take your data with you. An owner or admin can export the workspace at any time, free: every envelope we still hold, with its PDF and certificate of completion where it has them, its activity log, the templates and the audit log. Export cannot recover copies that were deleted or expired; keep the completed PDFs we deliver to you.
- No standby engineer yet. Today no one else is under contract to run the service if the founder is unavailable. This page will say so when that changes.