Security at keysig

Who can sign in, and how.

Two-factor sign-in

Any account can add an authenticator app. Once it has one, every sign-in asks for a code before any signed-in page opens.

Enforced by the database

For an account with two-factor sign-in, the database itself refuses every request from a session that has not entered the code, on every table that holds account or agreement data and on every stored file. It is not only a screen in the app.

Passwords and sessions

Passwords are at least 8 characters, are checked against known breached passwords, and are hashed by our authentication provider, and changing one needs the current password. Sessions end after 30 days of inactivity, and after 90 days at most.

Emailed sign-in

Signing in by emailed link or 8-digit code is checked by our authentication server, and the link and the code are one single-use token: using either spends both. keysig never takes a sign-in session from a web address, so a link cannot quietly sign you in as someone else.

We never ask for your code

keysig will never ask you for a sign-in code. The email that carries one says so, and anyone asking you for it is not us.

Your address, your account

An email address is confirmed only by a link or code sent to it. If someone else may have set up an account with your address first, you are asked before anything is confirmed. If you signed in from the email and answer no, their sessions end and their password is removed.

Recovery through support only

There are no recovery codes to leak. A lost authenticator is removed only by keysig support, once support has confirmed the request comes from the account's own email address.

Private until you send them, and only to the people you send them to.

Private by default

An agreement is readable only by the account that drafted it, by the label it is filed under, if any, and by the people it is sent to once it is sent. Access is decided inside the database on every request, not only in the app, and is tested on every code change.

Shared only once sent

Someone you send an agreement to can open it in keysig only after it is sent, only while signed in with a confirmed email address that matches theirs on the agreement, and never while it is a draft. Taking a request back hides it from them again.

What signers see

The people you send an agreement to see the agreement, its status and who is signing it, never your drafting answers or the people you copied.

Signing without an account

Signers do not need a keysig account. Each receives their own signing link by email, and keysig never shows or serves that link anywhere else.

Private files

Signed PDFs are kept in private storage and handed out only to the people allowed to see them, as links that expire within the hour.

On a label’s roster

Work you file as your own stays yours. The label never sees it, only a count of the credits spent on it, and you choose before each agreement is created.

What was signed stays what was signed.

Locked once sent

While an agreement is Pending or Signed, the database refuses any change to its words, its answers or its signers. To change anything, you take the request back first, which makes it a draft again.

Signed needs evidence

An agreement becomes Signed only with the e-signature provider's completion record, or with a signed PDF stored by keysig's server. No browser can mark an agreement Signed.

What was checked is what is sent

The document and the signer list sent for signature are built from keysig's stored record, never from what a browser submits, and the send is refused if that record changed after it was prepared.

A signature audit trail

The e-signature provider keeps a signature audit trail for every agreement signed through keysig and emails each signer the completed copy, and the signed PDF is the authoritative record of what was signed.

Paper signatures marked as paper

Recording an agreement as signed on paper needs a valid email address for every signer, emails every other signer that it was recorded, and shows "signed on paper" wherever the agreement appears, exports included. The uploaded PDF is rebuilt with scripts, embedded files and automatic actions stripped out before it is stored.

What you can take with you, and what happens when you leave.

Download your data

Export my data, in Settings, downloads your profile, agreements, signers, tracks, collaborators and ownership records as one file.

Delete your account

Deleting your account from Settings cancels any subscription, takes back your personal requests still out for signature, and removes your agreements and their files. A signed agreement is held for 30 days first, so the other parties can save a copy, and work filed under a label stays with the label.

Deleting an agreement

Deleting an agreement removes its stored files before its record, through our server, and deletes for good any signature request for it that was never completed. What you delete leaves our encrypted backups within 35 days, unless we are looking into a possible loss at the time.

Only the email you asked for

keysig adds an address to its news list only after its owner confirms from the email itself, and you can turn it off in Settings.

No trackers in the app

Inside the signed-in app there are no analytics, advertising or session-recording scripts. Ad measurement on our public pages runs only with consent and honors Global Privacy Control.

What sits underneath.

Encrypted in transit and at rest

Every connection to keysig.co is HTTPS (TLS 1.2 or 1.3), with HTTP Strict Transport Security for two years. The database and file storage are encrypted at rest with AES-256 by our infrastructure provider, Supabase, which holds a SOC 2 Type 2 report. Both are hosted in the United States (us-west-2).

Nightly off-site backups

Every night a complete copy of the database is restored into a fresh database and counted, then it and every stored file are encrypted to a key keysig holds offline and written to Cloudflare R2 under a 34-day lock. Each copy is kept 35 days, and none is removed while a possible loss is being looked into. Our database provider also keeps seven daily backups.

Card data never touches keysig

Payments run through Stripe. keysig never sees or stores a card number.

Limits on outgoing email

An account can send at most 100 signature requests in any 24 hours, on any plan, and the notices keysig itself emails any one inbox about personal agreements are capped per day across every account.

Checked every hour

An automated check every hour alerts us to refused or failed signing events, a completed signature that was never recorded, a signed agreement without its PDF, unusual spikes in sends or refunds, and a burst of new accounts nobody signs in to.

Error reports without personal data

Error monitoring redacts email addresses and ID numbers, carries no agreement content, records no screens or sessions, and identifies an account only by an opaque id.

What our support team can and cannot do.

Who holds access

Only keysig's founder can reach production systems and customer data: the database, the server functions, the code and every provider's console. Anyone given access later has a background check where the law allows, signs a confidentiality agreement and is trained first, and loses every account the day they leave.

Two-factor on every internal account

Every account that reaches keysig's code, customer data or a provider's console uses two-factor sign-in, and who holds each one is reviewed every quarter.

Two-factor for every action

The support console refuses every action, reads included, unless the staff member's session has passed a second factor.

Metadata, never text

The console shows ids, titles, types, statuses, counts and dates. It cannot read an agreement's text, and automated tests fail if any console function reaches for it.

A reason, quoted to you

A corrective action, such as moving or resetting an agreement, adjusting credits or removing an authenticator, needs a written reason, and when it changes what someone sees, the reason is quoted to them word for word, in the app and by email.

keysig's own audit log

Every action keysig staff take in the support console is recorded, reads included, and an action that fails partway is recorded with its error. The log is append-only, hash-chained and kept indefinitely.

Lines no one crosses

No support action marks an email address as verified, and nothing resets a Signed agreement to a draft, for anyone.

How an incident is handled, and when you hear about it.

We tell you within 72 hours

If a security incident affects your data, we tell you without undue delay, and within 72 hours of becoming aware of it: what happened, what was affected, what we have done and what you should do. We tell the authorities where the law requires it.

Report a problem

Anyone can report a security problem to hello@keysig.co, the contact published at keysig.co/.well-known/security.txt, and hears back within three business days.

A few habits that keep your account and your agreements safer.

Turn on two-factor sign-in

In Settings, under Two-factor sign-in, with any authenticator app.

Confirm your email address

Agreements sent to you appear in your keysig account once your address is confirmed. Until then, you still get every signing email.

Ask before you sign

If an agreement arrives that you did not expect, check with the person who sent it before you sign.

The companies that run parts of keysig for us, and what each receives.

Ask us anything here in more detail. Labels and companies can ask for our security overview for labels and enterprise customers: hello@keysig.co.

This overview describes keysig as of October 11, 2026. It is a summary, not a contract: your agreement with keysig, our Terms of Service and our Privacy Policy govern. keysig is not a law firm and does not provide legal advice.