Keeping signed documents secure: the layers and your part in them.

Your contracts and agreements carry sensitive business information. This guide covers the layers that protect them when they are sent for signature, what to ask of any provider, and what your own team can do.

Why document security matters

For a business handling contracts and agreements, a security incident costs more than money. It damages trust with the clients whose details were in those documents.

Electronic signing is often more secure than paper. A paper document can be photocopied, forged or lost. An electronically signed document has an audit trail and tamper evidence that paper cannot match. But the protection you get depends on the practices of the platform you choose, so it is worth knowing what to look for.

The layers of protection

Encryption

Documents should be encrypted while they travel between browsers and servers and while they are stored. Signed documents should be sealed so that any change made after signing can be detected.

Sign-in

Strong sign-in stops people getting into accounts they should not. SignAndGo offers optional two-step sign-in on every account, so a stolen password alone is not enough to get in.

Audit trails

Every view and signature should be recorded with names, email addresses, times and IP addresses. That gives you a chain of events to point to if a signature is ever questioned. Our guide to audit trails goes through what is recorded.

Application safeguards

Beyond encryption and sign-in, a platform should check what users send it: cleaning up uploaded file names, checking input and escaping what goes into emails, so a document or form cannot be used to attack the system or the people receiving it.

Access control

People should see only the documents they are meant to. In SignAndGo, team workspaces have admins who give each person a role, and idle sessions are signed out after a period of inactivity.

Questions to ask any provider

• What encryption protects documents in transit and at rest?
• Is two-step sign-in available?
• What does the audit trail record, and can I download it?
• How are user inputs and uploaded files checked?
• What happens to my documents if I close my account?
• Is there a way to report a security issue?
• How quickly do you respond to a security incident?

Our security questions guide goes into each of these in more depth.

Your part

A secure platform is only half of it. These steps are on your side:

• Switch on two-step sign-in. Even if a password leaks, the second step keeps the account closed.
• Use strong, unique passwords. A password manager makes this easy. Never reuse a password across services.
• Review access regularly. Remove people who no longer need access, and give everyone the narrowest role that lets them do their job.
• Check signer email addresses. The signing link goes to the address you enter, so a typo sends it to the wrong person.