Security Overview
Built with enterprise security controls to protect your documents and data
Data Storage
Encrypted at Rest
Audit Trail
Security Controls
Authentication & Session Security
Enterprise-grade authentication protecting your accounts
- Google and Microsoft single sign-on via OAuth 2.0
- Optional two-factor authentication (TOTP) on any account
- Short-lived session tokens with a configurable idle timeout and re-authentication
- Rate limiting on authentication endpoints
- Magic link passwordless sign-in option
Tenant Isolation
Complete data separation between workspaces
- Workspace-based tenant isolation
- All requests scoped to user's workspace
- Role-based access controls (RBAC)
- Envelope-scoped document authorization
- Signing field isolation: recipients can only sign their own fields
- Sub-group access controls
Signing Link Security
A separate, time-limited signing link for each person
- High-entropy opaque signing tokens
- Tokens stored as hashes only
- Time-limited token expiration
- Single-use signing tokens
- Witness co-signing with separate secure tokens
- Full audit trail of link activity
Audit Trail Integrity
A record of every signing event
- Comprehensive event logging
- Timestamped activity records
- Export and reporting capabilities
Infrastructure Security
Enterprise infrastructure
- Hosted on Google Cloud, with the database in the same region as your documents
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Automated backups with point-in-time recovery
- DDoS protection via Cloud Run and Google Front End
Access Controls
Fine-grained permissions and controls
- Admin and standard user roles
- Granular permission settings
- Workspace administrator controls
- Audit log access management
- API access controls with developer keys
- Custom branding per workspace
About SignAndGo
Company: Fintech Development Pty Ltd
Address: Level 1, 18-20 Knuckey Street, Darwin NT 0800
Contact: sign@signandgo.com.au
Security & Procurement FAQ
Does SignAndGo have security certifications?
SignAndGo runs on Google Cloud infrastructure, which holds ISO 27001, 27017 and 27018 certification. Contact us for our current security documentation.
Where is data stored?
Our data storage page sets out where your documents are kept.
How is data encrypted?
Data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Signing tokens are stored as cryptographic hashes. API communications use HTTPS exclusively.
What authentication methods are supported?
SignAndGo supports email/password sign-in plus Google and Microsoft single sign-on via OAuth 2.0. Passwordless magic link sign-in is also available, and any account can enable two-factor authentication (TOTP). Authenticated sessions use short-lived tokens with an idle timeout that workspace admins can configure, and re-authentication on expiry.
How do you handle data retention?
Data retention policies can be configured per workspace. Completed documents and audit trails are retained according to your policy requirements. We support data export for compliance purposes.
Can we get a security questionnaire or your security documentation?
Yes. We can complete security questionnaires (SIG Lite, CAIQ), share a summary of our internal security reviews, and provide other security documentation under NDA. Contact us at sign@signandgo.com.au.
What happens if there is a security incident?
We have an incident response plan that includes containment, investigation, notification, and remediation phases. Customers are notified promptly of incidents affecting their data as required by applicable regulations.
Have security questions?
Contact us for security documentation or questionnaires.