Privacy & Data Protection at SignVerse
1.Our privacy posture in one paragraph
SignVerse handles the minimum personal data required to run legally meaningful signing ceremonies, isolates it strictly per organization, masks it wherever it surfaces outside its purpose, stores no passwords and no raw credentials of any kind, and records every access-relevant action in an immutable audit trail. For organizations with strict data-residency needs, SignVerse can run fully self-hosted — your servers, your database, your jurisdiction.
2.What we process
| Category | Examples | Why |
|---|---|---|
| Account data | Name, work email, organization | Sign-in, workspace membership |
| Contact & recipient data | Name, email, phone, company, delivery preferences | Routing documents to the right signers, the way they prefer |
| Customer records | Company profile fields your admins configure | Your CRM-style organization of signing work |
| Documents & signatures | Uploaded files, field values, signature images | The product's core purpose |
| Ceremony evidence | Timestamps, verification events, device/network signals, signature-motion telemetry | Integrity, forensics, and dispute defense |
3.Data minimization — by structure, not by promise
- No login passwords exist to leak. Sign-in is passwordless; one-time codes are stored only as Argon2 hashes and expire in minutes.
- Contacts can never hold credentials. The contact record's schema accepts delivery preference codes only — an allowlist that structurally excludes passwords, password hashes, one-time codes, and access grants from ever being written, on every code path (create, update, and auto-save from ceremonies alike).
- Tokens, keys, and secrets are hash-only or encrypted (see the Security Whitepaper, §5).
- Public pages expose no internal identifiers or storage paths. Invitation flows show masked addresses (
f***@domain) and coarse status only.
4.Masking wherever data leaves its purpose
- Audit details carry masked emails and names — enough to be evidentiary, not enough to be a directory.
- Exports (CSV results, submission logs) mask phone numbers by default.
- Application logs never contain one-time codes, tokens, secrets, or unmasked personal data.
5.Who can see what
- Tenant isolation: every read and write is scoped to your organization; cross-organization access paths do not exist, and cross-tenant references in requests are rejected and tested on every release.
- Role-based access within your organization: 10 roles over 69 fine-grained permissions let you give coordinators, compliance officers, auditors, and viewers exactly what they need — enforced server-side.
- Recipients see only their ceremony. A signing link authorizes one recipient's view of one document; it cannot enumerate or access anything else.
- We don't reveal who uses SignVerse. Sign-in responses are identical for existing and non-existing accounts, so outsiders cannot probe your staff list through our login page.
- Platform operators are separate. Operator-console access requires an explicit platform-administrator role with its own stricter sign-in.
6.Retention, deletion, and portability
- Deletion is honest about relationships: deleting a customer record untags its contacts and envelopes rather than leaving dangling references; drafts can be deleted outright; document version history is kept deliberately, because a signing platform's value includes proving what happened.
- Storage policy is configurable per deployment and per organization (upload limits, scanning, archival behavior), and organizations can export their audit trails and results.
- Self-hosted deployments give you direct control over backup, retention, and deletion schedules on your own infrastructure.
- Formal data-subject-request (DSAR) tooling — packaged export and erasure workflows — is under active development; today these requests are fulfilled operationally per deployment.
7.Ceremony evidence and biometric-style data
Signature-motion telemetry and the per-signer signature baseline exist for one purpose: defending the authenticity of that signer's signatures. This data is organization-scoped like everything else, never shared across tenants, never used for profiling or advertising, and surfaces only as a forensic score with a deterministic, explainable breakdown (see Signature Integrity).
8.Where your data lives
SignVerse supports fully self-hosted, single-tenant deployment: application, database, document storage, and keys all run on infrastructure you control, in the jurisdiction you choose. Organizations may additionally hold their integration secrets in their own KMS/vault (AWS, Azure, GCP, HashiCorp) — SignVerse keeps only references and fails closed if your vault is unreachable.
9.Your responsibilities
Privacy is shared: protect the mailboxes that receive sign-in codes and signing invitations; grant your users the narrowest roles that work; configure your communication providers with least-privilege credentials; and, if self-hosting, maintain disk encryption, TLS, backups, and access control on the host.