Your documents, handled carefully
A signature is only worth what you can prove about it. Here is how Signetec protects your documents and the evidence around them.
Separated workspaces
Every organisation’s data is kept apart and every request is checked against the workspace it belongs to. One customer can never see another’s templates, documents or people.
Verified signers
Signing links are private, expire, and work once a signatory confirms a one-time code sent to their email. Links are per signatory and per document.
Tamper-evident records
Each document is fingerprinted with SHA-256, and every action — generated, sent, verified, signed — is written to an audit trail you can export in the evidence package.
Independent proof
Fingerprints are anchored to the Bitcoin blockchain through OpenTimestamps. Your document never leaves Signetec; only its fingerprint is published, and anyone can verify it without us.
The right people, the right access
Roles limit what each person can do. Signetec staff manage accounts and subscriptions but do not read your document contents, and every staff action is logged.
Staff access protected twice
Signetec’s own administrative access requires two-step verification with an authenticator app, so a stolen password alone cannot open it.
Built on Google Cloud, hardened in layers
Signetec runs on Google Cloud in Johannesburg, South Africa. Data is encrypted in transit with HTTPS and encrypted at rest by the platform. Customers outside South Africa are covered by the cross-border transfer safeguards in our Privacy Policy; we do not yet offer a choice of hosting region.
- Text people type into documents is treated as data, never as code, so it cannot be used to attack other signers or your team
- Strict browser security headers, including a Content-Security-Policy that blocks injected scripts
- The document renderer runs with scripts disabled and cannot reach internal services
- Secrets live in a managed secret store, not in code; the code history is scanned for leaked secrets and dependencies are monitored for known vulnerabilities
- Automated tests exercise the security rules on every change
Privacy
We handle personal information with the Protection of Personal Information Act (POPIA) in mind. What we collect, why, and how long we keep it is set out in our Privacy Policy, and the rules for using the service are in the Terms of Service and Acceptable Use Policy.
Found a vulnerability? We want to hear about it. Email support@signetec.com with the details and we will respond promptly.
What Signetec does and does not do
Signetec provides the tools and the evidence. Whether a particular document may be signed electronically depends on the law that applies to it, and some documents must still be signed in ink. We are not a law firm and cannot give legal advice. See the FAQ for the common exclusions.