Our Infrastructure Commitment
1. Data Storage Location
SignAndGo is committed to storing all customer document data within Australian borders. Our primary infrastructure is hosted on Google Cloud Platform (GCP) in the australia-southeast1 (Sydney) region. This includes:
- All uploaded documents (PDF, DOCX)
- Signed and completed documents
- Signature images and certificate data
- Audit trail records and event logs
- User and workspace data
2. Database Infrastructure
Our database systems are provisioned on Google Cloud Firestore, configured for the Australian region (australia-southeast1, Sydney). Document files are stored in Firebase Storage, also configured for the Sydney region. Database backups are taken daily and weekly and are stored in Australian regions only, alongside a seven-day point-in-time recovery window, so your documents and signing data never leave the country even during disaster recovery.
3. Encryption Standards
All data is protected with industry-standard encryption:
- At rest: AES-256 encryption for all stored documents and database records
- In transit: TLS 1.3 encryption for all data transfers
- Signing tokens: Cryptographically secure, one-time-use tokens for document access
4. Third-Party Services
Some ancillary services may process limited metadata, and the table shows where each one is located:
| Service | Location | Purpose | Data Processed | Security |
|---|---|---|---|---|
| Google (sign-in) | United States | Signing in to your account | Name, email address and sign-in method; never a document | SOC 2 Type II |
| Stripe | United States | Payment processing | Billing info only | PCI DSS Level 1 |
| Amazon SES (ap-southeast-2, Sydney) | Australia (Sydney) | Transactional email (signing requests, notifications) | Email addresses and message text, and the completed PDF when it is attached | SOC 2 Type II |
| SendGrid | United States | Email delivery | Email addresses and message text, and the completed PDF when it is attached | SOC 2 Type II |
| Twilio | United States | SMS notifications | Phone numbers | SOC 2 Type II |
| Google Cloud (Vertex AI, Sydney) | Australia (Sydney) | AI document summary, contract analysis, chat | Processed in Australia; not used to train models | SOC 2 Type II |
Important: Your documents are stored in Sydney. Apart from the completed PDF attached to the completion email, described below, document content (PDF files, signature images, form data) is not sent to these third-party services. They only receive the minimum metadata required for their specific function.
Choices you make yourself. Two settings decide whether a completed document travels beyond our Sydney servers:
- Attach the signed PDF to completion emails (Workspace Settings). On by default, so every party receives their copy in the email, which sends it through our email provider. Switch it off and every party gets a secure link instead, and the document is downloaded from our Sydney servers.
- Connected systems such as Xero or Procore, off until you connect one. When you connect one, we send your completed documents to it at your direction, and that provider may store data outside Australia under its own terms.
Both are yours to change at any time: switch the attachment off, or disconnect the integration in Settings, and we stop sending. Nothing goes to a system you have not connected.
5. Compliance Framework
SignAndGo is designed to support compliance with:
- Australian Privacy Act 1988 - Including Australian Privacy Principles (APPs)
- APP 8 (Cross-border disclosure) - We minimize overseas data transfers
- Electronic Transactions Act 1999 - Our signatures are legally binding
- Real Estate industry requirements - Suitable for property transactions
6. Enterprise Data Residency Options
For enterprise clients with strict on-shore processing requirements, we offer:
- Dedicated Australian-only infrastructure
- Custom data processing agreements (DPA)
- Audit and compliance reporting
- Option to disable AI features that may use international APIs
Contact enterprise@signandgo.com.au to discuss your specific requirements.
7. Verification and Auditing
You can verify our data residency commitments through:
- Request a data location certificate for your account
- Access audit logs showing where your data is processed
- Review our subprocessor list for complete transparency