Security Overview
Built with enterprise security controls to protect your documents and data
Australian Hosted
Encrypted at Rest
SOC 2-Aligned Practices
Audit Trail
Security Controls
Authentication & Session Security
Enterprise-grade authentication protecting your accounts
- Google and Microsoft single sign-on via OAuth 2.0
- Optional two-factor authentication (TOTP) on any account
- Short-lived session tokens with a configurable idle timeout and re-authentication
- Rate limiting on authentication endpoints
- Magic link passwordless sign-in option
Tenant Isolation
Complete data separation between workspaces
- Workspace-based tenant isolation
- All requests scoped to user's workspace
- Role-based access controls (RBAC)
- Envelope-scoped document authorization
- Signing field isolation: recipients can only sign their own fields
- Sub-group access controls
Signing Link Security
Secure, tamper-proof signing process
- High-entropy opaque signing tokens
- Tokens stored as hashes only
- Time-limited token expiration
- Single-use signing tokens
- Witness co-signing with separate secure tokens
- Full audit trail of link activity
Audit Trail Integrity
Tamper-evident audit logging
- Comprehensive event logging
- Cryptographic hash chain verification
- Verification endpoints for chain integrity
- Timestamped activity records
- Export and reporting capabilities
Infrastructure Security
Australian-hosted, enterprise infrastructure
- Data hosted in Google Cloud Platform: Sydney (australia-southeast1)
- Managed database with Australian data residency
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Automated backups with point-in-time recovery
- DDoS protection via Cloud Run and Google Front End
- SMS delivery via Australian carrier routes
Access Controls
Fine-grained permissions and controls
- Admin and standard user roles
- Granular permission settings
- Workspace administrator controls
- Audit log access management
- API access controls with developer keys
- Custom branding per workspace
About SignAndGo
Company: Fintech Development Pty Ltd (ACN 655 608 969)
ACN: 655 608 969
Address: Level 1, 18-20 Knuckey Street, Darwin NT 0800
Contact: sign@signandgo.com.au
Security & Procurement FAQ
Does SignAndGo have security certifications?
SignAndGo is designed with security controls aligned to industry standards. We are working toward formal certifications including SOC 2 Type II and ISO 27001. Contact us for our current security documentation.
Where is data stored?
All data is stored in Google Cloud Platform Sydney (australia-southeast1) with a managed database providing Australian data residency. Documents are stored in secure cloud storage with server-side encryption. All infrastructure is provisioned within Australian regions.
How is data encrypted?
Data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Signing tokens are stored as cryptographic hashes. API communications use HTTPS exclusively.
What authentication methods are supported?
SignAndGo supports email/password sign-in plus Google and Microsoft single sign-on via OAuth 2.0. Passwordless magic link sign-in is also available, and any account can enable two-factor authentication (TOTP). Authenticated sessions use short-lived tokens with an idle timeout that workspace admins can configure, and re-authentication on expiry.
How do you handle data retention?
Data retention policies can be configured per workspace. Completed documents and audit trails are retained according to your policy requirements. We support data export for compliance purposes.
Can we get a security questionnaire or your security documentation?
Yes. We can complete security questionnaires (SIG Lite, CAIQ), share a summary of our internal security reviews, and provide other security documentation under NDA. Contact us at sign@signandgo.com.au.
Is SignAndGo GDPR compliant?
Yes. We provide data processing agreements (DPA), support data subject rights, and maintain records of processing activities. See our DPA Summary page for details.
What happens if there is a security incident?
We have an incident response plan that includes containment, investigation, notification, and remediation phases. Customers are notified promptly of incidents affecting their data as required by applicable regulations.
Have security questions?
Contact us for security documentation, questionnaires, or to schedule a security review.