Security at SwiftSignet
Security is part of the signing workflow, from account access to document delivery and audit records.
Application security
- Authenticated sessions use HTTP-only cookies and secure transport in production.
- Passwords are stored as bcrypt password hashes rather than plaintext passwords.
- Signing invitations use high-entropy tokens whose hashes are stored in the database.
- Signing links expire and can be revoked by the sender.
- Server-side validation is applied to required signing fields before a signature is recorded.
- Rate limits protect sensitive authentication, signing and payment endpoints against repeated abuse.
Document and audit protection
Documents, signer records and audit events are associated with authenticated account owners. Signing events can record the event time, IP address and browser/user-agent information to support an audit trail. Completed documents can be downloaded by authorized parties.
Infrastructure
SwiftSignet uses managed infrastructure for application delivery, PostgreSQL database hosting, transactional email and payment processing. Access to provider credentials is kept in deployment environment variables rather than source code.
Email and payment security
Transactional email is sent through Resend using the verified SwiftSignet sending domain. Payments are handled through Stripe-hosted checkout and billing infrastructure; SwiftSignet does not need to store raw card numbers.
Security reporting
If you believe you have found a security issue, contact hello@swiftsignet.com with a description and enough detail for us to investigate. Please do not include passwords, private signing tokens or unnecessary personal information in a report.
Important: SwiftSignet does not currently claim SOC 2, ISO 27001, HIPAA, FedRAMP or other formal security certification unless separately documented. Customers with regulated-data requirements should review their obligations and contact us before using the service.
Effective date: October 1, 2026