How we keep your documents safe.

1. Where your data lives

The database, file storage and authentication system that hold your account, documents and audit trails are hosted in Sydney, Australia (AWS region ap-southeast-2), through Supabase. We don't replicate, mirror or back up your data to any other region.

A small number of supporting systems necessarily touch global infrastructure, the static website (Vercel CDN), the TLS edge proxy (Cloudflare), the outbound email pipeline (Google Workspace SMTP) and payment processing (Stripe). The full breakdown is in our privacy policy, section 6. We've kept the list short so the trust story stays clear.

2. Encryption

3. The tamper-evident audit log

Every event in a document's lifecycle, sent, viewed, disclosure accepted, signed, completed, is recorded with:

• An ISO 8601 timestamp,
• The actor's IP address and approximate geolocation,
• A parsed device summary (browser, OS),
• A SHA-256 hash of the event's contents (serialised with sorted keys so the hash is reproducible),
• A reference (prevHash) to the hash of the previous event.

This chains every event to the one before it. If a single byte of the audit log is altered after the fact, including by us, the chain breaks and the audit page flags it. Anyone can re-verify the chain from the public Audit page using only the data on screen.

4. Database access control

Every row in our database is protected by a server-side Row-Level Security (RLS) policy that ties it to the workspace it belongs to. A user signed into one workspace cannot read another workspace's data, even by guessing IDs in the URL. Anonymous signers can only access the specific document their sign-token unlocks, never anyone else's.

5. Password storage

We never see, log or store your password in plain text. Supabase Auth handles password verification and stores a salted bcrypt hash. Two-factor authentication is on the roadmap for the Business plan but is not live yet.

6. Email authentication

Every email we send from signpad.com.au is signed with DKIM, aligned with SPF and protected by DMARC. This is what stops your signing emails being marked as spam or spoofed.

7. Backups

Supabase performs automatic daily backups of the production database in its hosted Sydney region. Backups are encrypted with the same AES-256 standard as live data. We have not configured cross-region backup replication.

8. Vendor list

The third parties we share customer data with, and what each receives:

• Supabase Inc., hosted database, authentication and file storage (encrypted at rest in AWS Sydney).
• Vercel Inc., website hosting (static files only, no account data).
• Cloudflare Inc.. TLS termination and DDoS protection (encrypted traffic in transit, not stored).
• Google LLC (Workspace), outbound email delivery via SMTP. The email body and recipient name are shared; PDFs are linked, not attached.
• Stripe Inc., subscription payment processing on paid plans (your billing email, last 4 of card, country only).
• ipify and ipapi.co. IP and geolocation lookup for the audit log. They receive the signer's IP only.

If we ever add or change a vendor, we'll update this list and the version number at the top of the page.

9. Operational practices

• Least-privilege access. Only one person at SignPad has production database access, used only for incident response. All such access is logged by Supabase.
• Single-person team disclosure. SignPad is currently operated by a small team. We don't pretend to have a separate SOC or a 24/7 security operations centre, the founder is on-call.
• Source code in private repositories. Our source is not public.
• Dependency monitoring. We use the security advisories built into our hosting providers and act on critical patches within 48 hours of disclosure.

10. Responsible disclosure

If you've found a security issue, please email sign@signpad.com.au with the subject line "Security: [short summary]". We respond within 2 business days. We don't yet run a paid bug bounty but we'll send a thank-you and credit you on this page if you'd like.

11. Data breaches

If we ever experience a data breach that's likely to result in serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in line with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth). See privacy policy section 15.

12. What we're working on

Things we want to ship in the next 12 months. These are roadmap items, not current state:

• Two-factor authentication for all account holders.
• SSO with Google Workspace and Microsoft Entra on the Business plan.
• SOC 2 Type I report.
• Customer-managed encryption keys on Business plans.
• Public status page at status.signpad.com.au.
• Independent penetration test, results summary published here.

13. Contact

Security questions: sign@signpad.com.au. We answer every message.