Talk to the team
Bring your security checklist
Evaluating vendors? Our team answers item by item: encryption, signature standard and evidence. Get your questions answered directly on WhatsApp.
This page describes what Signater does to protect your documents, with the precision a legal or security team expects — and nothing beyond what the platform delivers.
From the connection to the stored file: TLS in transit, documents encrypted and replicated across multiple zones, PAdES sealing on the signed PDF, Signater's timestamp and an immutable audit trail.
The most sophisticated signing feature is worth little on a fragile platform. These are the base protections, from the connection to the database.
Every access, from the browser or the API, goes through HTTPS/TLS at the edge, with HSTS preventing any fallback to unencrypted HTTP.
Documents live in object storage, encrypted with provider-managed AES-256 and replicated across zones and geographic regions.
API tokens, MFA codes, digital certificate passwords and SMTP credentials are encrypted at rest, with a random nonce per value.
The database stores only a PBKDF2 derivation with an individual salt; the password itself is never stored.
A TOTP second factor for whoever operates the account, with recovery codes so you are not locked out when switching devices.
The Cloudflare Turnstile challenge blocks bots on the authentication screens, without asking real people to decipher image puzzles.
Storage
Documents live in object storage with provider-managed AES-256 encryption at rest — no file is ever written unencrypted.
Every file is automatically replicated across multiple devices, availability zones and geographic regions: a hardware failure never compromises your documents.
Deletions go through the trash, with restore available to the account owner before permanent removal.
Availability and durability
Storage operates under a 99.9% availability Service Level Agreement (SLA).
Files are replicated by the provider across multiple geographic regions, with designed durability of 99.999999999% per year — eleven nines. In practice, losing a file is a statistically negligible event.
Additional backup layers, in a separate region, protect documents beyond the provider's replication.
Signature standard
The cryptographic signature lives inside the file itself, in the PAdES standard, recognizable by mainstream signature validators. The document carries its own proof instead of depending on an external registry.
After signing, the document is sealed: any later change breaks the seal and is flagged by PDF readers, such as Adobe Reader.
The signature hash uses SHA-256, SHA-384 or SHA-512, and the certificate of completion records the SHA-256 of each file for integrity checks.
Moment of signing
Along with the signature, the document receives a timestamp issued by Signater's own Timestamping Authority, built on the international RFC 3161 standard: cryptographic proof of when the signature happened.
The recorded moment no longer depends on the clock of the signer's computer. If someone questions the date of a contract, Signater's timestamp cryptographically attests the exact moment — verifiable in the document itself.
Global registry
IANA is the organization that coordinates the internet's core identifiers. Among them are Private Enterprise Numbers — unique codes it assigns to organizations that run their own standardized infrastructure.
Signater holds enterprise number 66151. Every cryptographic identifier we issue derives from it: it never collides with another organization's, and it traces back to us in a public, independent registry.
Timestamping Authority
Signater operates its own Timestamping Authority on RFC 3161, the international standard for trusted time. Each timestamp is issued under our policy identifier 1.3.6.1.4.1.66151.1.1 — built from our IANA number, unique to Signater and readable inside the document.
That gives every signature independent proof of its moment: evidentiary weight recognized under the U.S. ESIGN Act and, internationally, under frameworks such as the EU's eIDAS regulation.
Long-term validation
Every digital signature is checked against a certificate, and certificates expire. Without preparation, validating an old document can fail years later, even if the signature was valid on the day.
With long-term validation (LTV), the document embeds the complete certificate chain and the revocation data in force at the moment of signing. The proof travels inside the file and does not depend on external lookups in the future.
Evidence
Every action on the envelope becomes a new record: nothing is edited, nothing is deleted. The trail only grows, and that is what makes it reliable as evidence.
The record is forensic: IP address, geolocation and device for every event, plus every MFA attempt, including the incorrect ones. Whoever got the code wrong before getting it right left that in writing.
At the end, the full history is consolidated in the certificate of completion that accompanies the envelope.
Yes. Electronic signature laws such as the U.S. ESIGN Act and UETA make electronic signatures legally binding, and the EU's eIDAS regulation recognizes them across Europe. Signater produces an advanced electronic signature based on a digital certificate: signer binding, multi-factor authentication, hash-based integrity, document sealing and an audit trail of the act.
The advanced signature identifies the signer and guarantees document integrity through cryptographic means, without requiring them to hold a personal digital certificate. The qualified signature, in regulations that define it, is made with the signer's own accredited digital certificate.
Signater produces an advanced electronic signature based on a digital certificate, in the PAdES standard, reinforced by qualified timestamps and long-term validation. Signers who hold their own digital certificate can sign with it, making the signature certificate-based end to end.
It is cryptographic proof issued by a Timestamping Authority attesting the exact moment the signature existed. The document date stops depending on the clock of the signer's computer.
LTV (long-term validation) embeds the certificate chain and the revocation data from the moment of signing into the document. Without it, validation can fail once the signer's certificate expires. It is worth it for documents that need to stay verifiable for years, such as long-term contracts and corporate records.
Documents live in object storage with provider-managed AES-256 encryption at rest, replicated across availability zones and geographic regions, under a 99.9% availability SLA with 99.999999999% designed annual durability and additional backup layers. Deletions go through the trash, with restore available to the account owner.
Access passwords are never kept in plain text: we store a PBKDF2 derivation with an individual salt per password. Secrets the platform needs to read back, such as API tokens, MFA codes, digital certificate passwords and SMTP credentials, are encrypted with AES-256-GCM, with a random nonce per value.
Talk to the team
Evaluating vendors? Our team answers item by item: encryption, signature standard and evidence. Get your questions answered directly on WhatsApp.