Security

Security you can actually read

No vague promises or badges. This page explains how Signkoi protects your documents and the people who sign them, and every point describes how the product works today.

Sharing

The signing link is the key, so we guard it

Recipients sign without an account, which means the link itself is the credential. Here is how it is protected.

Signing-link security

Every link is built from 32 bytes of cryptographically secure randomness. It contains no document ID or other guessable value, so links cannot be enumerated.
Incoming links are matched by their SHA-256 hash. The readable link is stored only in encrypted form, so you can copy it again from your dashboard.
Choose when a link expires: never, or after 1, 3, 7 or 30 days. Expired links stop accepting signatures.
Revoke a link at any time, and the document stops loading for anyone who has it. Creating a new link automatically revokes the previous one.
One signature per signer. Once a recipient has signed, their link is marked as used. If two submissions arrive at the same moment, only one of them is accepted.
Signing API responses include Referrer-Policy: no-referrer and X-Robots-Tag: noindex, so browsers don’t pass the link on to other sites and search engines don’t index it.

Access control

Only the owner of a document can view, edit, send, download or delete it. The server checks ownership on every request, not just in the interface.
A signing link opens one document and nothing else. Recipients never get access to your account, your other documents or your dashboard.
Once a document is completed, its fields are locked and it can no longer be changed.
Files are kept in private storage outside the public web folder. They are streamed only to the signed-in owner or to someone with a valid link, and their file names are generated by the server, never taken from the upload.
Uploads must really be PDFs: the file contents are checked, not just the extension. The size limit is 25MB.

Evidence & protection

A clear record, delivered safely

Every important step is logged on the server, and every response is sent with hardened defaults.

Audit trail

Key events are recorded: document created, sent, opened (plus a running view count), signed, declined, completed, downloaded, and link revoked or expired.
Each entry includes a timestamp, the IP address and the browser’s user agent.
The signature record holds the signer’s name, how they signed (drawn, typed or uploaded), when, and from which IP address and browser.
Signers must tick a box agreeing to sign electronically. The server rejects any signature submitted without that agreement.
A SHA-256 checksum of every uploaded file is saved when you upload it.
Audit entries are written by the server. The app has no way to edit them.

Transport & headers

In production, every link the app generates uses HTTPS. On secure connections the server sends Strict-Transport-Security (one year, including subdomains), so browsers never fall back to plain HTTP.
Every response from our API and file server includes hardening headers: X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN (blocks clickjacking), a strict referrer policy, and a Permissions-Policy that turns off camera, microphone and location access.
Session cookies are HttpOnly and SameSite=Lax, and browser requests that change data are protected against cross-site request forgery (CSRF).
Documents sent to signers are marked no-store, so shared computers don’t keep cached copies.
When something fails, you see a clear message. Internal error details never reach the browser.

You’re in charge

Your account, your data

Strong defaults for signing in, plus controls to review sessions and remove what you no longer need.

Account security

Passwords are hashed with bcrypt and are never stored in readable form. New passwords need at least 8 characters, with both letters and numbers.
Sign-in attempts are rate-limited by email address and network, and too many failures cause a short lockout. Registration, password resets, signing and account deletion are rate-limited too.
Review your active browser sessions (device, IP address, last active) in Settings, and sign out every other session in one click.
Changing your password signs out your other browsers and revokes mobile-app sign-ins on other devices.
To delete your account, you must confirm your current password.

Data you control

Delete any document at any time. The original file, the signed PDF, the thumbnail and the signature images are removed from storage, along with the document’s fields, links and audit trail.
Delete your account from Settings. Every document you own is deleted the same way, your profile photo is removed and you are signed out.
Deletion is permanent, and there is no recycle bin in the app. Download any signed PDF you want to keep before you delete it.
Signers can download their own copy of the signed PDF through their link, so both sides have a record.

Straight talk

What this page doesn’t say

We don’t list certifications, compliance badges or claims about encryption at rest. If something isn’t on this page, don’t assume we do it. If your organisation needs a particular control, ask us and we’ll give you a direct answer.

Random, hashed signing links
Owner-only document access
Signed PDF for every party
Timestamped audit trail