Security you can explain to your customers.
E-signatures are only worth anything if they hold up. Here's exactly how QDigiSign keeps your documents private, proves they weren't altered, and meets the rules in the regions you operate in — in plain English, no jargon.
How we protect your documents
Documents are encrypted when stored
Every uploaded and signed PDF is scrambled on our servers using AES-256 — the same class of encryption banks use. A stolen file is useless without the key.
Tamper-proof fingerprint on every signed file
When signing completes, we take a unique fingerprint (SHA-256) of the document. If anyone changes even one character afterwards, the fingerprint no longer matches — so tampering is instantly detectable.
A full, unalterable activity trail
We record who uploaded, who opened, who signed, the exact time, the IP address, and the browser/device for every step — kept as an audit trail that can't be quietly edited.
Role-based access
Admin, Manager, HR, Employee and Auditor roles come built in, and each workspace can create its own roles with precisely the permissions it wants. People only see what their role allows.
Two-step login (MFA)
Users can add a one-time code from an authenticator app on top of their password, and a workspace can require it for everyone.
Network & session controls
Restrict sign-in to trusted office networks (IP allowlist) and set how long a session lasts before re-login is required.
Strong passwords, anti-brute-force
Passwords are stored using one-way bcrypt hashing (never as plain text), must meet a strength policy, and repeated bad attempts are rate-limited and logged.
Encrypted connections
All traffic runs over HTTPS/TLS 1.2+ in production, with strict browser security headers that block common web attacks.
Your data stays separated
Every customer (tenant) is isolated. One organisation can never see another's documents, users or audit trail.
Built for the rules where you do business
QDigiSign is designed to support the privacy and e-signature laws of each region below. Per-workspace settings let you choose your data controls, currency and language.
India
Built to support the DPDP Act 2023 and the IT Act 2000 §5 basis for electronic signatures, with GST-compliant invoicing.
European Union / UK
Designed around GDPR / UK-GDPR principles — data-subject access, deletion, retention controls and eIDAS-style electronic-signature evidence.
United States
Supports the ESIGN Act and UETA legal basis for electronic signatures and records.
Canada
Aligned with PIPEDA privacy principles and Canada's electronic-documents legislation (PIPEDA Part 2).
South Africa
Built to support POPIA privacy requirements and ECTA electronic-signature recognition.
Saudi Arabia
Designed to support the PDPL (SDAIA) data-protection requirements and KSA e-transactions law.
Certifications & assurance
We believe in being straight about where we are. Here's the honest status — what's live today versus what we're working toward.
Encryption at rest & in transit
AES-256 storage encryption + HTTPS/TLS — live today.
Tamper-evident audit trail & document fingerprinting
Live today on every signed document.
Role-based access, MFA, network & session controls
Live today, configurable per workspace.
SOC 2 Type II
Controls being implemented; independent audit planned. Report available under NDA once complete — not yet certified.
Independent penetration testing
Third-party test scheduled; summary letter available to enterprise customers on request once complete.
Disaster recovery & vulnerability management
Documented processes with defined RTO/RPO targets; formal program maturing.
This page describes QDigiSign's security design and current posture. “Aligned” / “built to support” means the product is designed to help you meet that framework's requirements; it is not a statement of independent certification. For your specific legal/compliance obligations, please consult your advisors. Enterprise customers can request our security documentation pack.
Questions from your security team?
We're happy to walk through any of this. Start free and see the controls yourself, or reach out for the full documentation pack.