Product

Security & Compliance

This page describes the actual mechanics behind every signature DocuAgree collects, and the security practices protecting your account and documents — a direct, specific account of what's actually built and why, not a marketing summary of a compliance certification.

How every signature is built to hold up

Courts evaluating whether an electronic signature is enforceable generally look for four things, and each is built into the signing flow automatically — not as an add-on:

• Intent to sign. A signer draws or types a signature and takes a distinct "adopt & sign" action, separate from the final "complete signing" step — not a signature that's pre-applied or defaulted.
• Consent to sign electronically. Every signer sees an explicit ESIGN/UETA consent disclosure before ever viewing the document itself, and has to affirmatively accept it.
• Attribution. The signing email address, IP address, device, and exact timestamp are captured server-side at the moment of consent and at the moment of signing — never trusted from anything the client submits, which is what makes this evidence hard to forge.
• Record integrity. A SHA-256 hash of the completed document is computed the instant the last signature lands. Recompute it later and any change — even one character — produces a different value.

All of it is bundled into a certificate of completion attached to every signed document: the full event history (sent, viewed, consented, signed, from where), each signer's attribution data, and the document hash. See our guide on what actually makes an e-signature valid in court for the full legal reasoning behind each element.

Account and data security

• Passwords are hashed with bcrypt — never stored in plain text or a reversible format.
• Magic-link sign-in uses single-use links that expire after 30 minutes.
• Every signing link is scoped to one signer, one document — it can't be reused for a different signer or a different document.
• A signed document can't be altered after the fact. Once every signer has completed, the document and its fields are locked — no edits, by anyone.
• CSRF protection is applied to every mutating request across the app, and every signer-facing endpoint (viewing, consenting, signing, downloading) is rate-limited to blunt automated abuse.
• The audit trail's IP address is never client-supplied — it's read from the raw connection, not a header a signer could set themselves, so it can't be forged in a legal record.
• All traffic is HTTPS-only. Plain HTTP is never served.
• Billing runs through Stripe — your card details never touch DocuAgree's own servers, and webhook events are signature-verified before being trusted.
• Database file permissions are locked down to the application process only, not the wider server — this is access-control hardening, not encryption at rest, and we're not going to describe it as more than it is.

What this doesn't cover

Being direct about the boundary: this page describes DocuAgree's own engineering practices, not a third-party-audited compliance program — if a compliance requirement specifically calls for a formal certification, get in touch and we'll talk through it. There's also no notarization or identity-verification add-on for signatures that need a higher bar than standard e-signature attribution.

Questions about a specific security or compliance requirement? Contact us at hi@docuagree.com.