How SignBolt Protects Your Documents

All data transmitted between your browser and SignBolt's servers is encrypted using TLS 1.2 or TLS 1.3 — the same standard used by financial institutions. Our HSTS policy with a two-year max-age and preload flag means browsers will always enforce HTTPS, even on first visit.

Documents stored in our infrastructure are encrypted at rest using AES-256, the encryption standard mandated by the US National Institute of Standards and Technology (NIST) and widely accepted by government and financial regulators globally.

• TLS 1.3 for all data in transit
• AES-256 encryption for data at rest
• HSTS preload — HTTPS enforced at the browser level
• Zero plaintext storage of passwords or API keys

When a document is signed on SignBolt, we compute a SHA-256 cryptographic hash of the completed PDF. This hash acts as a tamper-evident fingerprint: if a single byte of the document is altered after signing, the hash will no longer match, making any tampering immediately detectable.

The hash is recorded in the document's audit trail alongside the timestamp, signer's email, IP address, and user agent. This creates a verifiable, immutable chain of custody that can be produced as evidence in legal proceedings.

• SHA-256 hash computed and stored for every signed document
• Hash tied to signer identity and timestamp in audit trail
• Tamper detection: any post-signing modification is detectable
• Downloadable signing certificate available for each document

SignBolt's audit trail captures every significant action taken on a document — from creation and viewing through to signing and downloading. Each event is timestamped to millisecond precision and associated with the authenticated user or signer responsible.

The following data points are recorded per signing event:

• Signer's verified email address
• IP address at time of signing
• Browser user agent string
• UTC timestamp of every action (view, sign, download)
• Document SHA-256 hash at point of completion
• Unique document and audit IDs for cross-referencing

Audit logs are accessible from your SignBolt dashboard and can be exported as a PDF signing certificate — suitable for attachment to contracts stored in your own document management system.

SignBolt uses email-verified accounts — no account can be activated without completing email verification. This satisfies basic identity assurance requirements and prevents automated account creation.

Additional protections applied to every authentication flow:

• Rate limiting on login and signup endpoints (per IP)
• Account lockout after 10 failed login attempts, clearing after 15 minutes
• Input sanitisation — HTML and script injection prevented at API layer
• Strict email format validation (RFC 5322) with disposable domain blocking
• All failed login and signup attempts are logged for security monitoring

For Business plan API access, all keys are stored as SHA-256 hashes — the raw key is shown only once at creation time and cannot be retrieved. Keys support scoped permissions (read / write / admin), expiry dates, and can be rotated or revoked instantly from your dashboard.

SignBolt is deployed on Vercel's global edge network — the same infrastructure trusted by companies like GitHub, Washington Post, and Twilio. Vercel operates data centres in North America, Europe, and Asia-Pacific (including Australia), ensuring low-latency access and built-in redundancy.

• Global CDN with automatic failover across regions
• Serverless functions with no persistent server attack surface
• Automatic DDoS mitigation at the edge layer
• Security response headers on every response (CSP, HSTS, X-Frame-Options DENY)
• Content Security Policy blocks injection of unauthorised scripts
• API endpoints excluded from CDN caching (no-store, private)

SignBolt does not sell, share, or use your documents for any purpose other than delivering the service. Your documents are yours — we do not train machine learning models on your content.

• Documents are accessible only to account holders and designated signers
• No third-party access to document content
• Signed PDFs are downloadable and can be deleted by the account holder
• Personal data handling follows our Privacy Policy
• Stripe handles all payment data — we never see or store card details

For enterprise clients with specific data residency requirements, please contact our team to discuss your requirements.

Electronic signatures created on SignBolt are legally binding under the following legislative frameworks:

If you discover a security vulnerability in SignBolt, please report it to us responsibly before public disclosure. We take all reports seriously and aim to acknowledge receipt within 48 hours.

Please do not access, modify, or delete data belonging to other users. Limit testing to your own accounts and documents.

• Email reports to: security@signbolt.store
• Include a clear description and steps to reproduce
• We will credit researchers who disclose responsibly (if desired)
• We do not pursue legal action against good-faith researchers