Security: how Suresign protects your documents and account

Suresign protects your documents, account, and evidence with several layers of security. This page explains what we do in plain words, what you need to do yourself, and how to report a problem.

​

Encryption: locking your files

At rest. Every stored document is encrypted with AES-256-GCM. Think of this as a lock that scrambles your file so no one can read it without the key. The GCM part means the lock also detects tampering: if someone tries to modify the scrambled file, it will not open properly. When a file is uploaded, it waits briefly in a private holding area while our server checks it, encrypts it, and then deletes the holding copy. In transit. All traffic between your browser and Suresign uses TLS, the same secure connection banks use. HTTP is redirected to HTTPS, and a setting called HSTS makes sure your browser always uses the secure version. Keys. The encryption key is held only in process memory while the server is running. It is never written to the database or stored next to the files it protects. If the key were lost, stored documents would be unrecoverable. That is by design. Database. The database that stores your account and document records is encrypted at rest by our managed provider and reachable only over TLS.

​

Virus scanning

Every file you upload is checked for viruses before it is stored. If a file fails the scan, it is rejected and you are told why.

​

Sign-in protections

​

Two-step sign-in

Two-step sign-in adds a second check after your password. You turn it on in Settings > Security and use an authenticator app on your phone that supports TOTP. The app gives you a new code every 30 seconds. You also get one-time recovery codes. Save these somewhere safe. They are the only way back into your account if you lose your phone.

​

Signing link safety

Each signing link is built for one document, one recipient, and one turn.

• Links expire and revoke immediately when a recipient finishes signing, or when a document is cancelled, expires, or is deleted.
• Access codes are encrypted the same way as documents. Five wrong attempts lock the link for 15 minutes.
• Emailed 6-digit confirmation codes are stored as hashes and valid for 10 minutes. Once passed, the check is remembered for 12 hours in that browser.
• Nothing on the document is shown until all checks pass.

​

Your responsibilities checklist

Security is shared. Here is what only you can do:

• Use a strong, unique password and protect the email account that receives your signing links.
• Remove workspace members promptly when they leave.
• Give people the lowest role that lets them do their job.
• Check recipient email addresses before sending. We deliver to the address you type, including the wrong one.
• Set expiry dates on sensitive documents so links do not stay live forever.
• Download and store completed documents and certificates in your own records.
• Decide what belongs in a document. We encrypt whatever you upload, but we cannot decide for you whether it should have been uploaded.

​

Certifications: an honest note

Suresign is not currently SOC 2 Type II or ISO 27001 certified. The controls on this page are real and you can check them against the product, but they have not been audited by a third party. If your procurement process requires an audited report, email security@suresign.si and we will be straight with you about where we are. Our infrastructure providers hold their own certifications, and those are listed with each provider at subprocessors.

​

Report a vulnerability

If you find a security issue, tell us at security@suresign.si before disclosing it publicly. Include what you found, how to reproduce it, and what you think the impact is. We acknowledge within 3 business days, keep you updated while we fix it, and credit you if you would like. We do not currently pay bounties. Safe harbour applies to good-faith research within your own test accounts, without privacy violations, service degradation, or data destruction. Do not access or modify anyone else’s documents.

​

Next steps