Security
Documents and sign-in
Every page and download is served over HTTPS. Passwords are stored as one-way hashes, and the sign-in cookie is not readable by scripts and is not sent with requests from other sites. Account holders can turn on two-step sign-in with an authenticator app. The service runs on hardware we operate, and documents and the database are stored on an encrypted disk.
Signing evidence
Every signed document comes with a certificate that records who signed and when. The signed PDF carries a digital signature and a trusted timestamp, so a later change can be detected. Each signing event is also added to a record the service does not allow to be edited or deleted once written, and each entry is chained to the one before it.
Anyone holding a signed PDF can check it on the check page. The file stays on their computer, and only its fingerprint is compared.
Signer protections
A sender can require an access code before a signer opens a document. We store the code as a hash, and a signer is locked out after five wrong codes. A sender can also require a one-time code emailed to the signer before the document opens.
We send signing emails from our own domain, with sender authentication set up so a receiving mail server can confirm the message came from us.
Part 11 mode
Business accounts can turn on a mode designed and tested against FDA 21 CFR Part 11. Whether your use meets those requirements depends on your own procedures and validation, which remain yours.
Health information
Business customers who handle health information can request a business associate agreement. Contact support to ask for one. Do not send health information through an account until that agreement is signed. Free and Solo accounts are not for health information.
Report a vulnerability
If you think you found a security issue, write to security@purplesign.app with enough detail for us to reproduce it. Please give us time to fix it before you share it, and do not access, change or delete data that is not yours. We do not run a paid bounty program. Our security.txt has the same details.