Security
Security controls that are live in the product today — stated plainly, without marketing redress.
Editorial owner: Security + Growth. Last reviewed 2026-09-20. Review cadence: 90 days.
Access and identity controls
All controls below are live for production tenants.
| Control | Detail |
|---|---|
| Role-based access control (RBAC) | ~60 named permissions; every staff action is gated at the application layer |
| Multi-factor authentication (MFA) | TOTP-based; enforced on all staff accounts |
| OIDC staff sign-in | Staff can authenticate via your OIDC provider; no EndorsedSign password stored |
| Password policy on credential changes | Platform-enforced minimum complexity on all password create and change paths |
| Session management | Short-lived session tokens; revocable on demand |
| Allowed-origins control per tenant | Embed and API access restricted to registered origins; unregistered origins rejected |
Data and audit controls
| Control | Detail |
|---|---|
| Tenant data isolation | Tenant scoping on every tenant-owned record. A valid token cannot retrieve records from another tenant. |
| Encryption at rest | Documents and audit records encrypted at rest in tenant-scoped storage |
| Append-only audit trail | Hash-chained event log; each event references the prior hash; tampering is detectable |
| Correlation IDs on all API requests | Every API call carries an X-Correlation-ID returned in the response; links requests to audit events and webhook deliveries |
| No PHI in notification content | Notification bodies contain links only; no document content, no PHI, no attachment in email or SMS |
| Two-person PHI deletion gate | Enabled with HIPAA profile; document deletion requires confirmation from two authorised staff; event recorded in audit trail |
How the boundary is enforced
Tenant-owned documents, envelopes, templates, customers, and audit events carry a tenant identifier that is checked on every read and write. Storage paths are generated from that identifier so files for one tenant are not mixed with another. Staff sessions are bound to a tenant. These are product constraints, not guidelines.
We do not publish vendor brand names for signing, storage, or delivery on this site. Functions are listed on the sub-processors page; identities go out under a non-disclosure agreement.
Independent attestations and enterprise controls
These controls are available now for regulated and enterprise environments.
| Item | Status |
|---|---|
| SOC 2 certification report | Available under NDA during security review |
| SAML SSO | Live for enterprise tenants |
| EU data residency | Live for eligible plans and regulated workflows |
| Qualified signatures (QES) | Live for supported jurisdictions and signature profiles |
| Penetration testing evidence | Shared through the evidence process and customer security review |
Control evidence is shared through the trust evidence process.
Report a vulnerability
If you have found a potential security issue, email partnerships@endorsedsign.com with reproduction steps. Do not include customer documents or real credentials in the report.
We will acknowledge within one business day and keep you informed of remediation progress. We will not pursue legal action against good-faith security researchers.