Trust centre
One place for the security, privacy, compliance, and contract documents an enterprise review asks for.
Editorial owner: Security + Growth. Last reviewed 2026-09-20. Review cadence: 90 days.
What is published here
Each page states what the product does today and where to request supporting evidence during procurement.
Security architecture
Access, identity, tenant scoping, and the hash-chained audit trail that ships today.
Learn more →Compliance posture
Current controls, certifications, and regional options used in production.
Learn more →eIDAS and signature levels
SES, AES, and QES options with guidance on when each level is used.
Learn more →SOC 2
Certification posture, evidence handling, and review workflow for enterprise buyers.
Learn more →Privacy and residency
Where processing happens today, transfer safeguards, and EU residency options.
Learn more →Sub-processors
Third-party functions that process customer data — by function, never by brand.
Learn more →Data Processing Addendum (draft)
A draft GDPR Article 28 addendum. Not reviewed by counsel, and not an offer.
Learn more →Business Associate Agreement (draft)
A draft HIPAA BAA. Not reviewed by counsel, and not executable from this page.
Learn more →Request evidence
Named vendors, questionnaire answers, and editable drafts — shared on request, not published here.
Learn more →Claims index
Public claims mapped to the page that evidences them.
| Claim | Status | Evidence |
|---|---|---|
| Tenant scoping, RBAC, MFA, OIDC | Live | Read security architecture |
| Hash-chained append-only audit trail | Live | Read security architecture |
| HIPAA profile and PHI deletion gate | Live | Read HIPAA details |
| Public BAA and DPA text | Draft — not an offer | Read the BAA draft · Read the DPA draft |
| Simple electronic signatures (SES) | Live | Read signature levels |
| Advanced electronic signatures (AES) | Live | Read signature levels |
| Qualified electronic signatures (QES) | Live | Read signature levels |
| SOC 2 certification | Live | Read SOC 2 details |
| EU-only data residency | Live | Read residency details |
| Named sub-processors and questionnaire pack | Gated | Request evidence |
Some artifacts are shared through procurement and security review channels.
How to read these claims
HIPAA has no certificate for a software vendor to hold. What can exist is a business associate agreement and the controls behind it, and both are described on the pages below.
Certification and assessment artifacts are provided through standard evidence review channels rather than posted publicly.
Reporting a vulnerability
Email partnerships@endorsedsign.com with steps we can reproduce. Do not include customer documents or personal data in the report.
Running a procurement review?
Request the gated evidence pack, or write to us about a sandbox with the HIPAA profile enabled.