Trust Center
Security and compliance posture for document workflows that need confidence.
SignWorkflow is built with security-focused product behavior such as authenticated access, role-aware controls, AI-assisted review boundaries, audit-oriented records, and retention-aware document workflows. This page explains the current posture without overstating certifications.
Current trust position
SignWorkflow does not publish a SOC 2 or ISO 27001 audit report, claim HIPAA compliance, or claim GDPR certification.
Security controls are described as product behavior and operational posture, not legal certification.
AI outputs should be reviewed by users and treated as assistance for document understanding, not final legal judgment.
Regulated customers should complete their own vendor review before uploading sensitive regulated data.
Security controls customers can understand
Trust improves when buyers can see the controls that matter in day-to-day document work.
Encryption-focused handling
SignWorkflow is designed around secure transport, controlled storage, and restricted document access patterns.
Role-aware access
Workspace roles, team boundaries, and permission checks help limit sensitive document actions to authorized users.
Audit-oriented events
Document actions are recorded so teams can review signer activity, status changes, and governance events.
Retention-aware workflows
Retention and legal-hold-aware product behavior helps teams preserve records when documents should not be removed prematurely.
AI review boundaries
AI summaries, translation, clause explanations, and risk analysis are presented as review assistance, not legal advice or certification.
Compliance posture
These labels are intentionally conservative. They tell customers what is being designed for without pretending a completed audit or certification exists.
SOC 2
No independent report publishedControls are being described around security, availability, confidentiality, processing integrity, and privacy themes. SignWorkflow does not claim SOC 2 certification unless an independent report is completed.
Privacy and data rights
See the privacy noticeReview the privacy notice for information about personal data and contact support with questions about a specific processing arrangement.
HIPAA-supportive safeguards
Not a blanket HIPAA claimHealthcare use cases that involve PHI require additional review, appropriate safeguards, vendor controls, and usually a Business Associate Agreement.
Security reviews
Available for customer evaluationCustomers can review the security posture, product controls, and rollout responsibilities before using SignWorkflow for sensitive workflows.
Data handling practices
Documents are accessed through authenticated application flows.
Private workspace actions are separated from public marketing pages.
Administrative and governance actions are controlled by workspace role and plan gates.
Completed document workflows are designed to keep signing and activity context reviewable.
AI document features help with summaries, translation, explanations, and risk review while customers remain responsible for final decisions.
Cloud exports use per-user provider connections when authorized by the user.
Operational security also depends on deployment configuration, storage setup, secrets management, and customer-side access practices.
Customer responsibility
Security is shared. Customers should configure user access carefully, remove users who no longer need access, avoid uploading regulated data unless the right agreements are in place, and review their own legal obligations before using any signing platform for sensitive workflows.
Read the security policyQuestions for your vendor review
Use these questions to assess whether SignWorkflow fits your requirements. Contact us for answers about your deployment and contractual needs.
Policies and contracts
- Which data will the service process?
- What data processing terms are available?
- Which subprocessors handle the data?
Infrastructure and vendors
- Where will documents and backups be stored?
- How are storage permissions configured?
- Which providers send email or handle exports?
Access and identity
- How are sessions and account recovery protected?
- Which workspace roles can access documents?
- How are privileged actions reviewed?
Incident readiness
- How can a suspected incident be reported?
- How are affected customers notified?
- What incident response details can be shared?
Need to review SignWorkflow for your team?
Book a walkthrough to discuss access controls, audit trails, retention behavior, privacy questions, and the compliance requirements that matter for your workflow.
For regulated use
Do not upload PHI, special-category personal data, or other regulated data unless your team has completed a vendor review and the necessary contractual terms are in place.