Document security isn't just a feature — it's the foundation of any trustworthy e-signature platform. When you sign a document electronically, you need confidence that the document can't be tampered with, that your identity is protected, and that there's an unbreakable chain of evidence proving what was signed, when, and by whom.
Global · Enacted Ongoing
TLS/HTTPS encryption protects all data in transit between browser and server
SHA-256 document hashing creates a unique fingerprint at upload and after signing
ECDSA P-256 cryptographic signatures provide mathematical non-repudiation
Append-only audit trail cannot be modified or deleted by any user or system process
32-byte cryptographically random signing tokens — only hashes stored in database
Infrastructure includes biometric access, 24/7 surveillance, and redundant power
Document security isn't just a feature — it's the foundation of any trustworthy e-signature platform. When you sign a document electronically, you need confidence that the document can't be tampered with, that your identity is protected, and that there's an unbreakable chain of evidence proving what was signed, when, and by whom. SignForge implements defense-in-depth security: TLS encryption protects data in transit, documents are hashed with SHA-256 at every stage, ECDSA P-256 cryptographic signatures provide mathematical proof of document authenticity, and an append-only audit trail ensures no event can ever be modified or deleted. Signing tokens are 32 bytes of cryptographic randomness, and only their SHA-256 hashes are stored in the database. Our infrastructure runs on Hetzner in Germany, with ISO 27001:2022 certified data centers featuring biometric access control, 24/7 surveillance, and redundant power systems.
These are the facts we capture and store for every signature. Security best practices sets the requirements above — whether what we record satisfies them for a given transaction is a legal question that depends on the circumstances.
TLS 1.3 encryption on all connections via Cloudflare edge network
SHA-256 hash computed at document upload and recomputed after PDF stamping
ECDSA P-256 digital signatures embedded in verification records
QR code on every signed document links to public verification endpoint
Signing tokens: 32 bytes crypto-random, base64url encoded, only SHA-256 hash stored
Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options enforced
TLS 1.3 + SHA-256
Cryptographic proof
Append-only, immutable
Certified infrastructure
SignForge uses multiple layers of security: TLS encryption for data in transit, SHA-256 hashing for document integrity, ECDSA P-256 cryptographic signatures for non-repudiation, and an immutable audit trail. Signing tokens are 32 bytes of cryptographic randomness, and only their hashes are stored.
Any tampering would be immediately detectable. SignForge computes a SHA-256 hash of the document at upload and after signing. Changing even a single byte would produce a completely different hash. Additionally, ECDSA cryptographic signatures embedded in the verification record would fail validation.
SignForge uses TLS 1.3 for data in transit, SHA-256 for document integrity hashing, ECDSA P-256 for cryptographic verification signatures, and bcrypt for password hashing. Signing tokens use 32 bytes of crypto-random data.
General information — not legal advice
This page summarizes electronic signature legislation drawn from primary legal sources and international bodies including UNCITRAL and UNCTAD. It is not legal advice and creates no solicitor–client or attorney–client relationship. Laws change, and how they apply depends on the transaction, the parties, and the document type. Before relying on electronic signatures for a regulated, high-value, or cross-border transaction — or for any document type listed as excluded — take advice from qualified counsel in the jurisdiction whose law governs that transaction. That is a separate question from the governing law of your agreement with SignForge, which is set out in our Terms of Service.
Last reviewed: 10 August 2026
Legally binding e-signatures with 256-bit encryption, cryptographic verification, and an immutable audit trail. Free forever.
Get started freeNo credit card required.