Security
Secure Electronic Signatures
What actually makes an e-signature secure isn't the visual squiggle — it's the encryption, the audit trail, and what happens if something's ever disputed. Here's exactly how Docracy handles all three.
Four things that make a signature secure
Not marketing claims — the actual mechanics.
Encryption in transit and at rest
All traffic runs over TLS. Document bytes and application data are encrypted at rest via Cloudflare's platform defaults for R2, KV, and D1.
Tamper-evident audit trail
Every view, consent, and signature is logged with a timestamp, IP address, user-agent, and a cryptographic hash of the document content at that exact moment.
Unguessable signing links
Signing links are HMAC-signed tokens, not account passwords — they can't be brute-forced or guessed, and paid plans can add a required PIN on top.
Deliberate retention limits
Anonymous signing chains use a short retention window (9 days by default) so documents don't sit on our infrastructure longer than needed to complete signing and deliver final copies.
What "secure" doesn't mean here
We're direct about this: Docracy (RELACON GmbH) does not hold its own SOC 2 or ISO 27001 attestation. Our infrastructure runs on Cloudflare, which does maintain SOC 2 Type II and ISO 27001 — but that's shared-responsibility infrastructure evidence, not a Docracy-issued certificate for the application layer.
We'd rather publish exactly what we do and don't have than make a compliance claim we can't back up. Our full security questionnaire answers are public, not gated behind a sales call.
Secure ≠ identity-verified, by default
By default, Docracy does not verify who is signing — anyone holding a signing link can sign as the name on it. The audit trail proves what was signed and when, not who physically clicked. Paid and Enterprise accounts can add a required PIN and WhatsApp-bound delivery for a stronger, identity-linked tier.
Frequently asked questions
Does Docracy have SOC 2 or ISO 27001?
Not on its own — our infrastructure (Cloudflare) does, which is shared-responsibility evidence, not a Docracy-issued certificate. See our full Trust & security page for the complete questionnaire.
Is my data encrypted?
Yes — TLS in transit, and Cloudflare's platform-level encryption at rest for documents and application data.
Does Docracy verify who's signing?
Not by default. The audit trail proves what was signed and when, not a verified identity. An optional PIN and WhatsApp-bound delivery (paid plans) add stronger signer verification.
How long are my documents kept?
Anonymous signing chains use a 9-day default retention window. Paid keeps signed PDFs until the next April 15 or 13 months.
See exactly how your document is protected.
Sign securely, free →