Our security practices

A summary of how SignSolid is built and operated.

Encryption and hosting

• HTTPS and TLS for all traffic in transit.
• Encryption at rest for stored data.
• Infrastructure hosted in the EU.

Independent assessment

• We complete the independent security assessment required to access mailbox and storage data on your behalf.
• We run regular independent security testing.

How we operate

• Credential rotation. Credentials and keys are rotated on a defined schedule.
• Least privilege. Access to data follows least privilege, and connections to external services use the minimum access needed.
• Vulnerability management. Issues are tracked and resolved on an ongoing basis.

Reporting a problem

If you believe you have found a security issue, contact us rather than disclosing it publicly, and we will work with you on it.