Security

md2sign handles contracts and the evidence that people signed them, so we treat both carefully. This page explains how, in plain terms. If you have a question it doesn't answer, or your organisation needs a security questionnaire completed, email [email protected].

Your documents and signatures

• Tamper-evident signing. When someone signs, we record the document's SHA-256 fingerprint, their typed name, the time, their IP address and browser. Each signature is chained to the one before it and sealed with an Ed25519 digital signature. Changing a single character of a signed document breaks the seal.
• Anyone can check a document. Every signed PDF links to its own verification page, where you can confirm a copy is genuine, and our sealing public key is published at /.well-known/md2sign-seal-key, so a seal can be checked independently of us.
• Private signing links. Each signer gets their own random link. We store it encrypted and look it up by a one-way hash, and signers can only download their copy for a limited time from the link.
• Optional signer email verification (Pro). Senders can require each signer to enter a one-time code, emailed to them, before their signature is recorded. Codes expire after 15 minutes, allow 5 tries and are stored only as a keyed hash. The time the signer confirmed is sealed into their signature and shown on the audit certificate.
• Retention. Documents and audit trails are kept while your account is active and for up to 7 years afterwards so signatures stay verifiable, as set out in our Privacy Policy.

Encryption and secrets

• In transit: the site, dashboard, API and MCP server are served only over HTTPS, with HSTS so browsers never fall back to an unencrypted connection.
• Passwords are stored as salted hashes, never in a readable form.
• API keys are stored as hashes. We show a key once, when you create it.
• Webhook signing secrets, signing-link tokens and authenticator-app secrets are encrypted by the application before they reach the database.
• Webhooks we send are signed (HMAC-SHA256) with your endpoint's secret, so your system can confirm they came from us.

Account protection

• Two-step sign-in. You can turn on an authenticator app (such as 1Password, Google Authenticator or Authy) from your profile, with recovery codes in case you lose your phone.
• Connecting AI apps without sharing keys. Apps such as Claude connect through OAuth: you sign in to md2sign and approve access, and the app gets a token that expires after an hour and can be refreshed. You can disconnect any app from Connected apps, and only known apps' addresses can receive a sign-in.
• Email confirmation. An account can't send documents for signature until its owner confirms their email address, including accounts created by an AI agent.
• Rate limits on sign-in, signing, sign-up and the API slow down automated abuse.

How we run md2sign

• Staff access. Our internal admin panel requires an authenticator app as well as a password, and access is limited to named administrators. Every sign-in and every change made in it is recorded in an audit log that can't be edited.
• Tested changes. Every change to md2sign runs through our automated test suite and a dependency vulnerability check before it can be deployed. Changes that fail aren't deployed.
• Payments. Paddle is our merchant of record and collects all payment details. Card numbers never reach our servers.
• Email authentication. Our sending domain uses SPF, DKIM and DMARC, which makes it harder for anyone to send fake email that looks like it came from md2sign.

Suppliers

Certifications

md2sign doesn't have a SOC 2 or ISO 27001 report yet. We're building the controls those standards require, and this page describes what's already in place.

Reporting a vulnerability

If you think you've found a security problem, please email [email protected] with the details and steps to reproduce it. Please don't access other people's data, disrupt the service or publish the issue before we've had a chance to fix it. We won't take action against anyone who reports a problem to us in good faith and follows these rules. Our security.txt has the same contact details.