A signature is only as good as its evidence
Anyone can draw a squiggle on a PDF. What matters is proving — years later, to a court or an auditor — who signed, what they signed, and that nothing changed afterwards. SignSwifly stacks five mechanisms to make that case.
Digital seal on every completed document
Completed PDFs are cryptographically sealed to the international PAdES standard with SHA-256. A PDF reader’s signature panel shows whether the document has changed since it was sealed; change a single byte and the seal no longer verifies. The certificate of completion is sealed the same way, and every page of both carries the envelope’s SignSwifly ID, covered by the seal.
Long-term validation (LTV), so a seal still verifies years after its certificate expires, and a certificate on Adobe’s Approved Trust List, so PDF readers show the seal as trusted Coming soon
Independent timestamps
Each seal carries an RFC 3161 timestamp from DigiCert, an independent timestamp authority — proof of when the document was completed that doesn’t depend on our clocks.
Tamper-evident audit trail
Every event — sent, viewed, signed, witnessed, declined — is recorded with actor, time, IP address and device. Each entry’s SHA-256 hash covers all of that and the hash of the entry before it, so altering or deleting any entry breaks the chain from there on. The certificate of completion states whether the chain verified, and says so plainly for older trails whose first entries were written before the IP address and device were covered.
Write-once storage in Australia
Sealed documents and certificates are written to write-once storage in Australian data centres and kept for 7 years. A workspace’s own retention policy can stop them being handed out sooner, but it can’t shorten that, and a legal hold stops the policy touching them at all.
A locked write-once policy, so that not even SignSwifly’s own operators can change or delete a sealed copy before its 7 years are up Coming soon
Secure signing links
Signers authenticate with a personal 256-bit link; we store only a one-way hash of it, so even a database breach can’t forge a signing session. Correcting a signer’s address, or voiding the envelope, cuts off every link sent before. A one-time code by SMS for higher-assurance signing, on Scale, on Solo and Team with the SMS add-on, and on Free with a single envelope with SMS.
Who can get in, and a record of it
Your team’s access is yours to control, and ours is limited and written down.
Company sign-in and MFA
- On Scale, staff sign in through your identity provider — Microsoft Entra ID, Okta, Google Workspace, ADFS, or another OIDC or SAML provider — set up with our team
- Require it for everyone on your verified domains, with a recorded way back in for the owner and up to five admins they choose
- Require MFA for anyone who doesn’t sign in through your provider — on Solo and up (how it works)
- Sign people out after 15 minutes to 12 hours idle — on Solo and up
Provisioning with SCIM 2.0
- On Scale, Microsoft Entra ID or Okta adds, changes, suspends and removes people as your directory does
- Directory groups mapped to Admin or Member
- The workspace owner is never suspended, removed or demoted by a sync
- SCIM tokens shown once, stored only as a hash, and revocable
Team activity log
- Invitations, role changes, removals and ownership transfers
- Sign-in rule changes, break-glass sign-ins and every change made through SCIM
- Exports, retention changes and deletions, legal holds placed and released, and Microsoft 365 connections
- Visible to the owner and admins; entries can’t be edited or deleted
Our own access
- Support sees an envelope’s details, not its documents, by default
- Opening the contents takes a stated reason and lasts 60 minutes, for one envelope
- Each time is written onto that envelope’s own audit trail, where you can see it, and listed for your owner and admins under Settings → Team → Activity
Stored in Australia, kept on your terms
Data stored in Australia
- Documents, signing evidence and account data stored in Microsoft Azure data centres in Australia
- See Australian data storage
Retention policy
- On Scale, choose how long finished envelopes’ documents stay available: 30 days to 10 years, or no limit
- After that they’re withheld; deleting them as well takes an admin’s confirmation and a 7-day grace period
- Every deletion is recorded on the envelope’s audit trail, which is never deleted
- Sealed copies stay in write-once storage for their 7 years whatever the policy says
- With the legal hold add-on, a hold on chosen envelopes, a sender’s, a period’s or everything the workspace sends keeps them from being withheld or deleted until it’s released; each is checked again just before anything is deleted, and placing or releasing one is in the team activity log, and on the audit trail of each envelope it names
Workspace export
- On Team and Scale, the owner or an admin can export a CSV of envelopes with their sealed documents and certificates
- Download links work once and expire; export files are deleted after 7 days
- Every export is recorded in the team activity log
Microsoft 365, least privilege
- On Scale, completed envelopes can be saved to one SharePoint site your admin chooses, through Microsoft’s Sites.Selected permission — never every site in your tenant
- Picking a document from OneDrive or SharePoint is read-only, signed in as the person picking it
- Set up with our team and your IT admins
Legal standing
Electronic signatures are recognised across Australia under the Electronic Transactions Act 1999 (Cth) and state equivalents, and in New Zealand under the Contract and Commercial Law Act 2017. SignSwifly is designed to satisfy their requirements — consent, identification, and a reliable method — and our certificate of completion packages the proof for every envelope.
Sealing to the PAdES standard also matches the format the EU’s eIDAS advanced-signature rules use. This page is general information, not legal advice — some documents (for example some wills and powers of attorney) have special execution rules.
Going through a security review?
If your organisation needs a questionnaire answered or wants to understand how sealing, storage and sign-in work before it signs up, talk to us. Scale includes help with your security reviews. See SignSwifly for enterprise.
Reporting a vulnerability
If you think you’ve found a security problem in SignSwifly — the app, the signing pages or this website — please tell us privately. Email us or use our contact form, with “Security” in the subject. Say what you found, where, and the steps that show it.
While you look, please use only accounts and documents of your own, and don’t open, change or keep anyone else’s data beyond the least that shows the problem. Please don’t test in a way that slows the service for others, such as load or denial-of-service testing, or send messages through our forms and emails in bulk. Give us a reasonable time to fix a problem before you tell anyone else about it. We’ll reply to say we have your report and tell you when it’s fixed. We don’t pay rewards for reports.
Tools that look for a security contact will find these details at /.well-known/security.txt.
See the audit trail for yourself
Send a test document on the free plan and download its certificate of completion.
Start free