Security is a process, not a guarantee. We design controls around the sensitivity of the service and continuously harden the product as usage grows. We do not claim certifications we have not obtained.
Infrastructure and data separation
- Primary application data is stored in a managed Neon PostgreSQL database.
- Workspace and tenant authorization is enforced by SignoffDock's server-side application APIs before database operations are performed.
- Workspace selection in the browser does not grant authorization by itself; authenticated membership and role checks are performed on the server.
- Customer proof files and generated approval artifacts are stored in private Vercel Blob storage and delivered using controlled, time-limited access.
Authentication and access
- Internal users authenticate through SignoffDock's server-side account and session system with email verification and password recovery.
- Authorization roles are stored in protected membership records and checked by server-side APIs.
- Administrative, database, email, storage, and payment credentials are not intentionally shipped to the browser.
- Public customer approval links use separate hashed, expiring token flows rather than granting access to authenticated internal workspace APIs.
Application and network safeguards
- Production traffic is served over HTTPS.
- Security headers restrict framing, content types, referrer leakage, browser capabilities, and unexpected script/connect sources.
- Source repositories are private and deployment secrets are maintained outside public source code.
- Approval events and revisions are recorded to support traceability.
Operational safeguards
- We minimize the personal information we collect where practical.
- We review service providers that process customer information and publish our current subprocessors.
- We maintain procedures for privacy requests and security-incident response.
- Access to production administrative systems is limited to people with an operational need.
Customer responsibilities
Customers should use unique passwords, protect email accounts and devices, promptly remove users who no longer require access, avoid uploading unnecessary sensitive information, and notify us promptly of suspected account compromise.
Security reports
If you believe you have found a vulnerability or security incident affecting SignoffDock, email support@signoffdock.com with “Security” in the subject. Please do not access, modify, or download data that is not yours while testing.
Certifications
SignoffDock does not currently represent that it is SOC 2, ISO 27001, PCI DSS, HIPAA, or FedRAMP certified or compliant unless a written customer agreement expressly states otherwise.