Security

Every connection to DoneDocs uses TLS (HTTPS) — data is encrypted between your browser and our servers, always.

Your documents and database records are encrypted at rest by our infrastructure providers: documents in Cloudflare R2 object storage, everything else in our Neon Postgres database. We do not roll our own cryptography anywhere.

Every action on a document — sent, viewed, signed, declined, voided — is written to an audit trail where each event is cryptographically chained to the one before it. If anyone altered or deleted an event, the chain would no longer verify. That is what “tamper-evident” means: tampering cannot happen silently.

When a document is signed, we compute the SHA-256 hash of the final signed PDF and record it in the audit trail. Anyone can re-hash the file they hold and compare — if a single byte changed afterwards, the hashes will not match.

Each signing link is a 256-bit random token — a number so large it cannot be guessed or enumerated. We store only the SHA-256 hash of the token, never the token itself, so even a database read can never reveal a working link.

Links are single-purpose and expire automatically. A used or expired link stops working, and correcting a recipient's email address immediately invalidates the old link.

Senders sign in with Google or with a magic link sent to their email. We never see, handle, or store passwords — there is nothing to leak. Signers never need an account at all.

Sign-in attempts and signing endpoints are rate-limited per IP address, and sending actions are rate-limited per account, to blunt credential-stuffing and automated abuse. If our rate-limiting service ever goes down, the app keeps working — availability of your documents comes first.

Our dependencies are scanned automatically for known vulnerabilities, and we keep the stack patched. Signing links, sessions, and webhooks are verified server-side on every request — the browser is never trusted with decisions that matter.

We are a small team, and we will not pretend otherwise. DoneDocs does not currently hold SOC 2, ISO 27001, or similar certifications, and we will not use phrases like “bank-grade” or “military-grade” to imply otherwise. What we offer instead is a system whose protections you can verify yourself: the audit trail, the document hash, and this page.

Only you, the people you send signing links to, and the infrastructure providers listed in our Privacy Policy — who see them only as encrypted bytes doing their jobs. We do not read your documents, and we do not share them with anyone else.

Found something? Email support@getdonedocs.com with the details. We read every report and will fix verified issues promptly.