Security

Security claims should match the product behavior that actually exists.

This page focuses on the controls the current application and Convex layer demonstrate directly: access checks, signing-link handling, event history, and completion records.

Workspace-gated access

Document, template, envelope, and billing queries check workspace membership before returning data.

Hashed signing links

Recipient signing access is backed by generated tokens that are stored as hashes and checked against expiration windows.

Audit event record

The signing flow records created, sent, viewed, field-completed, signed, completed, downloaded, and finalized events.

Completion certificate

Completed packets generate a certificate page so the final output keeps the signing record attached to the document.

Operational review

What the current codebase demonstrates today.

These points are intentionally narrower than generic compliance marketing so teams can evaluate the real product surface.

  • Recipient links are time-bounded and matched through stored token hashes.
  • Envelope completion checks required fields before allowing a recipient to finish.
  • Completed packets can be finalized with the source document, field data, recipients, and audit events together.
  • Administrative credit and billing flows require explicit admin authorization checks.

Need a closer review?

Use the contact channel for product, legal, or privacy questions tied to your evaluation.

We keep the company identity and contact addresses visible so vendor-review questions can be routed to the right place.

Contact the team