Security & Compliance

1. Built on Google Cloud and Cloudflare

Traffic to signveli.com is served through Cloudflare, which provides DNS, TLS encryption and protection against attacks at the network edge. Sign Veli’s application, database and document storage run on Google Cloud, in Google’s asia-east1 region (Taiwan). Both providers are independently audited against these international standards:

• ISO/IEC 27001Information security managementGoogle Cloud · Cloudflare
• ISO/IEC 27017Security controls for cloud servicesGoogle Cloud
• ISO/IEC 27018Protection of personal data in the cloudGoogle Cloud · Cloudflare
• ISO/IEC 27701Privacy information managementGoogle Cloud · Cloudflare
• SOC 2 Type IIIndependent audit of security, availability and confidentialityGoogle Cloud · Cloudflare
• PCI DSS Level 1Payment card data security, as a service providerGoogle Cloud · Cloudflare
• CSA STAR Level 2Cloud Security Alliance third-party attestationGoogle Cloud

These certifications are held by Google and Cloudflare for their infrastructure. They are not certifications of Sign Veli itself. See Google Cloud’s compliance page and Cloudflare’s compliance resources.

2. How we protect your documents

• Encryption in transit — every connection to Sign Veli, including document uploads and downloads, uses HTTPS (TLS).
• Encryption at rest — documents and data are stored encrypted on Google Cloud.
• Account isolation — every request is checked against the account it belongs to, so one account can never read another’s documents. In company accounts, documents are visible to their senders, signers and the team they belong to; admins see usage and delivery for other teams.
• Password safety — passwords are stored only as salted scrypt hashes, never in plain text. You can also sign in with Google.
• Two-step verification — turn on a second step with an authenticator app, so a stolen password alone can’t open your account. It applies to every way of signing in, recovery codes cover a lost phone, and you’re emailed whenever it changes. Company admins can require it for every member and limit how long a sign-in lasts.
• Abuse protection — sign-in and other sensitive actions are rate-limited.
• Files stay on your device — the PDF tools (merge, split, compress, convert and more) run in your browser; those files are never uploaded.

3. Proof of every signature

Every completed document comes with a certificate of completion that records:

• who signed, the email address the request went to, and when each step happened;
• the IP address each signer signed from;
• each signer’s consent to sign and receive records electronically;
• a SHA-256 fingerprint of the original document.

Anyone holding the completed PDF can check it at signveli.com/verify: the file is fingerprinted in their browser, never uploaded, and matched against the fingerprint Sign Veli recorded when the document was completed, so any later change to the file shows.

4. E-signature laws

Sign Veli is designed to meet the core requirements these laws set for electronic signatures — intent to sign, consent to do business electronically, a record linked to each signer, and a copy everyone can keep:

• ESIGN ActUnited States (federal)
• UETAUnited States (states)
• eIDAS — simple electronic signaturesEuropean Union
• Electronic Communications Act 2000United Kingdom

Many other countries recognise electronic signatures in similar ways. Sign Veli provides simple electronic signatures; it does not currently provide qualified electronic signatures (QES) under eIDAS. Some documents still need a handwritten or certified signature — see section 4 of our Terms of Service.

5. Privacy laws

We handle personal information in line with the principles of the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and similar laws: we collect only what we need and never sell it. You can download a copy of your information and delete your account yourself, under Your data in the account menu. To correct your information, email [email protected].

Read the details in our Privacy Policy. If your company needs a data processing agreement, email [email protected].

6. Where we are today

Sign Veli is a young service. We have not yet completed our own independent audits such as SOC 2 or ISO/IEC 27001 certification for Sign Veli as a company, and we will say so here when we do. If your company needs a security questionnaire answered, email [email protected] and we will help.

7. Report a security issue

If you think you have found a security vulnerability, please email [email protected] with the details. We will look into every report, keep you updated, and ask that you give us reasonable time to fix the issue before sharing it publicly.