Tamper-evident audit trail
Every meaningful event on a document — sent, opened, viewed, signed, downloaded — is timestamped and sealed into an append-only, SHA-256 hash-chained record. Each entry incorporates the hash of the one before it, so altering or deleting a past event breaks the chain and is detectable. Anyone can check a completed document's audit trail using our verification tool.
Access control
Document access is enforced at the database level with row-level security policies, not just in application code — a user can only reach documents they created or were invited to sign. Signing links sent to invited parties are single-purpose and scoped to that document.
Records that can't be quietly removed
Documents on AgreeVia cannot be deleted from within the app — not by the sender, not by a signer, not by us through any client interface. Once a document has been signed, its record is fixed for six years. Erasure of an unsigned document happens only through a restricted internal process that refuses anything with a signature, a frozen audit chain, or an evidence package against it.
This is a deliberate constraint rather than a missing feature. An audit trail that the interested party can delete is not evidence.
Encryption in transit and at rest
All traffic to and from AgreeVia — the app, this website, and our APIs — is served over HTTPS/TLS. This site enforces HTTP Strict Transport Security so browsers never fall back to an unencrypted connection. Stored data — documents, signatures, and the audit trail — is encrypted at rest on our provider's infrastructure.
Data protection
AgreeVia Solutions Ltd is registered with the UK Information Commissioner's Office (registration ZC220362) and operates to UK GDPR and Data Protection Act 2018 standards. Where we process personal data on a customer's behalf we act as processor under an Article 28 Data Processing Addendum. Full detail is in our Privacy Policy, Terms of Service and Data Processing Addendum.
Responsible disclosure
We welcome reports from security researchers at [email protected]. Report to us first and we won't pursue good-faith testing that doesn't access or modify other users' data.