Security, traceability and honest disclosure of technical evidence are at the heart of SignCloud.
All communications are encrypted in transit (HTTPS/TLS). Signing pages are only accessible via a non-guessable random token link.
Each signature is confirmed by a one-time code sent by SMS. The code is never stored in clear text and no email fallback is accepted for signing. A company registration check may be required by the sender.
A SHA-256 fingerprint is recorded for the signed PDF. Comparing a file with that fingerprint can reveal a later change. A technical evidence record (server time, IP address, verification channel and fingerprint) is available.
Every event (sending, opening, verification, signature, sealing) is recorded in a cryptographically chained audit trail: any later tampering is detectable.
SignCloud records the controls actually completed in each electronic-signature flow. The service supports SES and enhanced workflows designed to meet AES requirements under eIDAS. No QES or qualified trust service is claimed.
The service is hosted in France. Sensitive data is stored in an OVHcloud environment in Paris with SecNumCloud-qualified hosting, and encrypted off-site backups remain in the European Union. Access to workspaces is isolated per organization; passwords are stored hashed; two-factor authentication is available (authenticator app for admins, email code for clients). Sensitive actions are logged and restorations are tested.
To report a vulnerability: securite@signcloud.fr.
Last updated: 10 September 2026 — version 1.1.