Built for documents that carry consequences.

When an agreement is fully signed, the document is flattened with every signature and value in place, then hashed with SHA-256. That fingerprint is stored on the certificate of completion, so any later modification to the file is detectable. Field placement is mapped precisely onto each page's real coordinate space, including rotated and cropped pages, and that mapping is protected by an automated regression test.

Every meaningful event on an agreement is recorded: sent, delivered, viewed, signed, declined, reminded, bounced, and executed. Each carries a timestamp and, where the request exposes it, the originating IP address. The same trail appears in your dashboard and is printed into the sealed certificate.

Document content is sent to our AI provider (Anthropic) only to power the features you invoke — field detection, drafting, pre-send review, and search. It is processed to serve your request, not to train models. Documents and signed PDFs are stored in your workspace's isolated storage.

Every workspace's data is isolated at the database level with row-level security policies, so one organization can never read another's documents, envelopes, contacts, or records. Signer-facing links are unguessable per-signer tokens; public endpoints are rate-limited.

Accounts sign in with email and password managed by our authentication provider (Supabase Auth), with leaked-password protection that rejects credentials found in known breach corpora. API access uses per-workspace keys that are shown once and stored only as hashes; revoking a key takes effect immediately.