Security
This page describes controls in the FormSign application. It is not a certification, a compliance attestation, or a guarantee that the service cannot be breached.
HTTPS
In production, responses include a Strict-Transport-Security header (max-age 63072000 seconds, includeSubDomains, preload) and a content security policy that includes upgrade-insecure-requests. Session cookies, Google sign-in cookies, and anonymous draft cookies are httpOnly and SameSite=Lax. In production those cookies are also marked Secure.
Encryption
Stored files, signature images, and the secret part of a public link are encrypted with AES-256-GCM before they are saved. A public link is looked up by a SHA-256 hash of the token, not by the raw token.
Account passwords are stored as bcrypt hashes with 12 rounds. The password itself is not stored. Names, email addresses, and form answers in the database are not encrypted with that key.
Signed documents
When a document is generated, FormSign stores a SHA-256 hash of the PDF bytes before the page-number footer is drawn. After signing, FormSign stores a separate SHA-256 hash of the finished signed PDF. The signature event and the audit event for that signature store the finished signed PDF hash and the earlier document hash.
Access
The workspace app requires a signed-in session. Workspace actions check that the user is a member of that workspace. Roles are owner, admin, and member. Some actions require an admin or the owner. A workflow can be limited to selected members and a permission. Reading a stored file checks that the file belongs to the workspace.
Sign-in, public forms, signing, uploads, and downloads are rate-limited.