At InSign we believe that you own your data, and we’re committed to keeping it private. Our privacy policy clearly describes how we handle and protect your information. On an annual basis our independent third-party auditors test our privacy related controls and provide their reports and opinions which we can then provide to you. To report an issue with privacy please submit a ticket on our Contact Us page.

Here are a few ways we protect your data:

Data Deletion/Destruction

Upon request InSign will work to expunge all customer data and solely owned artifacts from our systems. Artifacts under legal hold or owned by multiple parties will be deleted upon completion of the legal hold process or upon deletion by the other parties at their discretion.

To initiate a data deletion / data destruction event please contact support@insign.io

Payment Info

We process all payments through our payment provider, Stripe, and do NOT store cardholder data on our servers. InSign is PCI compliant for payment processing.

At least once a year, InSign performs a review of our sub-service providers. In the event these reviews have material findings which we determine present risks to InSign or our customers, we’ll work with the service provider to understand any potential impact to customer data and track their remediation efforts until the issue is resolved.

Each signature on a contract is imposed and affixed to the document. When you request a signature, InSign affixes an audit trail page to the document itself. The audit trail contains a globally unique identifier, or GUID, that can be used to look up a record in our database that shows who signed a document and when. These records include a hash of the PDF document which we can compare to the hash of a questionable PDF document to determine whether or not it has been modified or tampered with.

The non-editable audit trail ensures that every action on your documents is thoroughly tracked and time-stamped, to provide defensible proof of access, review, and signature.

It’s imperative that you can control who can do what within the system. Different roles carry different access rights. For example, administrators control team-wide settings, billing information, and the roles of others.

• Role-based security – Enables different levels of permissions for different members of a team, ranging from administrative rights to members who have only permissions to view templates and issue signature requests.
• Signer-specific access codes – Can be assigned to each individual being asked to sign as an extra layer of security

At InSign we have a dedicated Security Team with a Head of Information Security who is directly responsible for the security of InSign products and services.

Additionally we have a formal information security program in place that leads an information and Risk Management Committee. This committee periodically meets to review security-related initiatives at the product, infrastructure, and company level.

To ensure all employees are able to champion the security of customer data we work to ensure security is embedded in our company culture from day one. Employees undergo comprehensive background checks, sign and follow a code of conduct and acceptable use policies, as well as undergo periodic security awareness training.

To ensure teams are prepared for the unexpected InSign performs red team testing against our employee base to ensure they are prepared to act appropriately when faced with a potential security event. In general we want to ensure we can detect physical, network, and system vulnerabilities by taking an attacker-like approach.