Security & compliance

A signature is only as good as the evidence behind it.

Here is exactly what AiroSign records, how it is protected, and why it satisfies electronic-signature law.

The legal test

Four questions every court asks.

The U.S. ESIGN Act (2000), the Uniform Electronic Transactions Act and the EU’s eIDAS regulation all reduce to the same four questions. AiroSign answers each with a recorded artefact.

Intent

The signer draws, types or uploads a signature and clicks Complete. Both the signature image and the completion event are stored with timestamp, IP and user agent.

Consent

Before any field is collected, the signer agrees to use electronic records and signatures. The consent event is written to the audit trail and shown on the certificate.

Attribution

Signing links are unique per signer and HMAC-signed — a guessed link opens nothing. Optional email one-time codes add a second factor.

Integrity

The finished PDF is hashed (SHA-256) and sealed with a PKCS#7 digital signature. The audit chain is hash-linked so nothing can be altered silently.

Audit trail

Hash-chained, append-only.

Every event — created, sent, viewed, consented, started, field saved, signed, sealed, completed — is stored with hash = sha256(previous_hash | event). Changing or removing any row breaks every hash after it. The public verification page recomputes the whole chain on demand.

The chain, the signers and the original document’s hash are printed on a Signature Certificate page appended to the PDF, so the evidence travels with the file even when it leaves AiroSign.

GET /api/verify/2b6ae528-…

{
  "found": true,
  "status": "completed",
  "chain_ok": true,
  "event_count": 10,
  "signed_sha256": "ae3f1d11edce…95339e",
  "signers": [{ "role": "Contractor", "status": "completed",
                "completed_at": "2026-09-09T14:47:03Z" }],
  "events": [
    { "type": "created",   "hash": "0b3b10470e…" },
    { "type": "consented", "hash": "507349da13…" },
    { "type": "signed",    "hash": "0cad83cef5…" },
    { "type": "completed", "hash": "7124f17638…" }
  ]
}

Platform security

How your data is handled.

Tenant isolation

Every organization’s rows are guarded by row-level security in Postgres. API keys resolve to exactly one organization.

Keys stored as hashes

API keys are shown once and stored only as SHA-256 hashes. Revocation takes effect on the next request.

Private storage

Templates, signature images and completed PDFs live in private buckets; downloads go through authenticated endpoints only.

Encryption in transit

TLS everywhere: browser to AiroSign, AiroSign to database and storage, AiroSign to your webhook.

Signed webhooks

Each delivery carries an HMAC-SHA256 signature over id, timestamp and body, so your endpoint can reject forgeries.

Retention you control

Archive submissions from the API or dashboard. Dedicated instances can set their own retention and residency.

Verify a document yourself

Open the URL printed on any certificate page, or upload a PDF you received to check it byte-for-byte against the sealed original. No account needed.

The link is printed on every certificate page as airosign.airosofts.com/verify/<document id>.

Legal documents: E-sign disclosure · Terms · Privacy