KamiSign

How KamiSign protects your documents

Contracts hold private information. This page explains what we do to protect it, and where we still have work to do.

Every person you invite to sign gets their own secured link. It works in any browser, with no account needed, and it is built so that part of it never reaches our servers.

Before the #

Sent to our servers, so we can find the document and check the signer’s personal token.

After the #

The key to open the document. Browsers do not send this part to any server, including ours.

What happens when someone signs

  1. You send the document.The signer receives an email with their own link.
  2. They open the link.The link carries a token that belongs to that signer only, so it cannot be used to sign for someone else.
  3. They confirm it’s them.The signer enters a one-time code before they can sign.
  4. They sign.We record the time and the IP address the signature came from.
  5. You get a certificate.When everyone has signed, the document is finalised and a certificate of completion is attached.

Proof of every signature

The certificate of completion shows who signed, when, and from which IP address, so you can show how a document was signed if anyone asks. We also keep an audit log of activity in your workspace, such as who was invited, who opened a document and when signing finished.

Who can see what

Workspaces let teams share documents without sharing everything. Access is set by role, and the people who control it are the workspace admins.

Drafts
Private to the person who created them until they are sent.
Templates
Shared with the whole workspace. Only people with permission to edit templates can change them.
Roles
Owner, admin, member and viewer, each with its own permissions. Admins decide what each person can do.
Billing
Only the workspace owner can manage or upgrade the plan.
Database
Our database tables use row-level security, so data is restricted at the database itself and not only in the app.

Where your data lives

All traffic to KamiSign uses HTTPS. The site runs on Cloudflare, and your data is stored with Supabase, whose database storage is encrypted at rest. Both providers publish their own independent audits and certifications.

Those certifications belong to our providers. KamiSign itself has not been independently audited yet.

What we haven’t done yet

We would rather tell you than leave you guessing. We do not yet have:

  • A SOC 2 or ISO 27001 report
  • A published third-party penetration test

When we have either, we will link it here.

Report a security problem

If you think you have found a vulnerability, email us with what you saw and how to reproduce it. We read every report and will reply.

Email [email protected]