Security

docuinked encrypts every stored document, seals every finished PDF, and keeps a tamper-evident log. This page also says plainly what a beta doesn't have yet.

What we do today

Documents. Every stored PDF is encrypted with AES-GCM and bound to its document, so a file can't be swapped between records. PDFs are parsed in a limited child process, because a PDF is untrusted input.

The seal. After the last signature, the fields and the evidence summary are stamped into the PDF. The file then gets a PAdES seal and a timestamp from an outside authority. Any later change to the file breaks the seal.

The log. Each event is hash-chained to the one before it. The database refuses updates and deletes on the log. Checkpoints over the log are timestamped from outside, so a rewrite after that point would show.

Accounts. Passwords are hashed with Argon2. Two-factor sign-in is available. API keys are stored only as hashes and shown once. Signer IP addresses are encrypted at rest.

Agents. Agent keys can't sign, can't get live signing links, and can't send without a named person's approval. Anything that arrives over MCP counts as an agent, whatever key it uses. See approvals.

The web. Pages run under a strict Content-Security-Policy with no inline script. Requests are denied unless a path is listed as public. Outbound fetches and webhooks refuse private network addresses. The public site has no third-party trackers, fonts or chat widgets.

What we don't have yet

We would rather say this than have you find out.

• No SOC 2 report or ISO 27001 certificate. We have not been audited. The controls above are our own description.
• No outside penetration test.
• No HIPAA business associate agreement. Don't put protected health information in docuinked.
• Our seal certificate is not on the Adobe trust list. Adobe Acrobat will show that the file is unchanged, but it will say the signer's identity is unknown until you trust our public certificate.
• Beta hosting. The beta runs on company-operated servers, not a certified data center. Keep your own copy of anything important. Move to audited cloud hosting comes before paid launch.
• No SSO, SCIM or data residency choice.

What the seal does and doesn't prove

The seal shows the file has not changed since docuinked sealed it. It does not prove who a signer is. Email signing proves control of a mailbox at a moment in time. Add an access code when you want more. The evidence record says which step each signer passed, and no more than that.

Keep your own copy

Your evidence should not depend on us staying online. Every party gets the signed PDF. You can fetch the PDF and the full evidence record with the API and store them yourself. Anyone can check a file with no account.

Report a problem

Send security reports to security@docuinked.com. Send legal process to legal@docuinked.com. Our vendors are on the subprocessors page.

Common questions

Can docuinked staff read my documents?

Files are encrypted at rest, but the service holds the keys, because it has to stamp and seal your PDF. So we don't claim we can't reach them. Access is limited to running the service, and any change to a finished record would show in the log.

Can I use docuinked for health records?

No. We have no business associate agreement, and we don't accept protected health information during the beta.

What happens to my evidence if docuinked shuts down?

The sealed PDF carries its own seal and evidence summary, so it can still be checked without us. We recommend storing the PDF and evidence JSON in your own system now, while everything is working.