Security
Security is paramount at CollectEsign. People trust you with the documents they sign — and you rely on us to keep those documents, signatures, and personal information safe. The measures below outline how we earn that trust.
HIPAA
When documents contain Protected Health Information, we handle it as a Business Associate under HIPAA, governed by signed Business Associate Agreements (BAAs) with the organizations we serve and with our subprocessors. See our HIPAA Notice for details.
Infrastructure security
- Hosted only on HIPAA-eligible Amazon Web Services, within a private network; the database is not publicly reachable.
- Encryption at rest with AWS-managed keys and TLS 1.2+ for all data in transit; documents are kept in private object storage.
- Automated backups, deletion protection, and infrastructure managed as code (Terraform).
- Continuous logging and monitoring of access.
Application security
- Authentication via AWS Cognito with multi-factor authentication and passkeys; no passwords are stored in our database.
- Role-based access control with every query scoped to the user's organization, plus session timeouts.
- Audit trail on signing activity, and tamper-evident sealing with a digital signature applied to every completed document so any later change is detectable.
- Secrets held in AWS Secrets Manager; document contents kept out of application logs and URLs; least-privilege and privacy-by-design principles applied from the start.
Privacy
We apply the "minimum necessary" principle, do not sell personal information, and do not use your documents for advertising. See our Privacy Policy.
Certifications & assessments
CollectEsign is built on HIPAA-eligible Amazon Web Services, which maintain their own SOC 2 and ISO 27001 certifications, and we operate under signed Business Associate Agreements (BAAs) with AWS. CollectEsign does not claim independent SOC 2, FERPA, or PCI certification for the application itself.
Reporting a vulnerability
If you believe you've found a security issue, please contact info@collectesign.com. We investigate all reports and will keep you informed.