Skip to content

Security

How we protect your documents

Factual information about how PractiSign handles security, evidence and data protection. No marketing superlatives, just what we do and what we don't claim.

Document access

  • 01Encrypted in transit (HTTPS) and at rest by our hosting provider.
  • 02Scoped, expiring signer tokens. No shared links or guessable URLs.
  • 03Document-level viewing permissions enforced on the server.
  • 04Recipients can only access documents explicitly assigned to them.
  • 05Private file storage with no public caching of document content.

Signing evidence

  • 01Every action timestamped with actor, IP address and user agent.
  • 02Evidence record tied to exact document versions presented to each signer.
  • 03The evidence record includes SHA-256 fingerprints of each document, so any later change can be detected.
  • 04Evidence does not imply that a return was submitted or accounts were filed.
  • 05Email delivery status is recorded.

Privacy & data handling

  • 01No third-party tracking scripts on signing routes.
  • 02Marketing consent is separate and optional, never pre-checked.
  • 03Clients can be exported to CSV.
  • 04GDPR-aligned processing with documented responsibilities.

Infrastructure

  • 01Tenant isolation between practices. No cross-tenant data access.
  • 02Idempotent operations to prevent duplicate sends or charges.
  • 03Emails are sent through Resend; delivery status is recorded.
  • 04Data and servers in London (UK): the database is hosted on Supabase in its London region, which provides managed backups, and the application runs in London.
  • 05Protected secrets using encrypted server-side credential storage.

Authentication & access

  • 01Staff log in with email and password.
  • 02Optional two-step login for staff (authenticator app, with recovery codes); practice owners can require it for everyone.
  • 03Owner, admin and member roles with explicit access rules.
  • 04Unlimited staff does not mean unrestricted document access.
  • 05Session management with appropriate timeouts.
  • 06Activity log of staff actions, exportable to CSV.

What we do not claim

  • 01PractiSign provides simple electronic signatures suitable for most UK accounting documents.
  • 02We do not claim to provide advanced (AES) or qualified (QES) electronic signatures unless explicitly stated for a specific workflow with a verified provider.
  • 03A completed signature does not constitute legal advice on whether a specific document requires a particular signature type.
  • 04Evidence records document what happened. They are not independently certified by a third party unless stated.
  • 05Security measures are subject to ongoing review and improvement.

Last reviewed

Last reviewed 30 September 2026. We update this page when our security measures change.