Security

Everything on this page is a description of what the system does today, not an aspiration. Last updated 19 October 2026.

Your documents

• Uploaded files are encrypted at rest with AES-256-GCM, an authenticated cipher, so a modified file fails to decrypt rather than decrypting to something wrong.
• Files are stored under random identifiers, never under a name that reveals the document or the customer.
• Every request is served over HTTPS with HSTS, so a browser will not fall back to an unencrypted connection.

Accounts

• Passwords are stored only as Argon2 hashes, never as the password itself.
• Two-factor authentication (TOTP) is required on every account from its first sign-in, at no extra cost. Nothing in an account can be done, and no plan can be bought, until two-factor is set up.
• Each customer's data is separated at the query layer, and that separation has its own automated test so a future change cannot quietly remove it.

Signing links

A recipient signs through a single-use link tied to that document and that person, with an expiry. There is no account to create and no password for them to lose. Once used, it cannot be used to sign again, and a link that has not been used stops working when it expires.

After signing, the same link still lets that signer download the signed copy and its evidence certificate.

The evidence trail

Each event on a document (created, opened, signed) records who, when, from what IP address, an approximate location and the browser used. Every event carries the hash of the one before it. The chain is verified before a document is sealed, and its final value is printed on the evidence certificate every party is sent, so a later change to the record would not match their copy.

Location is derived on our own server from a local database. No IP address is sent to a third party to be geolocated.

The seal

When the last person signs, the finished PDF is sealed with an independent timestamp from DigiCert that covers the whole file. Change one byte inside the sealed range and the timestamp no longer verifies. Add anything to the file afterwards and our checker reports it as changed since sealing. In technical terms the seal is a PAdES document timestamp (ETSI EN 319 142), signed by DigiCert's timestamp authority with RSA-4096 and SHA-384, with the long-term validation data needed to check it embedded in the file.

Our checker recognises the exact files Pixasign sealed, from our own records, so a document signed somewhere else, or an imitation, can never be mistaken for ours. It gives one of three answers: sealed by Pixasign and unchanged, sealed by Pixasign but changed since, or not sealed by Pixasign. Anyone can check a sealed document here, free and without an account. To try it, download a real sealed PDF, a made-up quotation that Pixasign sealed, and drop it on the check page.

The seal travels with the file. The DigiCert timestamp is embedded in the PDF itself, so the proof that nothing has changed since sealing, and the time it was sealed, stay with the document wherever it goes. Recognising a file as one of ours is done here, against our records.

An independent clock

The seal's time comes from DigiCert, an independent timestamp authority, not from us. So the time a document was sealed is attested by somebody other than the supplier.

Backups

The database and the document storage are backed up nightly to Reykjavík, Iceland: a different provider, a different country and a different power grid from the live system, so one incident cannot take both. Both are encrypted with a public key on our server before they leave it, and the private key that would decrypt them is never present on the backup host. The people storing your backups cannot read them.

Backups cover the document files as well as the database. A database restore on its own would give you a catalogue of documents that no longer exist, which is the sort of thing you discover at the worst possible moment.

Where it runs, and why there

Pixasign is a service of Pixacomms Ltd, a UK company. It runs on Hetzner Online GmbH in Nuremberg, Germany, whose data centres are certified to ISO/IEC 27001:2022 (audited by SOCOTEC, scope covering Nuremberg). Backups sit in Iceland. Both are in the EEA, which the UK recognises as adequate.

Your documents and their evidence trail are stored in the EEA: on our servers in Germany, with backups in Iceland. Card payments are handled by Stripe, and email is sent through Brevo in France. If you are a solicitor, accountant or agent who has ever had to answer a client asking where their documents live, that is the answer.

Sub-processors are listed in full in the data processing agreement.

Telling us about a problem

If you find a security issue, email hello@pixasign.co.uk. We will acknowledge within two working days. Please give us a reasonable chance to fix it before publishing, and please do not access anybody else's data while testing.