Trust center
Everything we can tell you about how eSignProhandles your documents.
This page is the honest version: what we run today, who else touches your data, and a link anyone can use to check a signed document for themselves.
- Compliance status stated plainly, not implied
- Verify a signed document, no account needed
Verify a document
Anyone can check a signed document, without an account
Every finished document gets a public verification link. Open it and you see the document hash, who signed, and when it was completed, checked against what we recorded at the time.
Compliance status
What we hold, in one table
We would rather state this plainly than let a badge on a footer imply something untrue.
| Control or certification | Status | Detail |
|---|---|---|
| TLS in transit | In place | All traffic to the app and API is encrypted. |
| Secrets encrypted at rest (AES-256-GCM) | In place | AES-256-GCM for stored gateway and integration credentials. |
| Tenant data isolation | In place | Every document, recipient, template and user read is scoped to the requesting organization at the service layer. |
| SAML SSO, SCIM, MFA, passkeys | In place | Per-tenant SSO connection, scoped SCIM tokens, MFA enrollment, WebAuthn passkeys. |
| Immutable audit log with IP and user agent | In place | Recorded on every document and signing event. |
| SHA-256 document hashing and audit certificate | In place | Applied on completion; checkable at a public verification link. |
| PAdES digital signing | In place | Available as a signing conformance option. |
| Right-to-delete process | In place | Removes a person’s personal data on request, as US state privacy laws require. |
| SOC 2 Type II | Not certified — in progress | We do not hold this certification yet. Target date to be set once an audit firm is engaged. |
| ISO 27001 | Not certified — planned | On the compliance roadmap; no certification exists today. |
| HIPAA | Not certified | eSignPro is not currently positioned or certified as a HIPAA business associate. |
Subprocessors
Who else touches your data
A subprocessor is a company we use to run part of the service. This is the current list.
| Subprocessor | What it does | Location |
|---|---|---|
| Stripe | Subscription billing, and payment processing for payments collected at signing. | United States |
| OVHcloud US (OVH US LLC) | Application hosting, database, and file storage. | United States (Virginia) |
| Hostinger (Hostinger International Ltd.) | Transactional email: invitations, signing requests, reminders, receipts. | Hostinger data centers; company based in Cyprus |
| Twilio (Twilio Inc.) | One-time codes and signing reminders sent by text, where enabled. | United States |
| Cloudflare (Cloudflare, Inc.) | Content delivery and network proxy for www.esignpro.net. | Global network; company based in the United States |
On request
Documents we can share directly
Ask your account contact, or write to us, and we will send these over.
A summary of our current security controls
A countersigned copy of our Data Processing Addendum
A subprocessor change notice, if you want to be told before we add one
Last updated September 29, 2026.