Security, stated plainly.
You're trusting a free tool with real contracts, so you deserve specifics instead of a shield icon and the word "bank-grade." This page lists exactly what protects your documents — and, just as important, what SigFetch is not. I'd rather lose a signup than have you assume something I never claimed.
How your documents are protected
- Encrypted in transit and at rest. All traffic runs over HTTPS, and stored documents are written with AES-256 server-side encryption.
- Signing links are unguessable. Each signer gets a unique link built on a 32-byte random token — the same class of secret as a password-reset link. Don't forward yours.
- Credentials are hashed, never stored raw. Passwords are hashed with bcrypt. API keys are shown to you once and stored only as SHA-256 hashes — if the database leaked, your key wouldn't be in it.
- Sessions die when they should. Changing your password invalidates existing sessions, and unlinking a connected Google account ends the sessions it created.
- Signed webhooks. Outbound webhooks are HTTPS-only and signed with HMAC-SHA256 over a timestamped payload, so your server can verify each request really came from SigFetch and reject replays. Delivery is hardened against server-side request forgery.
Tamper evidence: what the hash actually proves
When an envelope completes, SigFetch assembles the final PDF — your documents, the signatures, and the Certificate of Completion — and records its SHA-256 fingerprint. Change one byte of that file and the fingerprint no longer matches.
Anyone holding the file can check it at sigfetch.com/verify. The hash is computed locally in the verifier's browser, so the document itself never leaves their machine — they upload nothing, and they don't have to take my word for the result.
To be precise about the limits: this is tamper evidence, not a cryptographic digital signature. SigFetch does not embed PKI certificates in the PDF (no PAdES, no qualified signatures). What verification proves is that this exact file completed signing through SigFetch, when, and by whom — which is the evidence that matters for ordinary US business documents under ESIGN and UETA.
What signing captures
Every signature records an explicit consent-to-sign-electronically checkbox, plus the signer's IP address, browser, and a timestamp. All of it lands in the envelope's audit trail and the Certificate of Completion that travels with the signed PDF.
What SigFetch is not
- Not SOC 2 audited — not yet. If your vendor process requires a SOC 2 report today, SigFetch won't pass it, and I won't pretend otherwise.
- Not offered as HIPAA-compliant. Keep protected health information out of SigFetch.
- Not a notary or identity-verification service. No Remote Online Notarization, no government-ID checks, no SMS access codes. Signer identity rests on control of the email inbox that received the link.
- No qualified/advanced EU signatures. SigFetch targets US ESIGN/UETA-grade signatures; it does not issue eIDAS QES or AES.
- No two-factor authentication yet on sender accounts. Use a strong, unique password (a password manager helps). MFA is on the list.
Retention: keep your own copies
Signed PDFs are byte-identical on every download, so a copy you save today will still pass verification years from now. That is exactly why you should download and file your own copies: SigFetch is a free service, not your document-retention system, and I don't promise indefinite storage. The Privacy Policy has the details.
Found a vulnerability?
Email support@sigfetch.com and it goes straight to me. I read security reports first and answer them fastest.
Judge it by the evidence, not the adjectives.
Send a document, download the signed PDF, and verify it yourself.