Security
You're trusting a free tool with real contracts, so here's how it works so you can decide for yourself if it meets your needs. This page lists exactly what protects your documents and, just as important, what SigFetch is not. We try to do what we describe here. We might make mistakes. There could be bugs. There's no such thing as guaranteed security, but we try our best to deliver something that is secure and stable.
How your documents are protected
- Encrypted in transit and at rest. All traffic runs over HTTPS, and stored documents are written with AES-256 server-side encryption.
- Each signer gets a unique link built on a 32-byte random string — the same style you've probably seen in links to shared files or password-resets. Almost impossible to guess at random, but don't pass it around. That is your link for your use only.
- Credentials are hashed. Passwords are hashed. API keys are shown to you once and stored only as SHA-256 hashes.
- Sessions time-out. Changing your password should invalidate existing sessions, and unlinking a connected Google account should end the sessions it created.
- Signed webhooks. Outbound webhooks are HTTPS-only and signed with HMAC-SHA256 over a timestamped payload, so your server can verify each request really came from SigFetch and reject replays.
Tamper evidence: what the hash actually proves
When a document completes, SigFetch assembles the final PDF — your documents, the signatures, and the Certificate of Completion — and records its SHA-256 fingerprint. If anything changes in that file, the fingerprint no longer matches.
Anyone holding the file can check it at sigfetch.com/verify. The hash is computed locally in the verifier's browser, so the document itself never leaves their machine — they upload nothing, and they don't need an account.
To be precise about the limits: this is tamper evidence, not a cryptographic digital signature. SigFetch does not embed PKI certificates in the PDF (no PAdES, no qualified signatures). What verification proves is that this exact file completed signing through SigFetch, when, and by whom — which is the evidence that matters for ordinary US business documents under ESIGN and UETA.
What signing captures
Every signature records an explicit consent-to-sign-electronically checkbox, plus the signer's IP address, browser, and a timestamp. All of it lands in the document's audit trail and the Certificate of Completion that travels with the signed PDF.
What SigFetch is not
- Not SOC 2 audited. If your vendor process requires a SOC 2 report today, SigFetch won't pass it.
- Not offered as HIPAA-compliant.
- Not a notary or identity-verification service. No Remote Online Notarization, no government-ID checks. Signer identity rests on control of the email inbox that received the link.
- No qualified/advanced EU signatures. SigFetch targets US ESIGN/UETA-grade signatures; it does not issue eIDAS QES or AES.
- No two-factor authentication (yet) on sender accounts. Use a strong, unique password (a password manager helps). MFA is on the list. Or better yet, use the Google single sign on if you have a Google account.
Retention: keep your own copies
Signed PDFs are byte-identical on every download, so a copy you save today will still pass verification years from now. That is exactly why you should download and file your own copies: SigFetch is a free service, not your document-retention system. I don't promise indefinite storage.
Allow-listing SigFetch email
If you administer a mail filter and our signature requests are being quarantined, the sending domains, SPF and DKIM details, and the steps for the common filters are on the email deliverability page.
Found a vulnerability?
Email support@sigfetch.com and let me know – and thank you.
Free e-signatures with a sound security approach.
Send a document, download the signed PDF, and verify it yourself.