Security & Compliance

Encryption

In Transit

All data is encrypted in transit using TLS 1.3 with modern cipher suites. We enforce HSTS and certificate pinning.

At Rest

Documents and user data are encrypted at rest using AES-256 encryption. Encryption keys are managed through Azure Key Vault with automatic rotation.

Document-Level Encryption

Each document has its own encryption key, derived from a master key. Even if one key were compromised, it could not decrypt other documents.

Infrastructure Security

ZiaSign is hosted on Microsoft Azure with enterprise-grade security:

• Network isolation — Services run in private virtual networks
• DDoS protection — Azure DDoS Protection Standard
• WAF — Web Application Firewall for API and web traffic
• Monitoring — 24/7 security monitoring with automated threat detection
• Backups — Geo-redundant backups with point-in-time recovery

Compliance

Access Control

• Role-based access control (RBAC) for team members
• SSO/SAML integration for Enterprise accounts (Okta, Azure AD, OneLogin)
• Multi-factor authentication (MFA) available for all accounts
• Session management — configurable session timeouts and concurrent session limits

Data Privacy

• Your documents are never used to train AI models
• Document content is only accessed for features you explicitly use (e.g., AI analysis)
• Full data export available via Settings → Data → Export
• Right to deletion — request complete data deletion via Settings or by contacting support
• Data Processing Agreement (DPA) available on request for Business and Enterprise plans

Penetration Testing

ZiaSign undergoes annual penetration testing by independent security firms. Enterprise customers can request a summary of findings.

Reporting Vulnerabilities

If you discover a security vulnerability, please report it responsibly:

• Email: security@ziasign.com
• We acknowledge reports within 24 hours
• We aim to resolve critical vulnerabilities within 48 hours
• We do not pursue legal action against responsible disclosures