Security is at the heart of every CivicSign signature. This page outlines the controls we have in place and the standards we align with as a United Kingdom-based provider of electronic signature services.
Encryption
- All traffic between your browser and CivicSign is protected by TLS 1.2 or higher.
- Documents and personal data are encrypted at rest using AES-256.
- Cryptographic keys are managed by a hardware-backed key management service with strict access controls.
Legal Validity (UK eIDAS)
Signatures created through CivicSign are designed to satisfy the requirements of the UK Electronic Communications Act 2000 and the retained EU Regulation 910/2014 (“UK eIDAS”). Every completed envelope is sealed with a digital certificate and accompanied by a tamper-evident audit trail capturing signer identity, IP address, timestamps and a hash of the final document.
Compliance & Certifications
- UK GDPR and Data Protection Act 2018 compliant processing.
- ISO/IEC 27001-aligned information security management.
- Regular independent penetration testing by CREST-accredited testers.
- Registered with the Information Commissioner’s Office.
Data Residency
By default, customer data is stored in our United Kingdom region. Enterprise customers may request EU or other approved regions subject to availability.
Access Controls
- Role-based access controls limit data access strictly to authorised CivicSign staff.
- All administrative access requires multi-factor authentication and is logged for audit.
- Customers can enforce SSO and SCIM provisioning on the Enterprise plan.
Business Continuity
Customer data is replicated across multiple availability zones with automated, encrypted backups. We test our disaster-recovery plan at least annually and target a 99.9% monthly uptime for production services.
Responsible Disclosure
If you believe you have discovered a security vulnerability in CivicSign, email security@civicsign.com. We will acknowledge receipt within two business days and work with you to validate and remediate the report.
Contact
Need our latest security questionnaire or pen-test summary? Email security@civicsign.com.