Trust & Security

Encryption in transit

All connections to ForgeSign use TLS 1.3. We enable HSTS with a preload directive (max-age 2 years), so your browser refuses to downgrade.

Encryption at rest

• The Supabase Postgres database that backs ForgeSign uses AES-256 encryption at rest.
• Supabase Storage (where original PDFs and signed bundles live) uses AES-256 server-side encryption.
• On top of that, we apply app-layer AES-256-GCM to biometric data: signature images and typed-signature text. Only ForgeSign servers can decrypt these — even a Supabase administrator with read access to the database would see ciphertext.

IP address hashing

When we record an IP address (in the audit trail or on a signed document), we store the SHA-256 hash plus a server-side pepper, not the raw IP. The hash is not reversible without the pepper.

Tamper-evident audit trail

Every event in an envelope's lifecycle (created, sent, viewed, consented, signed, etc.) is appended to a hash chain. Each event's SHA-256 includes the previous event's hash, so altering any event breaks the chain. Anyone with the envelope ID can verify the chain at /verify/<envelope-id>.

Backups and recovery

Supabase performs daily database backups and retains them for 7 days on the Pro plan. Point-in-time recovery is available within the 7-day window. Storage objects are replicated across multiple availability zones.

Authentication

User authentication is managed by Supabase Auth, with bcrypt-hashed passwords (cost factor 10), JWT-based sessions, and HttpOnly + Secure + SameSite=Lax session cookies. We do not store plaintext passwords.

Access control

All database tables are protected by Postgres Row-Level Security (RLS). The application connects with anon-role credentials by default; the service-role key is used only for server-side actions that require elevated access (audit-event writes, bundle generation), and never exposed to the browser.

Application security headers

• Content-Security-Policy with restrictive defaults
• X-Frame-Options: DENY (no embedding our app in iframes)
• Permissions-Policy disabling browser APIs we don't need (camera, microphone, geolocation, USB, etc.)
• Strict-Transport-Security with preload
• Cross-Origin-Opener-Policy + Cross-Origin-Resource-Policy: same-origin (browser process isolation)
• Referrer-Policy: no-referrer on legal and authentication pages

Subprocessors with strong compliance posture

We rely on a small number of trusted infrastructure providers, each with current SOC 2 Type 2 reports: Supabase (database + storage + auth), Anthropic (AI), Stripe (PCI DSS Level 1), Resend (email), Vercel (hosting). Full list at /legal/subprocessors.

AI privacy

Document content sent to Anthropic for AI features is processed under a commercial-tier agreement: Anthropic does not use customer data to train its models. We send only what is needed (page text + per-page rendered images for field detection; conversation context for chat).

Vulnerability reporting

If you believe you have found a security issue, please email hello@jvanet.com. We commit to acknowledging within 5 business days and to coordinated disclosure.

SOC 2 status

ForgeSign as a corporate entity is currently working toward SOC 2 Type 2. Our infrastructure subprocessors are SOC 2 Type 2 today.