Help center
Security & legal

Is my data secure? Where is it stored?

TLS in transit, encrypted at rest, tenant isolation in every query, a tamper-proof audit chain — and exactly where your data is stored today.

2 min read

Transport

Every request to SahlSign is TLS 1.2+. HTTP traffic is redirected to HTTPS at the edge. Email transmission uses STARTTLS opportunistically (Resend handles the SMTP layer).

At-rest

  • Database (Neon Postgres) — documents, signatures, audit records and account data are all stored here, encrypted at rest by the underlying cloud provider. Daily backups with point-in-time recovery
  • Audit chain — hash-linked SHA-256 chain stored in the database with a Postgres rule preventing UPDATE / DELETE (immutability enforced at the DB level, not just the application layer)

Multi-tenant isolation

Every database query that returns tenant-scoped data carries a tenantId filter, enforced in the application's data layer and checked in code review. Database-level Row-Level Security is not enabled today.

Data residency

Today: the database that holds your documents and audit records (Neon) and the application servers (Vercel) run in the same cloud region, outside the GCC. AI features, when an admin turns them on, use Groq in the United States. SahlSign does not offer hosting inside the GCC today.

This is fine for many organisations but can block regulated ones whose rules require in-country storage (for example under Saudi PDPL or sector rules from SAMA and the NCA). If your organisation must keep data in a specific country, contact us before subscribing — we confirm in writing where your data is stored and whether the requirement can be met.

What we do NOT do

  • We do not train ML models on customer documents
  • We do not share documents with third parties beyond the email delivery provider (Resend) and the timestamping authority (RFC 3161 TSA, which receives only a hash, never the document)
  • AI features are off unless an owner or admin turns them on. When they are on, the contract text needed for the feature you use is sent to our AI provider (Groq, United States); only request metadata is logged on our side
  • We do not retain documents after tenant account deletion (full purge within 30 days)

Reports / certifications

  • SOC 2 — not yet certified. On the roadmap; honest disclosure on our /compliance page
  • ISO 27001 — not yet certified
  • HIPAA — not currently supported (no BAA available)
  • UETA / ESIGN / eIDAS SES — fully compliant. See /compliance for the specific controls per regulation
Back to help center