Security

Access control

Access to documents is managed through accounts, workspaces, folders, invites, and roles. Rights to upload, send, sign, delete, share, bill and manage a team are checked at the server level. After a subscription expires, the account goes into limited view and download mode.

Traceability and signing

We support events for actions such as upload, open, send, sign, and access changes. An audit trail can include time, IP address, recipient, method, and signer identity. With a qualified signature, the certificate and validity are handled according to the integration with the external provider.

Transport and file storage

Your connection to the site is protected with HTTPS. Documents are kept in private file storage. Access permissions are checked when viewing or downloading; original files are not publicly accessible.

Document encryption

SignFida encrypts private documents with AES-256-GCM before sending them to storage. Each document uses a separate random data key protected by a versioned master key. Authenticated encryption detects unauthorized changes to the encrypted content or associated metadata.

Environment separation and recovery

The application supports separate deployment environments. Storage locations, backup schedules, retention and restore checks must be defined and verified for each environment. Encryption alone does not replace backups or guarantee recovery.

Payment information

Online card payments are not enabled. The offer form neither takes a payment nor stores card details. Payment instructions are provided separately with the personal offer.

Browser and session protection

Sign-in and sessions use secure cookies and request checks. Keep your browser up to date, protect access to your device, and sign out on shared devices.

Protecting keys and certificates

When Enterprise uses its own electronic seal, the private key is stored encrypted. Payment, email, signing, and encryption secrets are loaded from a secure configuration, are not sent to the client, and access to them must be restricted and traceable.

Operational security

Deployment security requires restricted access, updates, monitoring, backups and incident procedures. This page does not certify a particular server configuration or guarantee uninterrupted availability. Account owners should use strong unique passwords and review access regularly.

Reporting vulnerabilities and incidents

For a vulnerability, lost device, or suspected unauthorized access, write to [email protected]. Do not include real passwords, private keys, CVCs, or full card numbers. We will confirm receipt and provide guidance according to the risk.

Operator

The SignFida service is provided byЛИХТ ЕООД. Company registration number: 120562752. Address: ул. Петър Берон 14, 4700 Смолян, България.