Trust
What we do to make a signature stand up.
Written for the person who signs the contracts and for the person who has to ask how it works. Every claim on this page links to the page or feature behind it.
Signatures that hold up
In the United States an electronic signature counts when the signer agreed to sign electronically and there is a record of what happened. XOsign does both, every time.
Built to ESIGN and UETA
Before anyone signs, they are shown the electronic-records consent and have to accept it. That acceptance is stored alongside the signature rather than assumed.
A record of who signed, when, and from where
Every meaningful moment — created, sent, viewed, signed, declined, voided, with the reason the person gave — is written to the audit log together with the time, the IP address, and the browser and device used.
Nobody can quietly change the record
The audit table is append-only. Permission to update or delete a row is revoked in the database itself, so neither our staff nor our own application can backdate or erase an entry.
A signature is recorded only when someone actually signs
Being named on a document is not signing it. A person counts as signed only when every signature and initial block that belongs to them carries a real mark. Filling in text, dates, amounts or tick boxes is never treated as a signature.
Proof anyone can check
You should not have to take our word for it, and neither should the other side, their lawyer, or a judge.
A fingerprint on the signed PDF
Every completed document is hashed with SHA-256 — a 64-character fingerprint that changes completely if a single byte of the file changes.
A timestamp from someone who is not us
That fingerprint goes to FreeTSA, an independent RFC 3161 timestamp authority, which signs it. If XOsign vanished tomorrow, a third party holding the PDF and the timestamp token could still prove when it was signed.
How to check a document yourself
- Open the verification page. No account, no sign-in.
- Drop in the signed PDF, or paste its SHA-256 fingerprint if you already have it. The file is hashed in your browser — only the fingerprint reaches us.
- You get back whether it matches a completed document, when it was completed, its timestamp, and how many people signed. Never the contents.
Know where every copy went
Most documents stop being yours the moment they leave. XOsign keeps the thread.
Every copy that leaves is on the record
A download, a print, an email attachment, a certified letter — each one is registered with its own serial, who took it, when, and from what address and device. Opening a document inside XOsign is not an export and is not logged.
That record stays inside your account
The register is readable only by your own account, enforced by the database. Nobody — including us — can change or delete a row through the application; it goes only when you delete your account.
A mark that survives paper, and a way to read it back
On paid plans every copy carries a concealed mark that survives printing, photocopying, scanning and screenshots, so a page that leaked can be matched back to the export it came from. Free accounts get none of this — no register, no mark.
Your data stays yours
One account cannot see another
Every table holding account data carries Postgres row-level security tied to your account. The isolation is enforced by the database itself, not by application code remembering to filter.
Encrypted on the wire and on disk
TLS on every connection, AES-256 at rest on the Supabase Postgres and Storage backend. The keys that could bypass this exist only inside server-side functions; a browser never receives one.
Your contracts never reach our error monitor
Error monitoring is configured to receive the error and nothing else — no user IP addresses, no cookies, no auth headers, and no session recording. What our customers see on screen is their customers' contracts, so the monitor does not get to see it.
We do not train on your documents, and we do not hold your card
Your contracts are never used to train a model, and our AI runs on a zero-retention configuration. Payment details stay with Stripe — we store only a customer ID.
Two-step sign-in, for you and for your whole team
You can turn on an authenticator code for your own account today. A team owner can require it of everyone on the team, with a grace period, a warning first, and a per-person extension — nobody is locked out of work in progress. Our own staff tools have required it all along.
Take everything you have with us, whenever you want
Download an instant summary of every record we hold on you, or ask for the full bundle — your records, your audit timeline and every file — which arrives as a link by email. One full export per account per day, from Settings → Privacy.
Your original is never changed
An uploaded document stays exactly as you uploaded it. If you ask for an editable copy, that copy is a separate working document: the original stays attached and untouched, and everything else keeps working on it.
Works in two languages, and holds up in court
A signature from someone who could not read the contract is the weak point courts actually attack. XOsign presents the agreement in both languages, so the signer reads the version they understand. We have written up the case law that decides what a bilingual signature really proves — Morales v. Sun Constructors, the Texas Saenz line, California Civil Code §1632, and the gap in Florida.
Where we are headed
This part is the honest list. These are not finished, and we will not describe them as finished until they are.
Delete your account
Available nowYou can request deletion from your account settings today. It is scheduled 30 days out so a mistake can be undone, and then the data is purged. The audit log survives by design — a legal record you can erase is not a legal record. Demo accounts created without signing up are swept seven days after they are made.
Accessibility
In progressWe target WCAG 2.1 AA. The statement says plainly where we meet it and where we do not yet.
SOC 2
PlannedA SOC 2 Type II audit is planned. We have not started one, and we claim no certification today.
Questions, or something that looks wrong
Security researchers and IT reviewers: write to security@xosign.ai. We reply to every report within 24 hours. For the engineering detail behind this page, see the security page.