Creator-private by default
Documents and templates are visible only to their creator until that creator explicitly shares them. Organization administrators do not receive an override.
Trust comes from what the system actually does.
This page describes the planned launch controls. It does not claim a certification, guarantee legal enforceability, or promise a production hosting location that has not yet been configured.
Private object storage
Uploaded PDFs are kept out of SQLite. Development uses local private storage; production is designed for a private S3-compatible bucket.
Dedicated signer links
Each recipient receives a single-purpose token tied to the agreement and recipient. Sequential signers wait for their turn.
Electronic intent
A signer must affirm consent to electronic records and signatures, then adopt a typed or drawn mark before submission.
Completion evidence
The final workflow preserves the completed PDF, participant timestamps, and a separate completion record.
Consent-respecting analytics
Essential service and security remain on. Google Analytics loads only after analytics consent; Meta Pixel only after marketing consent.
Default lifecycle policy
Retention is visible and configurable—not hidden.
Launch defaults are policy and product settings, not legal advice. Organizations should confirm that the schedule fits their records obligations.
Completed agreements and audit recordsSeven years by default.
Draft, declined, expired, or cancelledNinety days by default.
User deletion recoveryThirty days before purge.
Workspace closure windowExport or reactivate before deletion begins.
Operational boundaries at launch
Payment, analytics, marketing tracking, production email, and public deployment remain inactive until credentials and explicit approval are provided. Security claims will be updated only after the deployed controls can support them.
Have a security or privacy question?
Ask about a control, workflow, or intended deployment choice.