What “secure” means for an e-signature
A signed agreement is only as trustworthy as the process behind it. For an e-signature, that comes down to four questions: can anyone read the document on its way to the signer? Is it protected while it’s stored? Can the wrong person open it? And afterwards, can you show who signed, and when?
SignPe is built to answer each of them. Your documents are encrypted in transit and at rest, access is limited to the people on the document, every action is written to an audit trail, and where you need stronger proof of identity, signer authentication is available through Aadhaar eSign.
It is easy to assume a paper signature is the safe option. In practice, printed contracts get left on desks, scanned to shared folders and emailed as unprotected attachments — and a handwritten signature carries no record of when it was made or by whom.
| Paper or email attachment | SignPe | |
|---|---|---|
| In transit | Plain attachment, forwarded freely | HTTPS/TLS plus AES-256 payload encryption |
| In storage | Inboxes, desktops, filing cabinets | Encrypted cloud object storage |
| Who can see it | Anyone it is forwarded to | Only the document’s participants |
| Proof of signing | A signature and a handwritten date | Time-stamped audit trail PDF |
| Identity check | None | Aadhaar eSign with OTP, for India |
Encryption in transit and at rest
Every connection to SignPe — from the web app, the iPhone and Android apps, and the signing page your recipients open — runs over HTTPS/TLS. On top of that, the data your device sends to SignPe’s servers is additionally encrypted with AES-256, so the contents of a request are protected by a second layer, not just the connection.
Once uploaded, documents are kept in encrypted cloud object storage. A contract doesn’t sit as an attachment in a dozen inboxes or as a file on a shared laptop; it lives in one protected place, and the signed copy is delivered from there.
| Stage | How it is protected |
|---|---|
| Uploading a document | HTTPS/TLS, with request payloads additionally encrypted (AES-256) |
| Stored between steps | Encrypted cloud object storage |
| A signer opening the link | HTTPS/TLS, and only participants can open the document |
| Every action along the way | Recorded with date and time in the audit trail |
| Aadhaar eSign (India) | OTP verification and a PKI-signed PDF with a SHA-256 document hash |
Who can open a document
A SignPe document is visible only to its participants: the person who sent it, the signers on it, and any observers you copied. Someone who isn’t on the document can’t open it, and signers only see the document they were asked to sign — never the rest of your account.
- Registered users sign in first before they can open and sign a document sent to them.
- Guests sign from their own email link after accepting an electronic records consent screen — no account and no download, and the link only opens the document it was sent for. See signing without an account.
- Each signer signs their own fields. Fields are assigned to a specific signer, so one person can’t complete another’s signature box.
- Only the sender can void. If you void a document, its signing link stops working for everyone, even from an old email.
Signer authentication with Aadhaar eSign
For agreements signed in India, SignPe offers Aadhaar eSign as a signer authentication option. Instead of relying on the email link alone, the signer verifies their identity with a one-time password (OTP) through eMudhra, a licensed certifying authority.
The result is a PKI-signed PDF: the signed document carries a cryptographic signature that includes a SHA-256 hash of the document, so any change made after signing is detectable. Each Aadhaar-signed document also comes with an evidence certificate recording the signing.
When to choose Aadhaar eSign
Use it where you want stronger proof of who signed — loan and credit paperwork, property documents, or high-value contracts with Indian signers. The legality guide explains how e-signatures are treated under India’s IT Act 2000.
An audit trail of every action
Security isn’t only about keeping people out; it’s also about being able to show what happened. SignPe records every action on a document with its date and time — sent, received, opened, signed, declined or voided — and you can follow it live through status tracking.
When the document is done, download its audit trail PDF. It lists the document ID, the dates it was sent and completed, and when each signer was emailed, viewed the document and signed. Electronic signatures are recognised under the US ESIGN Act and UETA, the EU’s eIDAS regulation and India’s IT Act 2000; a clear, dated record of the signing process is what lets you stand behind an agreement if it is ever questioned.
The same protection on every device
SignPe runs on the web at app.signpe.com, on iPhone and on Android, with one account across all of them. The protections above don’t depend on where you work: a contract uploaded from your laptop and signed on a client’s phone travels over the same encrypted connections and is kept in the same encrypted storage. See SignPe on iOS, Android and web.
- Scanning on your phone turns a paper contract into a PDF inside SignPe, so it never has to be emailed to yourself first.
- In-person signing lets a signer sign on your phone or tablet in front of you, and the signature is recorded like any other.
- Signers without an account sign in the browser — nothing to download or install, and nothing left behind on their device.
- Completed documents are emailed to every participant with the signed copy once the last signer has signed, so everyone holds the same final version.
Because every action is recorded centrally, the audit trail is the same whichever device each person used. A document opened on a tablet, signed on a phone and downloaded on a desktop still has one complete, dated history.
Good security habits for your documents
- Double-check signer email addresses before you send. The signing link goes to the address you enter.
- Assign every field to the right signer so each person can complete only what is theirs.
- Use observers, not forwarding. Copy a colleague as an observer instead of forwarding the signed PDF around.
- Void anything sent in error. If a document went to the wrong person, void it straight away so the link stops working.
- Choose Aadhaar eSign for high-stakes Indian agreements where proof of identity matters.
- Keep the audit trail with the signed copy so the evidence is always where the agreement is.
For more on separating fact from fear, read electronic signature myths and security facts.
