Security & trust

Yes — for the vast majority of business contracts. Electronic signatures have the same legal standing as a handwritten signature in most jurisdictions:

• United States — the federal ESIGN Act (2000) and the Uniform Electronic Transactions Act (UETA, adopted in 47+ states) give e-signatures full legal effect for commercial contracts.
• European Union — eIDAS Regulation recognises Simple Electronic Signatures (what Bocument produces) for most business agreements.
• India — the Information Technology Act 2000 recognises electronic signatures for commercial contracts.
• United Kingdom — the Electronic Communications Act 2000 (retained post-Brexit) gives e-signatures equal standing to wet signatures.

Bocument captures what these laws require: the signer's affirmative consent to sign electronically, a timestamped audit trail, an IP address and user-agent record for every event, and a tamper-evident signed PDF with a Certificate of Completion page.

What e-signatures can't replace (in most jurisdictions): wills, real-estate deeds, court filings that require a notary, and government forms requiring a wet signature. For the contracts a startup signs day-to-day — NDAs, offer letters, vendor agreements, SOWs — Bocument is fully valid.

• PDFs are stored in Supabase Storage, encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Every document lives under a storage path scoped to its owner — other users cannot access it even with a valid session token.
• Signed documents are generated server-side and stored separately from the originals; neither file is ever processed on the client.

• Row-level security (RLS) is enforced at the database layer — queries from one user's session cannot return another user's documents, signers, fields, or audit events, regardless of what the API receives.
• Signing links are 48-character random tokens (generated via Node's crypto.randomBytes). They cannot be guessed or enumerated.
• Signers are shown a consent gate before they can touch any field, and their consent is timestamped in the audit trail.
• Signers can only write to fields explicitly assigned to their slot — server-side validation rejects any attempt to fill another signer's fields.

Every significant event is recorded in a tamper-resistant audit log with a UTC timestamp, the signer's IP address, and their browser user-agent:

• Document sent
• Signing link opened / document viewed
• Each field signed
• Document completed or voided
• Declined (with the signer's stated reason)
• Reminder sent

The audit trail is appended as a Certificate of Completion page inside the final PDF and is available from the dashboard at any time.

• Netlify — global CDN, HTTPS-only, automatic TLS certificate rotation.
• Supabase — SOC 2 Type II certified. Postgres database with row-level security, Storage with per-owner path isolation. Hosted on AWS (us-east-1).
• Resend — transactional email for signing invites and completion notifications, sent from a verified bocument.com domain (SPF, DKIM, DMARC all pass).

We believe in being honest about where we are. Bocument is an early-access product, and there are trust milestones we haven't reached:

• No SOC 2 for Bocument itself — our infrastructure providers (Supabase, Netlify) are certified; Bocument as a product has not yet undergone a third-party audit.
• No penetration test — we follow secure development practices, but have not commissioned an independent pen test yet.
• No qualified electronic signature (QES) — Bocument produces Simple Electronic Signatures under eIDAS. If your use case requires Advanced or Qualified signatures (e.g. EU financial services, regulated healthcare), you need a provider with a qualified trust service.

These are on our roadmap as the product grows. If you have specific compliance requirements, get in touch and we'll tell you honestly whether Bocument fits.