Hosted in the EU
The database and files are hosted in the European Union (Ireland), by a company operated from France.
Security & audit trail
Signatures you can prove, data you can trust us with
How Priva6 records each signature, makes tampering visible, and protects your documents and your clients’ data.
Audit trail
What is recorded when someone signs
Every signature comes with the evidence needed to show who signed what, when and how. It is all printed in the audit trail sent to every party.
| Evidence | Details |
|---|---|
| Identity | The email address the signing link was sent to, the name and the details the signer confirmed (company, position, address… as you requested). |
| Signature | The typed, drawn or uploaded signature, the signing date and the primary signer’s initials. |
| Consent | The exact consent text the signer agreed to, word for word. |
| Context | IP address, country (from the IP address), browser and operating system names. |
| Timeline | When the link was sent, viewed (after a real interaction, so email scanners don’t count) and signed, in UTC. |
| Content | The SHA-256 fingerprint of the signed text and of every annex (name, size, fingerprint). |
| Chain | The sequence number and hash of the latest audit-chain entry, printed in the audit trail. |
Events in the log
- created
- revision
- sent
- link_created
- viewed
- reminder
- notification
- reviewed
- signed
- revoked
- completed
- superseded
- archived
Signers are informed
Signing records the IP address, country, browser and signature. A privacy notice link sits next to the “I agree” checkbox so signers know what is collected and why. That checkbox is consent to sign electronically: it is not, and is never treated as, consent to data processing under the GDPR.
Read our GDPR pageIntegrity
Tampering shows
Three mechanisms work together so that a signed document, its annexes and its history can’t be quietly changed.
Content fingerprints
When someone signs, the server fingerprints the exact content with SHA-256. A revision can’t be edited once sent: changes require a new revision.
Annex manifest
The name, size and fingerprint of every annex are recorded when the document is sent. The signed PDF is only generated if content and annexes still match.
Hash-chained log
Audit events are append-only. Each one is hashed and chained to the previous; the latest link is printed in every audit trail, so a rewritten history wouldn’t match the parties’ copies.
event_hash = sha256(event id, document, signature, event, actor, ip, details, timestamp)
hash = sha256(previous hash || event_hash)
#1283 prev 5d1e…a9c0 → hash 7be2…41f3
#1284 prev 7be2…41f3 → hash 03ab…7f19 ← printed in the audit trailLegal value
Simple electronic signatures, done properly
Priva6 provides simple electronic signatures (SES) as defined by the European eIDAS regulation (EU No 910/2014). Under its Article 25, an electronic signature cannot be denied legal effect or admissibility as evidence solely because it is in electronic form.
The signer is identified by the email address the link was sent to. They review the document and its annexes, agree to an explicit consent text, and sign; the evidence above is attached to the signature.
Priva6 does not verify identity documents and does not issue advanced or qualified electronic signatures. Some documents or jurisdictions require them, or a handwritten signature: you remain responsible for checking that the signature level suits each document.
- Explicit consent text, recorded with each signature
- Signer identified by the email the link was sent to
- Signed PDF and audit trail sent to every party
- Signed documents can’t be altered or deleted
- Every later version tracked and re-signed
Infrastructure
Security built into every layer
A separate signing domain
Signing pages are served from their own domain, so document content never runs where your team’s session lives.
Secrets never stored in clear
Signing, review and preview links are 256-bit random tokens; only their fingerprint is stored. API keys too.
Isolated organisations
Row-level security scopes every query to your organisation, with admin, editor and reader roles.
Strict browser policies
A strict Content Security Policy, sanitised document content, no third-party scripts and no remote images.
Minimal data
No tracking, advertising or analytics. Once a link is used or expired, it reveals nothing but its status.
Questions about security?
Our team is happy to answer your security questionnaire.