Skip to content
Security & integrity

Privacy built into the workflow.

Learn how Way2Sign processes documents locally, protects PDFs with AES-256 passwords and explains its security limitations.

In traditional contract management systems, uploading a PDF transfers your highly sensitive signatures, personal addresses, and financial figures to a corporate cloud database. This creates a massive vector for data leaks.

Way2Sign operates on a strict zero-trust baseline:

  • Core document operations run locally inside your device's browser. Optional account data and voluntarily submitted forms are handled separately.
  • We do not transmit, analyze, or process your files on external microservices.
  • Your legal paperwork remains entirely within your control.

Password Protect PDF uses AES-256 encryption locally. Use a strong password and share it separately. Encryption restricts opening the file; it does not authenticate the signer or prevent a reader from copying content. Searchable PDF (OCR) downloads an engine and selected language model, then recognizes your document locally. Cropping only hides margins and must not be used to redact sensitive information.

If you choose to create an optional account, we isolate your saved records using Google Cloud Security standards:

  • Firebase Authentication: Google-grade user profile authentication ensures only verified sessions can read/write data.
  • Strict Firestore & Storage Rules: Access security layers strictly isolate database folders. A user is physically restricted from accessing files belonging to another User ID.
  • Encryption in Transit: Optional account synchronization uses HTTPS.

To build trust, we must be honest about our project's early status. Way2Sign:

  • Does NOT have SOC 2 or ISO 27001 corporate compliance certifications at this stage.
  • Does NOT employ user-held end-to-end cryptographic key encryption (data in Google Cloud Storage is encrypted at-rest using Google-managed server keys, not user-held keys).
  • Does NOT provide advanced cryptographic digital signature seals (such as HSM-signed public key arrays) to verify signer authenticity.