Security and data
What we hold, where, and who can see it
SignedOffBy holds your briefs, plans, proposals and the record of who signed what. It holds them in the EU, shows them only to your workspace and the people you share a record with, and never touches a client's live system.
The short version
EU hosting
The application and its database run in Amsterdam, the Netherlands, on Railway.
No live-system access
We never ask for, store or use credentials for Oracle, Salesforce, Microsoft Dynamics 365 or any client system.
No training on your data
Your data is used only to provide the service to you, and never sold.
Your own model key
Passes run on your firm's Anthropic key, under your own agreement with Anthropic. We store it encrypted.
No trackers
No analytics, no advertising, no scripts. Fonts are served from our own server.
Delete when you choose
Plans and passes export at any time. An owner can delete the whole workspace from Settings.
Measures in place
| Area | What we do |
|---|---|
| Transport | HTTPS only, with HTTP Strict Transport Security |
| Passwords | Hashed with scrypt; never stored or logged in plain text |
| Sessions | Random tokens stored only as SHA-256 hashes; HttpOnly, Secure, SameSite cookies; 14-day expiry; an anti-forgery token on every signed-in form |
| Sign-in | Repeated sign-in attempts are limited by address and by email |
| Model keys | Encrypted with AES-256-GCM under a key held outside the database; shown only as a short hint |
| Separation | Every query is scoped to your workspace; an account belongs to one firm; automated tests check one workspace can't see another's data |
| Roles | Only owners and specialists can sign off or share; by default the person who started a pass can't sign it off; anyone whose password an owner set must choose their own before signing anything; every password reset is in the audit trail |
| Integrity | The content of plans, and every proposal, sign-off, agreement and audit event, can't be changed once written, enforced in the database; the audit trail is chained with HMAC-SHA256 |
| Share links | Random tokens stored only as hashes; expire within 365 days at most; revocable; views counted; hidden from search engines |
| Browser | No scripts run on any page; a Content Security Policy that blocks all scripts; pages can't be framed |
| Change control | Code in a private repository; an automated test suite against a real database runs before each release |
Who receives your data
| Recipient | Why | What | Where |
|---|---|---|---|
| Railway | Hosts the application and database (subprocessor) | Everything in your workspace | Stored in Amsterdam; company in the US, under its DPA |
| Google Workspace | Sends invitation and password-reset emails from hello@signedoffby.com (subprocessor) | The recipient's name and email, your workspace name and a one-time link | Under Google's data processing terms |
| Anthropic | Your own model provider, on your own key, when you start a pass | The brief and that task's vendor guidance | Under your agreement with Anthropic |
| People you share with | A read-only link you create | One sign-off record | Until the link expires or you revoke it |
The full terms are in our Data Processing Agreement.
What the seal proves, and what it doesn't
The seal proves a plan or a pass hasn't changed since it was made, that every sign-off still matches its entry in the audit trail, and that no event in the trail has been edited, removed or reordered behind a later one. Anyone with access can re-run that check, and a client opening a share link sees it run live.
It doesn't prove the content is right. A model can be wrong; that is why every task needs a named person's sign-off. And because we operate the service and hold the audit key, the seal guards against tampering by anyone outside SignedOffBy, not against us. Nor can the trail on its own show that its newest events were cut off. We say so in our terms.
- Detects
- Edited proposals, sign-offs or history
- Shows
- Who signed, when, as whom
- Doesn't prove
- That content is correct
Questions firms ask
Do you connect to our clients' Oracle, Salesforce or Microsoft Dynamics 365 systems?
No. SignedOffBy plans and records; it never configures, connects to or changes a live system, and never asks for credentials to one.
What does Anthropic see?
During a pass, the brief and the vendor guidance for each task are sent to Anthropic on your firm's own API key. What Anthropic keeps is governed by your own agreement with Anthropic.
Can we take our records with us?
Yes. Plans and passes export to Markdown at any time, and sign-off records can be printed or saved as PDF from the browser.
How do we delete everything?
A workspace owner can delete the workspace from Settings. Every plan, pass, sign-off, share link and audit event in it is deleted from the live service at once, and leaves our backups as they expire.
Do you back up the database?
Daily backups are being switched on during the pilot. Until we confirm they are active, export anything you can't afford to lose.