DocnezSecurity at Docnez
The security measures in place today, and what is still planned.
Last updated: . Docnez is an electronic signature service operated by Nezuna Technologies Inc. (Ontario, Canada). We only list a control as in place when it is live.
Certifications
Docnez does not hold SOC 2, ISO 27001 or any other independent third-party security certification.
Where your data is hosted
- The Docnez application, database and stored documents run on a server we operate at OVHcloud in Canada. Encrypted off-server backups are stored with Backblaze B2 in Canada.
- Some providers process limited data outside Canada. For example, transactional email (Resend) is processed in the United States. See our Subprocessors page for the current list and locations.
Security controls in place today
| Area | What we do |
|---|---|
| Encryption in transit | HTTPS only on docnez.com and app.docnez.com (TLS 1.2 and 1.3; older versions refused), with HTTP Strict Transport Security. |
| Encryption at rest | Uploaded documents and other stored files are encrypted with AES-256-GCM. Keys are kept outside the data directory. The application database is not yet encrypted at rest by the app. |
| Browser protections | Content Security Policy, clickjacking protection (frame-ancestors 'none' and X-Frame-Options DENY), nosniff, a strict referrer policy and a restrictive Permissions-Policy. |
| Passwords | Stored only as Argon2id hashes. |
| Two-step sign-in | Optional authenticator-app (TOTP) sign-in with one-time recovery codes. Authenticator secrets are encrypted with AES-256-GCM. |
| Abuse protection | Rate limits on sign-in, sign-up, password reset and two-step codes. |
| Signer access codes | Optional per-signer access code, never sent in the signing email. Five wrong tries lock the link for 15 minutes. |
| Document integrity | Completed PDFs are sealed and hashed (SHA-256), with an audit trail of signing events. Anyone can check a sealed PDF on the public Verify page. |
| Backups | Nightly backups: short-term copies on the server, plus off-server copies encrypted before upload and stored in Canada. |
| Analytics | First-party analytics with no advertising trackers. Do Not Track and Global Privacy Control are honoured. |
On our roadmap
- Encryption at rest for the application database.
- A full restore test of backups onto a fresh server.
- An independent penetration test.
- Self-service data export and deletion for all data types.
Privacy and data protection
Our Privacy Policy explains how we handle personal information. Business customers can rely on our Data Processing Agreement. See also Subprocessors and Trust and security.
Report a vulnerability
Email hello@docnez.com with "Security" in the subject. Please read our vulnerability disclosure policy; our machine-readable contact is at /.well-known/security.txt. Please do not access other users' data, degrade the service, or disclose an issue publicly before we have had a reasonable chance to fix it.