Security
Built so the evidence holds up
A signature is only worth the record behind it. Here is how Refrendo keeps your documents private and the record trustworthy. We describe the audit trail as tamper-evident, not tamper-proof, because that’s what it is.
Your organisation’s data is only yours
Every record belongs to one organisation, and every read is checked on the server against the signed-in person’s organisation, never against anything the browser sends. Automated tests try to read another organisation’s data on every change.
Documents that can’t be quietly changed
Each version of a document is fingerprinted with SHA-256 when it is uploaded, and the database refuses to change or delete a version. A revision is always a new version with a new fingerprint, and approvals stay tied to the version they were given on.
A tamper-evident audit trail
Every step (sent, opened, approved, signed, downloaded) is recorded, and each record is chained to the previous one with a hash, so any edit after the fact is detectable. The database refuses updates and deletes to the audit trail.
Private storage, short-lived links
Documents sit in private storage with encryption at rest, and are only ever served through links that expire within minutes. Nothing is publicly addressable.
Secure signing links
Each signer gets their own high-entropy link, stored only as a hash. Links expire, stop working the moment a request is retracted or revised, and are rate-limited against guessing.
Access that ends when employment does
Removing someone from your organisation ends their access immediately: their sessions, their API keys and their sender seat. Nothing they did is changed. With single sign-on, your identity provider decides who can sign in, on a domain you’ve proven you own.
Permissions, not job titles
Who can send, approve, manage templates, see the whole organisation’s documents or manage billing is set by explicit permissions. Nobody can give out a permission they don’t hold themselves.
Nothing sensitive in our logs
Application logs carry identifiers only, never document contents or signature images.
When a document is complete
The completion certificate
Everyone who took part receives the final PDF, with every signature merged into the page, and this certificate. It records:
- the document, your organisation and the request’s reference;
- each approver and signer, what they did and when;
- how each person was identified (a signed-in account, or their own secure emailed link) and how they signed (typed, drawn or uploaded);
- SHA-256 fingerprints of the original and the completed PDF, so anyone can check the file in front of them is the one that was signed.
Behind it sits the full audit trail, including the exact consent wording each person agreed to, stored as they saw it.
Questions from your security team
Email security@refrendo.com.au for our security questionnaire answers or to report a vulnerability.
Join the closed beta
Refrendo is invitation-only for now. Organisations in the beta approve and sign free for as long as it runs.