Technical architecture
How we protect every signature,
in six layers.
The evidentiary value of an electronic signature doesn't come from a platform's logo — it comes from being able to demonstrate, mathematically, that the signer's identity was verified and that the document wasn't altered afterward. Kligrafia built every layer of the product around that principle.
Six layers that feel enterprise-grade.
Each layer covers a different vector: cryptographic integrity, document confidentiality, isolation between accounts, signer identity, application authentication, and operational resilience.
Cryptographic SHA-256 audit trail
Every action on an envelope (upload, field placement, signature, download, verification) generates an event with a SHA-256 hash chained to the one before it. If a single byte of the PDF or the log changes, the chain breaks and the document is invalidated. That property is what holds up the evidentiary value under the ESIGN Act and Federal Rule of Evidence 901.
AES-256 encryption at rest, TLS 1.2+ in transit
Original PDFs and evidence reports are stored encrypted with AES-256 in object storage (Cloudflare R2). All traffic between the browser, the API, and internal services travels over TLS 1.2+ with HSTS preload enabled. Sensitive secrets (API keys, signing keys) are managed separately from application code.
Row-Level Security in PostgreSQL
Every database query passes through RLS policies that automatically filter by organization. A bug in application code cannot expose another account's data, because the database itself rejects the query. Forty reviewed migrations, a kligrafia_app role with least-privilege access.
Three-tier KYC with anti-spoofing
Level A: verified email, IP, user-agent, device. Level B: a government-issued photo ID — driver's license or passport — photographed on both sides, with OCR and pattern validation. Level C: Level B plus a camera-based liveness check, anti-spoofing, and facial comparison against the ID. The evidence report records which level each signer reached.
Authentication, sessions & signed webhooks
Sessions use rotatable tokens, MFA is available for admin roles, password hashing uses a modern algorithm with tuned cost, and magic links expire quickly. Outbound webhooks are signed HMAC-SHA256 — your endpoint verifies the request actually came from Kligrafia before processing it.
Origin protected behind Cloudflare
The application server sits behind Cloudflare with WAF, rate-limiting, and DDoS protection active. Logs are centralized, dependencies are audited regularly, and encrypted backups are tested on a regular basis with real restores — to avoid "backups that don't restore."
Evidence report
Everything an expert needs to validate the signature.
When an envelope is completed, Kligrafia generates an evidence PDF separate from the signed document. It's the reproducible material that supports the case in any comparison or discovery proceeding.
Try the public verifier- SHA-256 hash of the PDF before and after each signature.
- ISO 8601 timestamp of every action (upload, place, sign, download).
- IP address, user-agent, device, and approximate geolocation for each signer.
- The KYC level each signer reached (A, B, or C) and the method used to verify it.
- A hash-chained event log — any alteration breaks the chain.
- An RFC 3161 trusted timestamp issued by an external timestamping authority (TSA).
- A digital seal on the evidence report itself, so the evidence PDF can't be tampered with unnoticed.
Honest posture
What we do, and what we don't yet.
We'd rather be explicit about where we stand on the path to certifications than oversell it. This page is updated when there are material changes.
Yes, today
- · SHA-256 audit trail + trusted timestamp on every envelope.
- · AES-256 encryption at rest, TLS 1.2+ in transit, HSTS preload.
- · Row-Level Security in Postgres with audited multi-tenancy.
- · Three-tier KYC with a liveness check (anti-spoofing).
- · HMAC-SHA256 signed webhooks.
- · Encrypted backups with periodic restore testing.
- · Published responsible disclosure (security.txt).
- · An explicit DPA available — /us/legal/dpa.
Not yet, on the roadmap
- · SOC 2 Type II — process to start as the enterprise customer base scales.
- · ISO 27001 — evaluated in parallel with SOC 2.
- · Public bug bounty with monetary rewards — today we accept reports with public credit, not payment.
- · State-level qualified/certified signature accreditation — doesn't apply to our current electronic-signature model under the ESIGN Act and UETA; we'll evaluate if demand emerges.
Responsible disclosure
Found something? Tell us before you publish it.
If you found a vulnerability in Kligrafia, email us at [email protected]. We respond within 72 business hours, coordinate a fix privately, and, with your consent, publicly credit your report on this page.
The full policy and our PGP key are at /.well-known/security.txt.
Frequently asked questions
What security teams ask.
- Does Kligrafia have SOC 2 or ISO 27001?
- Not currently. We operate with equivalent security practices (encryption, RLS, MFA, audit logs, responsible disclosure, an explicit DPA), but formal SOC 2 Type II and ISO 27001 certifications are multi-month, auditable processes with significant cost. They're on the roadmap as the customer base justifies it. If your internal compliance requires documented certification today, it's worth mentioning before you adopt the platform — we can share the specific roadmap.
- Who has access to my documents?
- Only your account and the signers you explicitly invite. Kligrafia's team does not open customer documents except in support cases you authorize in writing, or when a valid U.S. court order or other legal process requires it. Administrative access is logged in internal audit records.
- What happens if the service goes down or shuts down?
- We maintain encrypted backups that are tested regularly. If the service were ever to shut down, we would offer an export period during which you can download all your envelopes and evidence reports in standard PDF format — those files remain valid without Kligrafia, because the signature lives inside the PDF, not in our database. The specific commitments are detailed in the Terms.
- How do I report a security vulnerability?
- We have a published responsible-disclosure policy at /.well-known/security.txt. Email [email protected]. Target time to first response: 72 business hours. We publicly credit researchers on this page, only with your explicit consent.
- Do the signatures hold up to expert examination in a U.S. court?
- The SHA-256 audit trail and trusted timestamp let an expert witness recompute the hashes from the original document all the way to the evidence report. If a single byte changed after signing, the hashes won't match — that's mathematically demonstrable, not a matter of trusting Kligrafia's word, but a property of the algorithm itself. That reproducibility is what separates an electronic signature with an audit trail from a scan that can be altered without a trace, and it's designed to meet the authentication standard of Federal Rule of Evidence 901.
A signature is only worth what you can prove.
Start free and see for yourself what signing with an audit trail feels like. No card, no commitment.