Everything your legal and security teams
need to review.

Compliance posture

What we have today, what's on the roadmap, and what doesn't apply.

We'd rather be explicit. If your internal compliance requires anything in the “Roadmap” column as a blocking condition, let's talk before you adopt the platform.

• ESIGN Act (15 U.S.C. §7001) & UETA compliance
  Live

  Operates as a simple electronic signature under the federal ESIGN Act and state Uniform Electronic Transactions Act framework. Documented at /us/legal/electronic-signature-legality.

• Reproducible public verification
  Live

  Server-recomputed hashes, an offline export for expert witnesses, and a published root CA.

• AES-256 encryption at rest · TLS 1.2+ in transit
  Live

  Applied to documents, evidence reports, and backups.

• Multi-tenant Row-Level Security
  Live

  Data isolation enforced by RLS policies in Postgres.

• DPA available for business customers
  Live

  See /us/legal/dpa — available to Teams, Enterprise, and other business customers.

• Responsible disclosure (security.txt)
  Live

  Policy published at /.well-known/security.txt — response within 72 business hours.

• Status page with incident history
  Live

  /status shows components and maintenance windows in real time.

• Security headers & CSP
  Live

  A rating on securityheaders.com: Content-Security-Policy, HSTS with preload, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. TLS 1.3.

• ISMS aligned with ISO/IEC 27001:2022
  Live

  A documented information security management system: an approved policy, a Statement of Applicability covering the 93 Annex A controls, and a risk register. It is not a certification; certification by an accredited body is planned as demand warrants.

• CSA STAR Level 1 (CAIQ v4.1)
  Live

  CAIQ v4.1 self-assessment published in the Cloud Security Alliance's public registry (STAR Level 1). It is a self-assessment, not an audited certification, and anyone can look it up. View the listing on CSA.

• ISO 27001 (audited certification)
  Roadmap

  The ISMS is already aligned (see above). Certification by an accredited body will begin as demand from enterprise customers warrants it.

• SOC 2 Type II
  Roadmap

  Process to begin as the enterprise customer base scales. No committed date.

• PCI DSS
  N/A

  Card processing is 100% outsourced to Stripe (PCI DSS Level 1). Kligrafia does not store, process, or transmit card data, so its scope is limited to SAQ A.

• HIPAA
  N/A

  Out of scope: Kligrafia does not process protected health information (PHI) covered by HIPAA. If your organization needs a Business Associate Agreement, talk to us before you adopt the platform.

• State-level qualified/certified signature accreditation
  N/A

  Doesn't apply to our current simple electronic-signature model under the ESIGN Act and UETA. We'll evaluate it if demand emerges.

Incident response

Five steps, no improvising.

When something breaks, what matters isn't promising perfection — it's having a process. Here's ours.

1. Step 1

   Detection & triage

   Automated monitoring plus external reports. Initial severity (P0/P1/P2/P3) and scope classification within the first hour.

2. Step 2

   Containment

   Immediate mitigation to stop loss or exposure. For security incidents: isolation, credential rotation, blocking attack vectors.

3. Step 3

   Communication

   For P0/P1 incidents: an update on /status within 30 minutes of confirmation, direct communication to affected customers, and, if applicable, notice under clause 11 of the DPA.

4. Step 4

   Eradication & recovery

   Removing the root cause, restoring services, verifying data integrity. Target time depends on severity.

5. Step 5

   Public post-mortem (when applicable)

   For incidents with material customer impact, we publish a post-incident analysis with root cause and the corrective actions taken.

Frequently asked questions

What legal and procurement teams ask.

Where is my data physically located?

PDFs and evidence reports live in Cloudflare R2 (a global network, primarily US/EU). The relational database runs on a managed provider with encryption at rest (US/EU). Specific regional details are in the subprocessor list above. If you have strict data-residency requirements, let's talk before you adopt the platform.

Who is the controller and who is the processor?

You (the business customer) act as the Controller of the personal data you upload, manage, or process through the platform. Kligrafia (Those Who Build Dreams, Inc.) acts as the Processor, handling data according to your documented instructions in the DPA and Terms.

Can I request a custom security questionnaire?

Yes — for Teams, Enterprise, and other business customers, we complete vendor questionnaires (SIG, CAIQ-Lite, or internal templates) under mutual NDA. Email [email protected] with the context.

How do I find out if Kligrafia adds a new subprocessor?

We notify business customers at least 30 days in advance (DPA clause 8). If you have reasonable objections, you may object; if we can't reach a resolution, you may terminate your subscription without penalty for the unconsumed portion.

What happens to my data if I cancel my subscription?

We keep data in an exportable format for a reasonable period defined in the Terms, during which you can download every envelope and evidence report. After that period, data is deleted or anonymized as set out in the DPA, except where mandatory legal retention applies (billing, tax records).