Is Paraph secure?

Documents, signed copies, certificates and the database are held by Supabase in the AWS London region (eu-west-2). The application runs on Vercel, pinned to its London region. Both choices are fixed in the project’s configuration.

Email goes out through Resend, which is in the United States. Every company that can touch your data is on the sub-processors page, with what it does and where it is.

Paraph runs on these providers. The certifications are theirs, as each states on its own page:

• AWS, whose London data centres Supabase runs on: ISO/IEC 27001:2022 certification and a SOC 2 report.
• Supabase, which stores the documents and the database: SOC 2 Type 2 and ISO 27001.
• Vercel, which runs the application: a SOC 2 Type 2 attestation and ISO 27001:2022 certification.

AWS states that physical access to its data centres is controlled at the entrances by security staff, surveillance and detection systems, that authorised staff use multi-factor authentication to get in, and that access is logged, monitored and kept.

Every Paraph domain serves HTTPS only. A request over plain HTTP is redirected to HTTPS, and each domain tells browsers to use nothing but HTTPS for the next 2 years (HSTS).

At rest, Supabase states that “All customer data is encrypted at rest with AES-256 and in transit via TLS”.

Each signer gets their own link. The secret in it exists only in the email; we store a keyed hash of it, so a copy of our database is not a set of working links. A link stops working after 30 days, and the sender can send a fresh one.

Paraph has no passwords anywhere, so there are none to leak or reuse. People sending sign in with a one-time code emailed to them. People signing don’t have an account and never sign in.

The sign-in page runs Cloudflare Turnstile, a bot check, and one email address can ask for at most 5 codes an hour.

The people in your organisation, decided by the database rather than by the screen, so the same rule covers the list, the page and the file itself.

• On Free, everyone in your organisation can see every document.
• On Pro, members see the documents they sent and those in folders shared with the organisation. Owners and admins see everything.
• The people you send a document to see that document, through their own link, and nothing else.

The rule is enforced by row-level security in the database, one function that every policy on documents and their files calls.

We don’t read your documents. Paraph has one admin page, open only to named accounts on an allowlist, and it shows:

• documents held for a check before sending: the title, the organisation, who sent it and which checks it tripped
• reports that recipients send in, with the reason and any note they wrote
• organisations whose sending is paused, and why
• how many emails each sending domain sent, bounced and had marked as spam in the last 7 days
• how many times the badge was clicked each day
• new sign-ups: the email address, and how they heard about Paraph if they said

It does not show:

• the files you upload or the signed copies
• the people you send documents to
• signatures or anything a signer typed
• the audit trail of a document

One automated check reads the first page of a document when it is uploaded, looking for bank and government names and invoice language, which is what phishing sent through e-signature tools looks like. It keeps the words that matched and the domains of any links, and never the page. The privacy page describes it in full.

This website counts page views with Vercel Web Analytics, which sets no cookies. There is no analytics in the product: it never loads in the app, on a signing page or on an invitation link. A signing link carries a credential in its address, and analytics records the address of every page it runs on.

We count clicks on the “Signed with Paraph” badge ourselves, as a number per day for each place it appears. Nothing about who clicked is kept.

The only script from another company anywhere in Paraph is Cloudflare Turnstile, a bot check on the sign-in page. People signing a document never load it.

Payments are handled by Stripe. You enter card details on Stripe’s own checkout and billing pages, so Paraph never receives or stores a card number. Stripe states that it is certified to PCI Service Provider Level 1.

Paraph uses three separate domains: tryparaph.com for this website, paraphsend.com for documents sent on Free, and paraphdocs.com for documents sent on Pro. If somebody abused the free plan and got its domain blocked, paid customers’ documents and this website would keep working, because spam blocklists judge a whole domain at once.

Both sending domains publish SPF and DKIM, and a DMARC policy of reject, so a mail server turns away a message that claims to be from them and fails the check.

It also means a real Paraph email can come from a domain that isn’t this one. Our email domains lists every address a genuine message comes from.

New accounts can send a few documents on their first day, and more over their first month. A document that looks like phishing is held for a check before it goes out. Anyone who receives a document can report it from the signing page, and repeated serious reports pause an account’s sending.

Every document has an audit trail: when it was sent, when each email was accepted and delivered, when signing links were opened, when each person agreed to sign electronically, when they signed or declined, and when the document was finished and downloaded. Each event carries the time from our server, the IP address and the browser.

The trail is append-only. Nothing in it can be edited or deleted, by you or by us, with one exception: if somebody asks us to erase their personal details, a single audited function removes them, and that removal is itself recorded in the trail.

It exists because a signature is only worth the evidence behind it. If a signed document is ever questioned, the trail is what answers.

Mail security scanners open links before people do. Those opens are recorded as what they are, marked as automated, and never counted as the signer having seen the document.

When the last person signs, Paraph computes a SHA-256 fingerprint of the signed PDF and prints it on the completion certificate. Any change to the file, however small, gives a different fingerprint, so anyone can check their copy against the certificate:

shasum -a 256 signed.pdf
certutil -hashfile signed.pdf SHA256

The first line is for a Mac or Linux, the second for Windows. If the result matches the certificate, your copy is byte for byte the document that was signed.

The PDF does not carry a cryptographic seal yet. A seal made with our own certificate makes Adobe Reader show a warning, which reads worse on a contract than no seal at all. One that Adobe trusts needs a certificate from an approved authority, and those are issued only to a registered company. We plan to add one once the company is registered. The fingerprint stays either way.

Download a sample certificate (PDF). How to check a signed PDF

The full test suite runs on every pull request and on every change to the main branch. It includes integration tests against a real Postgres database with every migration applied, and a standing test that tries to write every database column as a signed-in user and as an anonymous one, and fails on any column not on a written list.

On 30 September 2026 the suite held 694 unit tests and 454 integration tests.

You can delete a draft, completed, declined or withdrawn document from the app. The file, the signed copy, the certificate and everything signers typed are deleted. The record that the document existed, who it went to and its audit trail stay, so the evidence of what happened survives. How to delete a document.

A draft that was never sent is deleted 90 days after it was last edited, and we email you 14 days before.

To have your personal details erased, email info@tryparaph.com. We remove them with the audited function described above. The privacy page sets out how long we keep everything.

Email info@tryparaph.com. The same address is in our security.txt.

• Paraph doesn’t hold its own ISO 27001 certificate or SOC 2 report.
• There is no single sign-on.
• The signed PDF has no cryptographic seal.
• Paraph provides simple electronic signatures only. It verifies that somebody had access to an email address, not who they are.

• Sub-processors
• Privacy
• Report a document
• Security.txt