Encryption
All traffic uses TLS 1.3 with modern cipher suites and HSTS preload. At rest, every PDF, audit log, and database row is encrypted with AES-256, with keys managed by the underlying cloud KMS. Backups inherit the same encryption.
Infrastructure
Hosted on Supabase (Postgres + Storage) on AWS, with the application tier on Vercel and edge caching. Supabase and Vercel each maintain their own SOC 2 Type II compliance as our infrastructure providers; VG·Sign itself is not yet independently certified.
Tenant isolation is enforced at the database layer via Postgres Row Level Security — every query is scoped to the authenticated user’s organization, with no application-level shortcuts.
Audit trails
Every action — view, sign, decline, void — is appended to an immutable audit log, timestamped with the actor, IP, and device. The log is append-only: UPDATE and DELETE are blocked at the database layer by Row-Level Security. When the envelope completes, the SHA-256 fingerprint of the final PDF is recorded on the certificate of completion, so the signed document’s integrity can be verified independently. See Audit certificates for what that produces.
Authentication
Sender accounts use email + password with Supabase-managed sessions, optional TOTP MFA. Signers verify via email link plus optional SMS one-time code (configurable per envelope). Internal API access uses per-workspace bearer tokens — hashed at rest and revocable — with a secure single-use SSO hand-off for embedded CRM sessions.
Compliance
PIPEDA-aligned by design (retention controls, data subject rights). VG·Sign is not currently SOC 2 or ISO 27001 certified. Our infrastructure providers (Supabase, Vercel) hold their own SOC 2 Type II, and we’re glad to support a customer-led security assessment.
Vulnerability disclosure
Found something? Report it to info@vg-realestate.ca. We acknowledge good-faith reports and follow a coordinated disclosure timeline.
Security testing
We run internal security review ahead of enterprise onboarding, and an independent third-party assessment can be arranged as part of an enterprise engagement. Dependencies and access-control (RLS) policies are reviewed before release.