How vamosign looks after your documents
Where your documents are kept, how they are protected, and what happens to them. Every line is how vamosign works today.
Stored in Norway
The files people sign are kept in Microsoft's data centre in Norway. Every workspace has a storage container of its own.
Everything else in Europe
The app and its database run in Ireland. E-mail is sent from Frankfurt. Text messages go through a Norwegian provider.
Encrypted on the way and at rest
Every connection to vamosign is encrypted. Stored documents are encrypted at rest.
Shown before anyone signs
The signing page says what is kept: the name, the time, the IP address and the document's checksum. The certificate states exactly that, and nothing more.
Anyone can check a signature
Every signed PDF is sealed with our certificate and timestamped by DigiCert. Anyone can check a copy, without an account.
Check a sealed PDF yourselfNo AI reads your documents
vamosign sends no document, name or signature to an AI model.
No password to steal
You sign in with a one-time code sent by e-mail. The people who sign need no account.
Deleted on a schedule
Without Archive, a signed document is hidden after 30 days and destroyed after 90, with a warning a week before each. With Archive, everything is kept for as long as it is on.
Take everything with you
Download every sealed PDF, signature and event as one ZIP file, whenever you like, without asking us.
Backed up every night
Every record of who signed what, and when, is copied to a backup every night.
Signed webhooks
Every webhook carries an HMAC-SHA256 signature, so your system knows it came from vamosign. An API key belongs to one workspace.
A data processing agreement on every plan
We tell you before we add or replace a subprocessor. If a breach affects your data, we tell you without undue delay.
Who handles your data
The companies vamosign uses to run the service, what each one does, and where.
| Heroku (Salesforce) | Runs the app, its database, its job queue and our SMS service | Ireland |
| Microsoft Azure | Stores the documents and the sealed PDFs | Norway |
| Amazon Web Services | Sends the e-mails | Germany |
| CloudAMQP | Carries text messages to our SMS service | Ireland |
| Sveve | Sends the text messages | Norway |
| DigiCert | Timestamps each sealed PDF, and receives only its checksum | USA |
| FreeTSA | Timestamps when DigiCert does not answer, and receives only the checksum | USA |