Think about what's inside your contracts:
- Revenue figures and pricing strategies
- Customer lists and contact information
- Employee compensation and personal data
- Intellectual property descriptions
- Trade secret definitions
- Board resolutions and corporate governance decisions
- M&A terms and acquisition prices
A breach of any of these creates legal liability, competitive damage, regulatory penalties, and reputational harm. Yet many teams send these documents through platforms that:
- Store files on servers they don't control
- Don't encrypt data at rest
- Have no access controls beyond a shared login
- Can't prove who accessed what and when
- Are headquartered in jurisdictions with weak data protection laws
What it is: An independent audit verifying that the platform meets the American Institute of CPAs (AICPA) Trust Services Criteria across five pillars: Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Why Type II matters: Type I is a point-in-time assessment. Type II evaluates controls over a 6-12 month period — proving the platform consistently maintains security, not just on audit day.
What to ask:
- "Can we see your SOC 2 Type II report?"
- "When was the last audit completed?"
- "Are there any exceptions noted in the report?"
ZiaSign: SOC 2 Type II certified. Annual renewal. Report available to enterprise prospects under NDA.
What it means: All stored documents are encrypted using AES-256 encryption — the same standard used by governments and financial institutions. Even if someone gains physical access to the storage media, the data is cryptographically unreadable.
What to verify:
- Encryption algorithm (AES-256 is the minimum standard)
- Key management (are encryption keys stored separately from data?)
- Key rotation policy (how often are keys rotated?)
What it means: All data transmitted between your browser and the platform is encrypted using TLS 1.3 — preventing interception, man-in-the-middle attacks, and eavesdropping.
What to verify:
- TLS version (1.2 minimum, 1.3 preferred)
- Certificate transparency
- HSTS (HTTP Strict Transport Security) enforcement
What it means: Only authorized users can access specific documents and functions. A sales rep can send contracts but can't delete them. A legal reviewer can view all contracts but can't modify templates without approval.
What to verify:
- Granular role definitions (not just admin/user)
- Custom role creation
- Per-document permission overrides
- Audit log of permission changes
What it means: Login requires more than just a password — a second factor (OTP, authenticator app, biometric) confirms identity.
What to verify:
- MFA available for all users (not just admins)
- MFA enforceable at the organization level
- Recovery procedures for lost second factors
What it means: Every action on every document is logged with timestamps, user identity, IP address, and browser/device information. This creates an immutable record for compliance, litigation support, and security investigations.
What to verify:
- Actions logged: view, edit, sign, download, share, delete
- Audit trail cannot be modified or deleted by anyone (immutable)
- Retention period (should match your regulatory requirements)
- Export capability for compliance teams
What it means: You can choose where your data is physically stored — crucial for GDPR (EU data stays in EU), data sovereignty laws, and industry regulations.
What to verify:
- Available regions (US, EU, India, Australia at minimum)
- No data replication to unapproved regions
- CDN caching policy (does cached data stay in-region?)
What it means: Before someone can sign a document, their identity is verified through one or more methods.
Available methods:
- Email verification (link sent to the specified email)
- OTP (one-time password sent via SMS or email)
- Phone verification
- Knowledge-based authentication (security questions)
- Government ID verification (passport, driver's license)
What it means: After a document is signed, any modification — even a single character — is detectable. This prevents tampering and ensures the document in evidence is identical to the document that was signed.
How it works: Cryptographic hashing (SHA-256) creates a unique fingerprint of the document at the moment of signing. Any future change produces a different hash, proving tampering.
What it means: When you delete a document, it's actually deleted — not just hidden. Secure deletion follows NIST 800-88 guidelines for media sanitization.
What it means: Regular third-party security professionals attempt to breach the platform, identifying vulnerabilities before attackers do.
What to verify:
- Frequency (at least annually, quarterly preferred)
- Scope (full application + infrastructure)
- Remediation timeline for findings
What it means: A documented, tested plan for responding to security incidents — including notification timelines, containment procedures, and communication protocols.
What to verify:
- Notification timeline (ZiaSign: within 72 hours per GDPR)
- Dedicated security team
- Regular incident response drills
| Risk | Without Proper Security | With ZiaSign |
|---|
| Data breach liability | Up to $4.88M average cost (IBM 2025) | Enterprise-grade protection |
| Regulatory fine (GDPR) | Up to €20M or 4% of global revenue | Full compliance |
| Contract disputes | "We can't prove the original document" | Immutable audit trail + hash verification |
| Unauthorized access | "Anyone with the link could see it" | RBAC + MFA + signer authentication |
| Data sovereignty violation | "We didn't know data was stored overseas" | Configurable data residency |
- ✅ SOC 2 Type II certified
- ✅ AES-256 encryption at rest
- ✅ TLS 1.3 encryption in transit
- ✅ Role-based access control with custom roles
- ✅ Multi-factor authentication (OTP)
- ✅ Immutable audit trail on every document
- ✅ Data residency options (Azure global regions)
- ✅ Multi-method signer authentication
- ✅ SHA-256 document integrity verification
- ✅ NIST 800-88 compliant deletion
- ✅ Annual penetration testing by third parties
- ✅ Documented incident response plan with 72-hour notification