In short
vScrawl protects your documents with AES-256 encryption at rest and in transit, a detailed audit trail, signer authentication with one-time codes and passkeys, role-based access control and tamper-evident seals. Enterprise plans add single sign-on (SSO). This page explains each control in plain terms. Security measures can vary by deployment model, plan and configuration.
Encryption
- Documents are encrypted at rest and in transit with AES-256 encryption.
- Data sent between browsers, apps, APIs and vScrawl services travels over secure, encrypted connections.
- Encryption keys, credentials and secrets are managed through controlled systems with restricted access.
Audit trails
- vScrawl records who viewed a document, who signed it, when and from where.
- Depending on the workflow, the audit trail can include participant actions, timestamps, document events, delivery information, authentication events and technical details.
- Each signed document includes a certificate of completion with timestamps, IP addresses and email verifications.
An audit trail supports traceability. It does not decide legal admissibility. You remain responsible for your retention and evidence rules.
Signer authentication
- Two-factor authentication (2FA). The signer enters a one-time code before opening the document.
- Passkeys. Signers can sign in without a password. Passkeys use cryptographic keys stored on the signer’s device.
- Per-document control. You can turn 2FA and passkeys on or off for each document. If a signer fails verification, access is denied.
- Other verification options on vScrawl include email one-time passcodes, SMS codes and access codes.
Learn more on the Signer Authentication page.
Access control and identity
- Role-based access. Restrict documents, templates, workflows and admin settings by role and permission.
- Single sign-on. SAML 2.0 and OIDC SSO connect vScrawl to your identity provider. SSO is part of the Enterprise plan.
- Central administration. Enterprise admins manage users, roles and permissions from one console, and can set multi-factor authentication and access rules across the organization.
- Tenant separation. Logical access controls keep each customer’s accounts and data separate.
- Internal access. vScrawl limits administrative and operational access by job role. Access to operational logs is restricted to authorized staff.
Document integrity
- Completed documents carry tamper-evident seals. Digital certificates and cryptographic hashing help show whether a document changed after signing.
- Supported workflows can keep certificate, timestamp and revocation information, so a signature can be checked later.
Where your data lives
- Choose data storage in the US, the EU, Canada or Australia.
- vScrawl can run in the cloud, on-premise or in a hybrid setup. In the cloud, established infrastructure providers supply physical security. For on-premise setups, you share responsibility for the infrastructure.
- Backups may be encrypted, access-restricted and stored separately from live data. Backup schedules and retention vary by plan, deployment and agreement.
How we build and run vScrawl
- Secure development. Controlled source-code access, peer review, dependency management, testing and risk-based fixes.
- Security testing. Testing may include automated scanning, manual review, dependency analysis, configuration review and penetration testing. Findings are prioritized by risk.
- Threat prevention. Network filtering, protection against common injection and scripting attacks, rate limiting, session controls and measures against denial-of-service and automated abuse.
- Monitoring. Service and security events are monitored, and alerts flag unusual activity.
- Incident response. vScrawl has procedures to triage, contain, investigate and resolve incidents. It notifies affected customers or authorities where law or contract requires, then reviews and improves its controls.
Payments
Where paid plans are offered, an authorized third-party payment provider processes card payments. Full card details are handled by that provider, not stored in the main vScrawl application.
Availability
vScrawl uses practices such as service redundancy, health monitoring, controlled failover and recovery procedures, depending on the deployment. Any uptime commitment applies only where it is stated in a signed service-level agreement.
Your part in security
Security is shared. vScrawl protects the platform. You protect your users, devices and settings.
- Use strong passwords and turn on multi-factor authentication.
- Give each user only the access they need, and remove users who leave.
- Protect API keys, tokens and webhook secrets.
- Choose signer authentication that fits the transaction.
- Report suspected misuse or compromised credentials quickly.
Report a security concern
Email info@dictalabs.com with enough detail to reproduce the issue. Please do not access data that is not yours, disrupt the service, run destructive tests or disclose the issue publicly before we review it.
FAQ
Is my data encrypted?
Yes. Documents are encrypted at rest and in transit with AES-256 encryption.
Can I choose where my data is stored?
Yes. You can choose storage in the US, the EU, Canada or Australia.
Can we use our own identity provider?
Yes. vScrawl supports SAML 2.0 and OIDC single sign-on on the Enterprise plan.
Do you offer an uptime guarantee?
Only where one is written into a signed service-level agreement.
Does vScrawl hold SOC 2 or ISO 27001 certification?
vScrawl does not claim third-party security certifications on this site. This page describes the controls vScrawl applies. For a security questionnaire, contact info@vscrawl.com.
