GDPR / UK GDPR
AvailableOperational privacy programme: DPA, ROPA, DPIA, DSAR and breach procedures.
Processor role for signing workflows under customer instruction; controller for accounts, billing, and platform security.
View details →Compliance
Honest status — we publish what is operational today and what is still on the certification path. We do not claim ISO 27001 or SOC 2 until reports exist.
eIDAS & UK electronic signatures
AvailableProduct supports SES, AES, and QES via QTSP partners — eIDAS-aligned, not “eIDAS certified”.
QES via eID Easy; UK AES via OneID (DIATF Medium) with PAdES sealing. Customer selects the right signature level.
View details →UK DIATF (via OneID)
AvailableBank-verified UK identity through OneID, certified under the UK Digital Identity and Attributes Trust Framework.
View details →EU AI Act Art. 50
In progressTransparency mapping for Aria / Sentinel published; counsel review of messaging still open.
View details →ISO 27001:2022
In progressISMS policies, scope, risk register, and operating model in place. Certification audit not started.
Target: Stage 1 ~Month 10 of the compliance programme; certificate ~Month 18.
SOC 2 Type I / II
In progressControl design and evidence logging underway. No SOC report available yet.
Target: Type I ~Month 9; Type II after observation period (~Month 18). Reports will be shared under NDA.
NIS2 / DORA (customer support)
AvailableWe help in-scope customers meet supplier due-diligence expectations; we do not claim entity certification under NIS2 or DORA.
View details →HIPAA
Out of scopeDefault out of scope — no PHI, no BAA unless expressly agreed in writing.
View details →Security controls
Product and operational controls that prospects ask about in due diligence.
infrastructure
Encryption in transit (TLS)
HTTPS / TLS enforced for application and API traffic.
infrastructure
Encryption at rest
AES-256 class encryption for stored documents and database volumes (AWS).
product
Document integrity hashing
SHA-256 hashing and tamper-evident signed artifacts.
product
Cryptographic PDF signatures (PAdES)
AES/QES flows embed signatures in the PDF — not audit-trail only.
product
Audit trail & SCCR
Per-document event log, Signer Completion Certificate, and evidence pack export.
product
Identity verification tiers
Email/SMS OTP, OneID (UK DIATF), eID Easy national eID / QES.
product
Admin MFA
TOTP required for organisation admins and platform staff consoles.
privacy
DSAR tooling
Org-level DSAR register, 30-day SLA tracking, and export packs.
privacy
Retention & legal hold
Configurable retention, pre-purge notices, per-document legal hold.
infrastructure
EU data residency (primary)
Primary hosting on AWS eu-west-1 (Ireland) with published sub-processors.
privacy
Breach notification procedure
GDPR Art 33–34 playbook targeting 72-hour supervisory authority notice where required.
operations
Change management
Release checklist and production change log for SOC 2 CC8-style evidence.
operations
Access reviews
Quarterly access review log established.
operations
Incident response tabletop
IR plan drafted; first tabletop exercise in progress.
operations
Backup / DR restore drill
BCP documented; first RDS restore drill scheduled.
operations
External penetration test
Annual external pentest planned; report will be available under NDA.
operations
Vendor SOC / ISO collection
Collecting current SOC 2 / ISO reports from key sub-processors.
Resources
Public policies and legal docs are linked below. Certification reports will be shared under NDA when available.
Privacy Policy
AvailablePublicHow we collect and use personal data.
Terms & Conditions
AvailablePublicCustomer terms, acceptable use, and eIDAS disclaimers.
Data Processing Agreement
AvailablePublicGDPR Art 28 processor terms for signing workflows.
Pricing & Commercial Terms
AvailablePublicPlans, meters, prepaid credits, billing.
Refund Policy
AvailablePublicStandalone refund rules — seven-day unused window and chargebacks.
Cookie Policy
AvailablePublicCookies, analytics, and consent.
Minimum Compliance Pack
AvailablePublicGDPR / privacy / eIDAS baseline checklist.
Record of Processing Activities (ROPA)
AvailablePublicArt 30 processing records (controller + processor).
Platform DPIA
AvailablePublicHigh-risk processing assessment — IDV, eWitness, AI.
eIDAS Compliance Guide
AvailablePublicSES / AES / QES guidance for customers and teams.
EU AI Act Art. 50 Transparency Guide
AvailablePublicHow Aria and Sentinel meet transparency duties.
Information Security Policy
AvailablePublicMaster ISMS policy — objectives, roles, principles.
Full Policy Library
AvailablePublicSecurity, privacy, engineering, and people policies.
Sub-processor register
AvailablePublicVendors that process customer data on our behalf.
SOC 2 Type II report
PlannedNDAWill be available to qualified prospects under NDA once issued.
ISO 27001 certificate
In progressNDACertification programme in progress — certificate not yet issued.
Penetration test summary
PlannedNDAExternal pentest report summary under NDA after first engagement.
Security questionnaire / CAIQ
AvailableOn requestEnterprise due-diligence pack — request from security.
Subprocessors
Key vendors that process customer data. Full register and notification rules are in the DPA.
Changes are notified per DPA (typically 30 days). Questions: legal@touch2sign.com
Certification roadmap
From the 18-month SOC 2 / ISO programme — public milestone view.
Policies v1.0 + ISMS scope
Target: Jul 2026
Customer legal pack (Privacy, Terms, DPA, Refunds)
Target: Aug 2026
ROPA + DPIA published
Target: Aug 2026
IR tabletop exercise
Target: Q3 2026
RDS restore drill
Target: Q3 2026
External penetration test
Target: Month 5
SOC 2 Type I
Target: Month 9
ISO 27001 Stage 1
Target: Month 10
SOC 2 Type II + ISO certificate
Target: Month 18
Deeper programme docs (internal): Compliance Programme Hub · Product security deep-dive
Questions for security or procurement?
We can walk through architecture, data flows, sub-processors, and the certification roadmap. Request questionnaires or NDA documents from the security mailbox.