Canada-hosted primary data
Dash Sign is designed around Canadian data residency for primary application data and document storage, with supporting vendors disclosed where they process limited operational data.
Security & Trust Overview
Security that helps firms answer the uncomfortable question: prove it.
Dash Sign helps firms show who accessed a document, who signed it, when it happened, and where the completion evidence lives. Formal certification or agreement requirements can be scoped when a client or procurement process requires them.
Last updated: May 4, 2026
Audit-ready signing evidence
Completed agreements are supported by timestamped signing events, signer identity metadata, IP and device context, document status history, and completion records.
Private document access
Documents are stored privately and shared through permissioned workflows, app-level authorization, and time-limited access patterns wherever possible.
Security control mapping
Dash Sign is built with documented security controls for access, retention, monitoring, and evidence review. Custom deployments can include additional control mapping when required by a client or procurement process.
Regulated workflow review
For regulated or healthcare-adjacent workflows, Custom deployments can include retention review, access governance, and agreement support where required before sensitive data is handled.
Control posture
Proof beats badges when a file is questioned.
If a client, manager, auditor, or counterparty asks what happened, your team should not be piecing the answer together from inboxes and downloads.
Evidence-scoped claims: We describe documented controls, audit-ready records, and review paths clearly without implying a formal certification unless that review has been completed.
Encrypted transport for app traffic and document access
Private storage buckets for original and completed PDFs
Role-based access boundaries for users, teams, templates, and settings
Signer event logging with timestamp, IP metadata, and user-agent context
Certificate/evidence package for completed documents
Short-lived signed URLs for sensitive file delivery where applicable
Database isolation controls and least-privilege access patterns
Operating procedures for monitoring, backups, and incident response
Retention defaults designed for professional and regulated workflows
Custom agreement review path for regulated deployments
Customer assurance
Answers buyers ask before they trust a signing layer.
Can Dash Sign support security review?
Dash Sign maintains documented security controls and can support additional control review for Custom deployments. Any formal certification requirement is scoped only when a client, enterprise buyer, or procurement process requires it.
Can Dash Sign support regulated workflows?
Custom deployments can be reviewed for regulated workflows with access governance, retention review, audit evidence, and agreement support where required. We scope requirements during the workflow review before handling sensitive information.
Can we review Dash Sign's security posture before signing?
Yes. Prospective customers can review this Security & Trust overview and request additional security details during demo or procurement conversations.
Where is data hosted?
Dash Sign is designed for Canadian professionals, with primary data and document storage configured for Canadian-hosted infrastructure. Some support services such as email, SMS, analytics, or error monitoring may process limited operational data outside Canada.
What evidence exists after a document is signed?
Dash Sign records signer activity, timestamps, status changes, IP/device context, and completion details so teams can answer client, lender, and compliance questions without hunting through inboxes.
Controls roadmap
We keep the MVP lean while preserving an enterprise path. Security controls continue to improve, but formal security certification and regulated-workflow operating procedures are scoped when client requirements make them commercially necessary.
01
Formal vendor-risk questionnaire package
02
Expanded admin audit-log export
03
Security incident and breach-response playbook
04
Security evidence package for Custom clients
05
Regulated workflow checklist and agreement support path for eligible Custom workflows
06
Formal security certification path if required by a signed client opportunity
Canada-focusedPrivate storageSigner metadataPermissioned accessLeast privilegeTimestamped records