EN
Book a demo
Security and trust

Security that passes the review of IT, legal and auditors

DigiSign keeps signed contracts, employment documents and the personal data of the people who sign them. That is why our security is certified, checked by independent auditors and described clearly.

Request the documentsSecurity questions
  • ISO/IEC 27001 Information security
  • ISO/IEC 27017 Cloud service security
  • ISO/IEC 27701 Privacy
  • ISO 22301 Business continuity
  • GDPR Data in the EU
Certification New

One certificate. Now for the cloud services too.

Our information security management system now includes ISO/IEC 27017, the standard for security controls in cloud services.

ISO/IEC 27017 belongs to the ISO/IEC 27000 family and extends ISO/IEC 27001. So we still have one certificate, and its scope now covers the DigiSign cloud services.

What it means for you

  • Independent confirmation that we run the cloud services under internationally recognised security rules.
  • Ready answers for your security team, your data protection officer and your auditors.
  • ISO/IEC 27001

    Information security

    The framework for managing risks and data protection controls, checked by an independent certification body.

  • ISO/IEC 27017

    Cloud services

    Extra controls for the cloud: separation of customers’ data, clear responsibilities of provider and customer, secure return and deletion of data.

  • ISO/IEC 27701

    Personal data

    Personal data is processed securely and in line with regulations such as the GDPR.

  • ISO 22301

    Continuity

    Plans that keep the service available even during unexpected events.

  • ISO/IEC 20000-1

    IT services

    Service management under international best practice.

  • ISO 9001

    Quality

    Continuous improvement and customer satisfaction.

How we protect documents

Protection at every level

  • Encryption and isolation

    • All traffic between browsers and servers is encrypted (HTTPS).
    • Documents are stored encrypted with AES 256.
    • Each customer’s data is kept in a separate repository.
    • Passwords are hashed one way. Nobody can read them, including us.

  • Identity of the signers

    • The recipient is identified by personal ID number, phone or email.
    • With a qualified signature, the trust service provider has verified the signer’s identity.
    • With 1-Click-Sign, the signature follows a code sent by SMS or Viber.
    • The download link of a document can be protected with a password.

  • Role-based access

    • Roles and access for each user.
    • Access to documents and folders is managed separately.
    • One application can serve several organisations with their own users.

  • Audit trail

    • Every action is recorded in a separate database (audit log) with strict access control.
    • For each request you can see how far it has got and who has signed.
    • The signed document carries its signatures and can be verified by any recipient.

  • Infrastructure

    • Our primary data centre is Equinix IBX in Sofia.
    • Distributed architecture with containers.
    • Your data stays in the European Union.

  • Backups

    • The database can be restored to any point in time.
    • Weekly backups are kept in a separate secure location.
    • Business continuity is certified under ISO 22301.
Personal data

GDPR from day one

  • You are the data controller and we are the processor. We sign a data processing agreement (DPA).
  • Our privacy information management system is certified under ISO/IEC 27701.
  • Data is stored in the European Union.
  • When the service ends, all data is deleted and the deletion is documented.
  • GDPR liability and professional liability insurance from Colonnade Insurance S.A. for Europe (excluding Russia and Belarus).
Privacy policy
Your settings

You set the rules

Your administrators configure DigiSign to match your internal rules, without waiting for us:

  • which signing channels are allowed;
  • the default signing deadline;
  • user roles and access;
  • organisations, notifications, document types and tablets.
See how in the manual (in Bulgarian)

In the cloud or on your premises

  • DigiSign SaaS

    Standard installation on shared infrastructure, with guaranteed separation of each customer’s data and access.

  • DigiSign SaaS Private

    Installation in the IBS Bulgaria cloud on resources reserved for you. For organisations that want a cloud solution with full isolation of access and data.

  • DigiSign On-Prem

    Installation in your own infrastructure for the highest level of control, with flexible licences based on load and volume.

Both SaaS options are within the scope of the ISO/IEC 27001 and ISO/IEC 27017 certification.

Documents for your review

For your IT security team, your data protection officer and public tenders.

  • ISO/IEC 27001 (with ISO/IEC 27017), ISO/IEC 27701, ISO 22301, ISO/IEC 20000-1 and ISO 9001 certificates
  • Data processing agreement (DPA)
  • List of subprocessors
  • Answers to a supplier security questionnaire
Request the documents

Found a vulnerability?

Write to support@digisign.space with the subject “Security”. Describe the problem and how to reproduce it. Please do not publish details before we have fixed it.

support@digisign.space

Security questions

All questions
Where is our data stored?

Our primary data centre is Equinix IBX in Sofia, in the European Union. Backups are kept in a separate secure location. Details are on the Security page.

How are documents protected?

All documents are stored encrypted with AES 256, and data between browser and servers is encrypted in transit. Access can be set up with two-factor authentication, depending on the customer’s infrastructure.

What does the ISO/IEC 27017 certification mean?

ISO/IEC 27017 is the standard for security controls in cloud services. It extends ISO/IEC 27001, so we still have one certificate, and its scope now covers the DigiSign cloud services too.

For you it is independent confirmation that we run the cloud services under internationally recognised rules. When your security team or auditors review your suppliers, the certificate answers many of their questions.

Are actions in the system logged?

Yes. All user actions are recorded in a separate database (audit log) with strict access control. For each signature request you can see how far it has got and who has signed.

What happens to our data if we end the service?

All data is deleted, with a record of the deletion, immediately after the service ends.

Which documents can we get for a supplier assessment?

The ISO/IEC 27001 (with ISO/IEC 27017 scope), ISO/IEC 27701, ISO 22301, ISO/IEC 20000-1 and ISO 9001 certificates, a data processing agreement (DPA), the list of subprocessors and answers to a security questionnaire. Write to us.

See DigiSign in action

Send yourself a sample document and sign it, or book a demo with our team.

Try it yourselfBook a demo