Security

How we protect your clients’ data.

TitleMagic protects client data with AES-256-GCM encryption at rest for sensitive fields and documents, Magic Links that expire after 7 days, masked values with logged reveals, and a full signing audit trail. This page explains each control in plain language.

Encryption

  • All traffic to TitleMagic is served over HTTPS (TLS).
  • Sensitive fields (Social Security numbers, bank account and routing numbers, tax ID numbers and other fields marked sensitive) are encrypted at the field level with AES-256-GCM before they are stored.
  • Documents clients upload, such as a driver’s license or formation documents, are encrypted with AES-256-GCM on disk. They have no public URL and can only be downloaded by a signed-in user of the company that sent the form.
  • The encryption key is stored separately from the database.

Magic Links

  • Every Magic Link is unique to one signer and one form.
  • Links expire after 7 days. A processor can extend a link by 7 more days or resend it; resending issues a new link and the old one stops working.
  • Once a form is signed, its link can no longer be used to view or change the answers.
  • Uploads are only accepted while a link is open, and only PDF, JPG and PNG files up to 10 MB (checked by file content, not by name).
  • Each link keeps a snapshot of the exact form version it was sent with, so later template changes never alter what a client saw or signed.

No sensitive data in email

  • Magic Link emails contain only the client’s name, the form name, your company name, the link and its expiry date. Never form answers or sensitive data.
  • Notifications to processors say who signed and link to the dashboard. They never include form answers.
  • After signing, the client receives an email with a secure link to download their own signed copy (no attachment). The link expires after 30 days, and the copy masks sensitive numbers.

Audit trail

  • Before signing, every signer must agree to a Consent to Electronic Records and Signatures (E-SIGN Act and UETA).
  • For every signature we record the date and time, IP address, browser (user agent), the signature method (drawn or typed), the full legal name typed and the version of the consent text shown.
  • The signed PDF includes every answer, each signature, the audit trail and the consent text. Sensitive values are masked to the last four characters in the PDF.

Access controls

  • Each company’s data is isolated: users only ever see submissions sent by their own company.
  • Accounts have Owner and Processor roles; only Owners can change company settings and billing.
  • In the dashboard, sensitive values are masked (for example ***-**-1234). Revealing a full value takes an explicit click.
  • Every reveal of a sensitive value, every document download and every signed-PDF download is recorded in an access log with the user, time, IP address and browser.
  • Public endpoints (form submission, signed-copy downloads, contact and password reset) are rate-limited.
  • Secure form pages opened from a Magic Link load no analytics, fonts or other resources from third parties.

Retention

  • By default, client data is kept while your account is active. Account owners can instead choose a retention period (for example 1, 3 or 7 years), after which each submission is deleted automatically, optionally keeping an encrypted copy of the signed PDF.
  • Account owners can export all records in one click: signed PDFs, uploaded documents and CSV files of every answer.
  • If your subscription ends, your account stays available read-only for at least 30 days so you can download your records, unsigned links stop working, account owners are emailed reminders, and submission data and documents are permanently deleted 90 days after cancellation.

Vendor due diligence

Title and settlement companies following the ALTA Title Insurance and Settlement Company Best Practices review how their vendors protect nonpublic personal information. You are welcome to use this page as part of that review, and to contact us with your questionnaire.

TitleMagic does not currently hold third-party security certifications or audit reports. This page describes our controls; it is not a certification.

Report a security issue

If you believe you have found a security vulnerability in TitleMagic, please email security@gettitlemagic.com with “Security report” in the subject line and enough detail for us to reproduce it.

Please do not access, change or delete data that isn't yours while testing. For how we handle personal information, see our Privacy Policy.