Access control policy

• Each company’s data is separate from every other company’s.
• People get the access their role needs and no more.
• Access to sensitive values is deliberate and recorded.

• Owner: manages settings, billing, team members, templates, data retention and bulk exports, and can do everything a Processor can.
• Processor: sends forms, resends links, views company submissions, reveals sensitive values (recorded) and downloads signed PDFs. A Processor cannot change company settings, billing, templates, team members or retention, and cannot bulk-export.

Role limits are enforced on the server, not just hidden in the screen. Owners can invite and remove team members at any time.

• Email and password, or Google Sign-In. Passwords are stored only as salted hashes.
• Optional two-factor authentication (authenticator app plus single-use backup codes). An Owner can require it for the whole company.
• Sessions expire after seven days. Signing in from a new device or location sends an email to the account holder.

• Clients do not need an account. A Magic Link is unique to one signer and one form and expires after seven days.
• A company can require an emailed 6-digit code before the form opens.
• Once a form is signed its link can no longer be used to view or change the answers.

• Administration pages are available only to designated administrator accounts and return “not found” to everyone else.
• Administrator accounts must have two-factor authentication enabled before the pages open.
• Administrator actions that change a customer account are recorded in an audit log.

Development and production are separate. The development site uses fake data only and has its own database, encryption key and secrets; none of them are shared with production.

Reveals of sensitive values, document and signed-PDF downloads, exports, CSV downloads and “send to file email” actions are written to an access log with the user, time, IP address and browser before the data is released.