Enterprise-Grade Security
Your documents contain sensitive information. We protect them with bank-level security, ensuring your data remains confidential and tamper-proof.
End-to-End Encryption
All documents are encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Your data is protected at every step.
Secure Infrastructure
Hosted on enterprise-grade cloud infrastructure with SOC 2 Type II compliance, regular penetration testing, and 24/7 monitoring.
Access Controls
Role-based access control, multi-factor authentication, and SSO integration ensure only authorized users access your documents.
Audit Trails
Complete, immutable audit logs track every action on your documents - who viewed, signed, or modified, with timestamps and IP addresses.
Team Security
Manage team permissions, enforce security policies, and maintain visibility over all document activities in your organization.
Data Residency
Choose where your data is stored. We offer regional data centers to help you meet local data residency requirements.
Compliance & Certifications
Evidence Act 2011
Nigeria
NDPA
Nigeria Data Protection
GDPR
European Union
SOC 2 Type II
Security Controls
Data Encryption
We use industry-leading encryption standards to protect your data:
- In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 with perfect forward secrecy.
- At Rest: Documents and sensitive data are encrypted using AES-256 encryption with unique encryption keys per organization.
- Key Management: Encryption keys are managed using hardware security modules (HSMs) with strict access controls.
Infrastructure Security
Our infrastructure is designed with security as a foundational principle:
- Hosted on SOC 2 Type II certified cloud infrastructure
- Network isolation with firewalls and intrusion detection systems
- Regular vulnerability scanning and penetration testing
- Automated security patching and updates
- DDoS protection and rate limiting
- Geographic redundancy and disaster recovery
Application Security
We follow secure development practices throughout our software lifecycle:
- Secure coding standards and code review processes
- Static and dynamic application security testing (SAST/DAST)
- Dependency vulnerability monitoring
- Input validation and output encoding to prevent injection attacks
- CSRF and XSS protection on all endpoints
- Regular third-party security audits
Authentication & Access Control
We provide multiple layers of authentication and access control:
- Multi-Factor Authentication (MFA): Optional MFA for all accounts, with enforcement available for enterprise plans.
- Single Sign-On (SSO): SAML 2.0 and OAuth integration with your identity provider (Okta, Azure AD, Google Workspace, etc.).
- Role-Based Access Control: Granular permissions to control who can view, create, send, and manage documents.
- Session Management: Automatic session expiry, concurrent session limits, and secure session handling.
Document Integrity
We ensure the integrity and legal validity of your signed documents:
- Digital Signatures: Cryptographically signed documents that detect any tampering or modification.
- Certificate Embedding: Signed PDFs include embedded certificates for long-term validation.
- Audit Trails: Comprehensive logs of all document activities, including IP addresses, timestamps, and user agents.
- Evidence Act Compliance: Documents meet the requirements of the Nigeria Evidence Act 2011 for electronic signatures.
Operational Security
Our team follows strict security practices:
- Background checks for all employees with access to customer data
- Security awareness training for all staff
- Principle of least privilege for system access
- Incident response plan with 24/7 on-call security team
- Regular security drills and tabletop exercises
Reporting Security Issues
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:
Security Team
Email: security@wegosign.com
We aim to respond to security reports within 24 hours and will work with you to understand and address the issue promptly.