eSignature
SignWell is compliant with the strictest electronic signature laws:
a) EU Electronic Identification and Authentication Services Regulation (910/2014/EC), commonly referred to as eIDAS, which took effect on July 1, 2016, and replaced both the EU Directive on Electronic Signatures 1999/93/EC and other EU member state laws that were inconsistent with eIDAS;
(b) Electronic signatures in the Global and National Commerce Act, which is commonly known as the ESIGN Act of 2000 (US law); and
(c) The Uniform Electronic Transactions Act, also known as the UETA of 1999 (US law).
SOC 2 Type II
SignWell is SOC 2, Type II (Security, Availability, and Confidentiality) compliant.
What is SOC 2, and why is it important?
Systems and Organizations Controls (SOC) is an audit methodology and reporting framework developed by the American Institute of Certified Public Accountants (AICPA). The requirements for security, availability, and confidentiality are detailed in the Trusted Services Criteria document by AICPA.
To become compliant and achieve certification by an independent, third-party security-specialized CPA company, SignWell’s technical solutions, safeguards, and procedures have been audited.
While security and protecting our customers’ data are always our focus, during the rigorous audit, SignWell has provided evidence of its implemented security solutions and data protection methodology, demonstrating our commitment to providing a reliable and secure electronic signature platform.
Please contact @signwell.com to request SignWell's most recent SOC 2 report.
HIPAA
SignWell is HIPAA compliant.
What is HIPAA, and why is it important?
The Health Insurance Portability and Accountability Act is a US law that sets rules and requirements for the management and protection of health-related personal information, often called personal health information (PHI) or electronic personal health information (ePHI).
SignWell has implemented the safeguards required by the law and has been audited by a third-party, checking our with the requirements, and the effectiveness of the implemented controls and procedures. SignWell has met or exceeded requirements related to HIPAA .
GDPR
SignWell is GDPR compliant.
The General Data Protection Regulation is an EU law that is relevant to everyone living in the EU or managing the data of persons from the EU. The law sets out the principles for companies such as SignWell on how to handle the personal data of users, and it requires the protection of personal data.
SignWell has implemented these requirements and is compliant with all the principles of the GDPR. To learn how we use your data to provide services for you and your rights as an EU user regarding your personal data, please review the details on our privacy page: https://www.SignWell.com/privacy/
NOM-151
For businesses operating in Mexico, SignWell supports NOM-151 compliance through our partnership with SeguriData, an accredited Prestador de Servicios de Certificación (PSC).
Every completed document can include a NOM-151 preservation certificate, providing verifiable proof that the file has not been altered after signing. This ensures your agreements are legally admissible under Mexican law.
21 CFR Part 11 Compliance
SignWell includes a dedicated 21 CFR Part 11 mode for organizations in regulated industries such as pharmaceuticals, biotechnology, and medical devices. Part 11 mode is a workspace-level setting available on the Business plan that adds specific technical controls to every document created in that workspace.
When Part 11 mode is enabled, all signers must authenticate using a one-time passcode (OTP) sent to their email before they can view or sign a document. Two signing modes are available: Streamlined Signing, where signers authenticate at document open and again at completion, and Per-Signature Authentication, where signers authenticate at every individual signature field. In both modes, signers must select a signing reason for each signature and initials field.
Completed Part 11 documents are sealed as a single PDF package containing the signed document (with the signer’s name and field IDs linking each signature to the record), an Electronic Signature Details page listing each field’s signer, reason, and timestamp, and a full audit trail - all certified with an Adobe-trusted digital certificate. Features that could weaken compliance controls - such as unsigned link sharing, self-signing, in-person signing, and recipient reassignment - are automatically disabled. Session timeout controls are in place.
SignWell also provides validation documentation, including IQ, OQ, and PQ qualification scripts, a Requirements Traceability Matrix, and a Validation Summary Report template, to support customer qualification activities. Part 11 compliance is a shared responsibility: SignWell provides the technical controls, and your organization is responsible for procedural controls, signer identity verification, and final validation.
Financial Services Regulatory Alignment
SignWell is designed to align with the security and recordkeeping expectations that regulated financial institutions in the United States are held to. Regulations such as FINRA, SEC, GLBA, SOX, and FFIEC guidance apply to the institution rather than to any single vendor, but the controls already built into the SignWell platform help firms evidence their compliance posture during internal reviews, external audits, and regulatory examinations.
- FINRA and SEC recordkeeping: tamper-evident audit trails capture timestamps, IP addresses, and signer activity for every document.
- GLBA-aligned data protection: AES-256 encryption at rest, TLS 1.2 in transit, and role-based permissions protect nonpublic personal information.
- SOX internal controls: access logs, full document history, and SOC 2 Type II audited processes support the evidence trail public companies need.
- FFIEC IT risk guidance: SignWell’s AWS-hosted infrastructure, documented security program, and third-party audits align with FFIEC expectations for vendor risk management.
For institutions that need deeper detail, our SOC 2 Type II report and compliance documentation are available on request at [email protected].
Network and System Security
The SignWell system is well protected, with best-practice security measures in place. When you are using our services—for example, logging in to the website and accessing documents—the connection between your computer and SignWell servers is encrypted using Transport Layer Security (TLS) Version 1.2.
Your data is also encrypted at rest using the AES-256 encryption standard, which the US government uses to protect confidential information.
We continuously update our servers and systems with the latest security fixes, and their effectiveness is regularly validated. The SignWell network environment is monitored, and each network connection is checked for malicious activities (an intrusion detection system).
Our systems and services are placed in AWS data centers using AWS services. AWS data centers provide high-level security, including remote locations, guards protecting the area and buildings, redundant power supply lines, redundant internet connections, and automated fire suppression systems.
Both AWS data centers and services are certified by independent auditors according to ISO 27001 (information security management system), ISO 27017 (information security management systems in the cloud), ISO 27018 (information privacy in the cloud), SOC 2, and HIPAA requirements, meaning that systems operate on certified secure services.
System Reliability
SignWell runs on AWS services using high-availability and fault-resistant solutions. Our systems run across multiple physical locations (so-called availability zones) simultaneously, ensuring that if one zone's services are interrupted (a highly unlikely event), the other zone continues to operate and provide services.
SignWell has created a disaster recovery plan and a business continuity plan that describe, step by step, how to ensure continuous operation. We regularly test scenarios and continually enhance our methodologies to ensure our services remain available to you. Our operations team regularly monitors services and operational KPIs to ensure the highest possible availability.
Data Protection
SignWell is committed to protecting your data and providing a secure service. Additionally, using high-availability servers and encryption at transit and rest, we restrict the who, how, and when of access to production environments.
Employee background checks are conducted in accordance with local laws. We train all employees on security and privacy principles and how to implement them in our environments.
Access to customer data is limited to employees who need it and only when they need it (for example, for troubleshooting). All access and activity is logged and monitored. User accounts and access levels are reviewed regularly.
All systems in the production environment are configured to provide the highest level of security. To ensure this, we use security checks and automated update tools.
