Security Center

Every signature on FaydaSign is anchored to a verified Fayda national identity. We use the Fayda eSignet OIDC service (Authorization Code + PKCE, RS256 client assertion) to authenticate users. During verification, you are redirected to the official Fayda portal — FaydaSign never sees your national ID credentials.

After verification, your legal full name, date of birth, gender, and a pseudonymous subject identifier (faydaSubjectId) are stored in your account. This identifier is used to link your verified identity to every document you sign, providing non-repudiation guarantees that hold up to legal scrutiny.

Recipients signing documents also complete Fayda verification before their signature is accepted, and their verification status is recorded immutably in the document audit trail.

In transit — all communication between clients and FaydaSign servers is encrypted with TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enforced to prevent downgrade attacks.

At rest — the Neon PostgreSQL database and Vercel Blob storage are encrypted at rest by the underlying cloud infrastructure using AES-256.

Document confidentiality — all documents are stored in private Blob storage. Presigned URLs are never issued; documents are served exclusively through authentication-gated API routes that verify session ownership or signing token validity on every request.

SHA-256 hashing — every document receives a SHA-256 hash at upload. The hash is stored in the database and embedded in the sealed PDF. The public verification portal allows anyone to verify a document by pasting its Document ID or uploading the file — the file is hashed in the browser and compared server-side, so the file itself never leaves your device during verification.

PAdES digital signatures — completed documents are cryptographically signed using a platform-issued PAdES-B-T certificate chaining to a FaydaSign Root CA. The signature covers the entire byte range of the PDF, making any post-signing modification immediately detectable by any compliant PDF reader.

Audit trails — every lifecycle event (document created, sent, viewed, signed, declined, completed) is recorded with actor identity, IP address, user agent, Fayda verification status, and timestamp. Audit records are append-only and cannot be deleted.

QR verification — sealed documents contain an embedded QR code linking to /verify/<publicId>, enabling offline verification by scanning.

Role-based access control — platform users are assigned one of seven roles: User, Support Admin, Finance Admin, Billing Admin, Compliance Officer, Auditor, and Super Admin. Each role grants a defined set of permissions enforced server-side on every request.

Document ownership scoping — every database query that touches document data is scoped to the authenticated user's ID. There is no public endpoint that exposes document content without valid authentication or a signing token.

Session management — sessions are managed by Better Auth with server-side session records. Sessions expire after 30 days of inactivity and are invalidated on sign-out across all devices.

Admin audit log — every privileged administrative action (role changes, subscription overrides, payment refunds, plan edits) is recorded in a tamper-evident admin audit log with actor, old value, new value, IP address, and timestamp.

Secure hosting — FaydaSign is deployed on Vercel's edge infrastructure. All environment variables (database credentials, signing keys, API secrets) are stored as encrypted environment variables and are never exposed in client-side code.

Webhook verification — incoming Chapa payment webhooks are verified against an HMAC-SHA256 signature using a shared secret before any payment state is updated.

Dependency management — the platform's dependency tree is audited regularly. Critical security patches are applied within 24 hours of disclosure.

Monitoring — server-side errors, authentication failures, and Fayda verification failures are logged and monitored. The admin portal includes a live system health panel showing database latency, failed job counts, and queue status.

We take security reports seriously. If you discover a vulnerability in FaydaSign, please disclose it responsibly:

• Email security@faydasign.com with a description of the issue and steps to reproduce it.
• Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and issue a fix (typically 90 days).
• Do not access, modify, or exfiltrate data belonging to other users during your research.

We will acknowledge receipt within 48 hours and keep you informed of our progress. Researchers who report valid vulnerabilities in good faith will be credited in our security acknowledgements.