RU Sign
Security and privacy
The real measures that protect your documents at every step.
RU Sign protects your documents and information at every step. Here, in full transparency, are the actual measures we apply.
AES-256 encryption
Documents are encrypted at rest on the server with the AES-256-GCM algorithm. Users' sending keys are encrypted too.
SHA-256 fingerprint
A SHA-256 fingerprint of the document lets you verify it has not been changed after signing.
HMAC seal
An HMAC seal, computed with a secret key kept on the server, protects each document against tampering.
Independent timestamp
Each signature is dated by an independent timestamping authority, following the RFC 3161 standard.
Hosting in Canada
Your data is hosted in Canada, with a Canadian host. It does not leave the country.
Designed according to the LCCJTI
The signing process is designed according to the Quebec legal framework (LCCJTI) and accompanies each signature with a verifiable certificate.
Audit trail and certificate
Every action on a document (sending, access, signing, sealing) is recorded in a timestamped audit log. A verifiable certificate, given to the parties, summarizes the proof of the transaction.
Privacy
We collect only what is needed for signing and its proof: name, email, IP address and timestamp. We do not sell this information.
Read the privacy policy →In all honesty
We describe here what our system actually does. RU Sign does not yet hold an external certification such as SOC 2; the measures above are technical protections we apply and keep improving.
Report a security issue
If you believe you have found a security flaw, write to us. We take every report seriously and respond promptly.