Trust Center
SignNinja is built around encryption in transit and at rest, per-organization tenant isolation, role-based access control, and a tamper-evident, hash-chained audit trail for every sign request. This page explains, plainly, what that means for three frameworks customers ask about specifically — and where a formal agreement beyond the product itself would still be needed.
Designed to support HIPAA
The technical safeguards HIPAA’s Security Rule expects — encryption of data at rest and in transit, access controls tied to individual accounts, and audit logging of who did what and when — are all part of how SignNinja is built, not an add-on. What SignNinja does not yet offer as a standard, self-serve product feature is a signed Business Associate Agreement (BAA), which a HIPAA-covered entity is legally required to have with any vendor handling protected health information. If your use case requires a BAA, contact us to discuss Enterprise.
Designed to support GDPR
Documents and signer data are encrypted, isolated per organization, and subject to retention and deletion controls an organization administrator configures directly — including the ability to delete an organization and its data entirely. This is how SignNinja approaches the data-protection principles GDPR describes, not a completed regulatory certification (no such certification exists for GDPR in the way SOC 2 or ISO 27001 does). A formal Data Processing Agreement for EU customers is not yet a standard part of the product; contact us if you need one.
Designed to support FERPA
FERPA governs how U.S. schools and districts handle student education records. SignNinja’s access controls, audit trail, and tenant isolation apply the same way to a school’s documents as to any other customer’s, and a signer never needs an account of their own to sign — reducing how much personal information the platform has to collect in the first place. A district-specific data-sharing or use agreement, where a school’s policy requires one, is handled through Enterprise rather than the standard product; contact us to discuss it.
Security roadmap
Trust is built in steps. Here is where SignNinja stands and what we are working toward. We list a report or certification here only once it has been completed, and we do not give dates we cannot keep.
In place today
- Encryption in transit and at rest
- Separate data for every organization
- Role-based access and sign-in policies
- Single sign-on (SAML) for Enterprise organizations
- Tamper-evident audit trail for every sign request
- Sealed evidence package for every completed document
Next
- Self-serve data processing agreement
- Public sub-processor list with change notices
- Two-step verification for accounts
Needs outside parties
- Independent security audit (for example SOC 2)
- Business Associate Agreement for HIPAA customers
- Regulated Indian eSign through an authorized provider
Want to know where something stands, or need it sooner for a procurement review? Write to hello@signninja.io.
A note on all of this
SignNinja is not a law firm, and this page is not legal advice. Whether SignNinja meets a specific compliance obligation for your organization depends on your own use case and jurisdiction — we’d always recommend checking with your own counsel for anything high-stakes. If you have questions this page doesn’t answer, reach out at hello@signninja.io.