Security posture
Security
How Affixsign protects agreements and the people named in them.
Authentication
Password authentication with leaked-password checking, optional authenticator-app MFA, throttling and lockout after repeated failures, and idle session expiry.
Authorisation
Roles are stored separately from profiles and checked on the server. Row level security isolates every organisation's data.
Secrets
Credentials live only in protected server-side secret storage. They are never shipped to the browser or written to logs.
Auditability
Governance and access decisions are written to an append-only audit log with correlation identifiers.
Reporting an issue
Email security@affixsign.com. We acknowledge reports and rotate any potentially exposed credential before investigating.