Scriptia handles contracts and personal data, so security is built into how it runs, not added later. This page explains, in plain terms, where your documents live, how they are protected and what we do not offer yet. If your IT or legal team needs more detail, write to support@scriptia.eu.
Where your data lives
- All accounts, documents and signed PDFs are stored on Oracle Cloud in Frankfurt, Germany, inside the European Union.
- Backups are kept in a separate Oracle storage bucket, also in Frankfurt.
- The only other services involved are listed in the Privacy Policy: Brevo (France) delivers emails, and Cloudflare Turnstile checks that sign-ups come from people.
- No advertising, no tracking cookies, no analytics, and no selling of data.
Encryption
- In transit: every connection uses HTTPS with TLS 1.3 or 1.2 only. Older protocols are refused, and browsers are told to always use HTTPS (HSTS).
- At rest: the server disk is encrypted by the cloud provider. Sensitive account secrets, such as two-factor keys, are also encrypted inside the database with a key held only by Scriptia.
- Backups: the off-site copy is encrypted before it leaves the server. The key to read it is not stored on the server or in the cloud.
Every signed document is sealed
- When the last person signs, the PDF is sealed with Scriptia's digital certificate (PAdES). Any later change to the file breaks the seal and shows in PDF readers.
- A trusted timestamp from an independent authority (DigiCert or Sectigo) records exactly when it was sealed.
- A signing certificate is attached with each signer's name, email, time and the document's SHA-256 fingerprint.
- The sender can require signers to enter a one-time code sent by email before they can open and sign.
Your account
- Email confirmation and a bot check at sign-up.
- Two-factor authentication with an authenticator app, plus recovery codes.
- Passkeys (fingerprint, face or security key) as a passwordless option.
- A list of active sessions you can sign out remotely, and a log of security events on your account.
- Passwords are stored only as salted hashes, never in readable form.
The server
- Only web traffic (ports 80 and 443) is open to the internet. The database, email and file-conversion services are not reachable from outside.
- Administrator access needs a private key; passwords and the root account are disabled for remote login, and repeated failed attempts are blocked automatically.
- Security updates for the operating system are installed automatically every day.
- Each part of Scriptia runs in its own isolated container.
- Strict browser security headers protect against clickjacking, script injection and data leaking to other sites.
Backups and recovery
- A full backup is taken every night. The last 14 days are kept on the server, and every backup is also copied off the server, encrypted.
- Restoring from a backup has been tested.
- Every signed PDF can be downloaded at any time, so you can keep your own copy.
Open and checkable
- Scriptia is built on Documenso, an open-source signing platform, and its code is public under the AGPL licence. Anyone can review how it works.
- Public scans give the site top grades: A+ on Mozilla Observatory and A+ on Qualys SSL Labs (November 2026). You can run them yourself: Observatory, SSL Labs.
- Dependencies are checked for known vulnerabilities and updated.
What we do not offer yet
We would rather tell you than have you find out:
- Signatures are at the eIDAS simple level, sealed and timestamped. Scriptia does not issue advanced or qualified signatures.
- Scriptia has no ISO 27001 or SOC 2 certification.
- It runs on a single server. It is backed up every night, but there is no automatic failover and no guaranteed uptime.
- Sign-in with Microsoft or Google is not switched on yet.
Reporting a security problem
If you think you have found a vulnerability, please email support@scriptia.eu with the details and give us reasonable time to fix it before making it public. Please do not access other people's data or disrupt the service while testing. Our contact details are also published at /.well-known/security.txt.