Trust

Security, from upload to signed.

What happens to a document between upload and executed copy - encryption, access control and a complete audit trail.

Every action recorded

Consent, intent and signature association captured on every signing event.

Who viewed, who signed, when and from which IP - sealed with the final document.

Documents encrypted at rest and in transit, access controlled row by row.

Signing tokens are unique per recipient, time-limited and burned after use.

Every signature Lucid Signing captures is built on three things, recorded automatically:

Explicit consent - signers confirm they intend to sign before a signature is applied.
Identity association - each signature is tied to a named recipient and a unique, single-use link sent to their email.
Integrity- the signed record, the signer’s actions and the final document are sealed together.

Every document accumulates an immutable event log:

Created, sent, viewed, signed, declined, completed, downloaded, voided.
Each event stores the actor’s email, IP address, browser user agent and a UTC timestamp.
The trail is stored separately from the document and cannot be edited from the application.

Row-level security in Postgres: owners see only their own and their team’s documents.
Signers never receive accounts - access is exclusively via an expiring, single-use token.
Tokens are 256-bit random values, invalidated on signing or expiry.
All security-sensitive operations run server-side; nothing trusts the browser.

TLS for all traffic; encryption at rest for documents and signatures.
POPIA-aligned processing - see our Privacy Policy.
Payments handled by a PCI DSS-compliant payment processor; card details never touch our servers.

Found a vulnerability? Email info@lucidsigning.com. We acknowledge reports within one business day and do not pursue good-faith researchers.

Every document you send carries a complete, tamper-evident record of who signed, and when.