Security
Built around your Microsoft 365 organization
Your people sign in with the identities you already manage, your documents stay in your own storage, and every action is recorded.
Single sign-on with Microsoft Entra ID
Staff sign in through Microsoft Teams with their existing Microsoft Entra ID accounts. There is no separate password for them to create, reuse or forget.
Access follows your directory: tenant owners decide which users belong to the organization in the admin portal.
Documents stay in your Microsoft 365 storage
Files open from and save back to OneDrive and the Teams and channels the user already has access to, or to the user's own computer.
Your documents remain in your organization's Microsoft 365 storage, under the retention, sharing and access policies you already have there.
Tenant isolation
Each customer organization is a separate tenant. Users, roles, signing requests and activity records are scoped to the tenant they belong to.
Within a tenant there are two roles: Tenant Owners manage users, billing and reports; Users work with documents.
Encryption and document protection
Password protection encrypts PDFs with AES-256 (PDF 2.0, revision 6). You can set an open password and a permissions password that restricts printing, changing, copying, commenting, form filling and page assembly.
Permission restrictions are enforced by PDF viewers; the open password is enforced by the encryption itself.
Redaction that removes content
Redacted pages are flattened when you save, so covered text and images are permanently removed from the file rather than hidden under a box. The remaining text is kept as a searchable layer.
Search and redact finds every match of a word or phrase so nothing is missed.
Audit
A write-only activity log
Every user action, from signing in to opening, saving, redacting or sending a document for signature, is recorded in the activity log.
The log is append-only: entries can be added but not edited or deleted. Each entry includes a hash of the previous one, forming a chain, so any change to past entries can be detected when the chain is verified.
Tenant owners can view activity reports in the admin portal and export them.
Signing certificate and audit trail
When everyone has signed, the completed document includes a certificate of completion. It lists the recipients and the audit trail of the signing process, such as when the request was sent, viewed and signed.
The certificate records SHA-256 fingerprints of the document, so anyone can check that a copy matches the document that was signed.
Signing invitations are sent from the sender's own Microsoft 365 mailbox, so recipients see a familiar sender.
Security questions?
If your review needs more detail, get in touch and we'll answer what we can.
Bring PDF work into Teams
Create your organization, choose a plan and connect Microsoft 365. Your team signs in through Teams with the accounts they already have.