Your Data, Encrypted

    How we protect your information with end-to-end encryption

    End-to-End Encryption

    At Signhoot, we use end-to-end encryption to ensure that your sensitive information, including signatures, remains private and secure. Even we cannot access your encrypted data without your encryption keys.

    Our platform uses the Web Crypto API with AES-GCM 256-bit encryption, which is a military-grade encryption standard. This means your data is scrambled in a way that makes it impossible to read without the correct decryption key.

    How Our Encryption Works

    Key Generation

    When you first use Signhoot, a unique encryption key is generated for your account using the Web Crypto API. This key is derived using PBKDF2 (Password-Based Key Derivation Function 2) with 100,000 iterations and a random salt, making it extremely resistant to brute force attacks.

    Local Storage

    Your encryption key is stored securely in your browser's local storage. It never leaves your device and is never transmitted to our servers. This is a critical part of our "zero-knowledge" approach.

    Data Encryption

    Before any sensitive data (like signatures) is sent to our servers, it's encrypted on your device. We use AES-GCM (Advanced Encryption Standard with Galois/Counter Mode), a highly secure encryption algorithm that provides both confidentiality and data integrity.

    Server Storage

    On our servers, we only store the encrypted version of your data. Without your encryption key, this data is just a series of random characters that cannot be deciphered, even by us.

    Why We Can't Access Your Data

    Signhoot employs a "zero-knowledge" architecture, which means we have zero knowledge of your encryption keys or the contents of your encrypted data. Here's why this matters:

    • Your encryption keys are generated and stored only on your device
    • Data is encrypted before it leaves your device using these local keys
    • We only store the encrypted data, never the encryption keys
    • Without the keys, the encrypted data is impossible to decrypt
    • Even if legally compelled, we cannot provide your unencrypted data to anyone
    • If you lose your encryption keys, we cannot recover your data

    Important Note

    Because we use client-side encryption with keys stored locally, it's important to remember that if you clear your browser data or switch to a new device, you may lose access to your encrypted data. We recommend backing up your important documents separately.

    Technical Details

    For those interested in the technical implementation, our encryption uses:

    • Web Crypto API - A standardized browser API for cryptographic operations
    • AES-GCM 256-bit encryption - A highly secure encryption algorithm
    • PBKDF2 key derivation - With 100,000 iterations for additional security
    • Random IVs (Initialization Vectors) - Ensuring the same data encrypts differently each time
    • Secure local storage - Keys remain local to the user's device

    This implementation follows cryptographic best practices and provides a very high level of security while maintaining a good user experience.