Security and privacy

Where your data lives

The app and its database run in Sydney, Australia. Documents are stored with Cloudflare R2, located near Australia.

Encryption and file access

Data is encrypted in transit (HTTPS only) and at rest. Documents are stored privately and are only ever served through short-lived signed links, so a copied link soon stops working.

Every uploaded PDF is cleaned before anyone sees it: scripts, auto-run actions and launch links are removed.

Access for your team and your clients

Team members sign in with a password and can add two-factor authentication or passkeys. Team owners can require two-factor authentication for everyone.

Clients never need an account. Each stakeholder gets a personal link and confirms their email address with a one-time code. They only see the documents shared with them, and never your internal notes.

Audit trail

Views, comments, approvals and signatures are recorded with a timestamp. The audit certificate attached to each issued document lists who signed, when, and how they were verified.

Electronic signatures

Issued provides simple electronic signatures: each signer types or draws their signature, confirms it with a one-time email code and consents to sign electronically. Every issued PDF is sealed with a SHA-256 fingerprint, which anyone can check at issued.io/verify.

Simple electronic signatures with this kind of audit trail are valid for most commercial agreements in Australia, the UK, New Zealand and the US. They are not suitable for deeds, documents that must be witnessed, or other documents the law requires to be signed on paper or with a qualified signature. If in doubt, check with your adviser.

More detail

Read our Privacy Policy, Data Processing Addendum (including our sub-processors) and E-signature disclosure. To report a security issue, contact us.