Data and security
Security built in, not switched on
These are properties of how Obsign is built, present on every account and every record by default, not options a customer has to remember to enable.
Two-factor on every account
Mandatory MFA with no opt-out, re-checked at the moment of every dispatch signature. A new session always re-checks the second factor, and access tokens are short-lived.
Tenant isolation
Every read and write is scoped to one organisation by row-level security in the database, and exercised by adversarial cross-tenant tests.
Tamper-evident audit
An append-only, hash-chained log of each audited change, verifiable on demand; any alteration is detected and the exact record named.
Malware scanning
Uploads pass through a malware-scan checkpoint on every ingest path, internal and counterparty. A flagged file is rejected at the door and never stored, and a stored file that is not clean is never served. The detection pipeline is built in, with a production scanning engine as the integration point.
Private document storage
Documents live in private storage, served only through short-lived signed links, with every download checked against its recorded sha256.
Guarded counterparty uploads
Accepted only through single-use expiring links, stored without trusting their content type, and never advancing a consignment without human review.
EU data residency
Data is hosted in the EU, on AWS eu-west-1 in Ireland.
No patient data
By design: there is no patient record in the system, and nothing in the workflow asks for one.
Subprocessors
Obsign relies on three subprocessors: Supabase (database, authentication and storage), Vercel (hosting), and Resend (transactional email only; it never receives document files, permit balances or ledger records). Each provider's current certification status is best confirmed with that provider directly.