Data and security
Security built in, not switched on
These are properties of how Obsign is built, present on every account and every record by default, not options a customer has to remember to enable.
Two-factor on every account
Mandatory MFA with no opt-out, re-checked at the moment of every dispatch signature. A new session always re-checks the second factor, and access tokens are short-lived.
Tenant isolation
Every read and write is scoped to one organisation by row-level security in the database, and exercised by adversarial cross-tenant tests.
Tamper-evident audit
An append-only, hash-chained log of each audited change, verifiable on demand; any alteration is detected and the exact record named.
Upload checks
Every upload, internal or counterparty, is checked at the door: its bytes must be a PDF, PNG or JPEG whatever the file claims to be, it is checked against known malicious signatures, and anything flagged is rejected and never stored. A stored file that is not marked clean is never served. Scanning is a checkpoint in the pipeline, not a judgement on the document's contents.
Private document storage
Documents live in private storage, served only through short-lived signed links, with every download checked against its recorded sha256.
Guarded counterparty uploads
Accepted only through single-use expiring links, stored without trusting their content type, and never advancing a consignment without human review.
EU data residency
Customer data is stored in the EU (Ireland), with the application served from the UK.
No patient data
By design: there is no patient record in the system, and nothing in the workflow asks for one.
Subprocessors
Obsign relies on three subprocessors: a managed database, authentication and storage platform; an application hosting platform; and a transactional email service (which never receives document files, permit balances or ledger records). Their names, locations and current attestations are listed in the subprocessor schedule supplied with your agreement, and on request from access@obsign.co.