Data and security

These are properties built into Obsign, not options to switch on.

• Two-factor authentication on every account, with no opt-out.
• Tenant isolation enforced by row-level security in the database, and exercised by adversarial tests.
• An append-only, hash-chained audit trail, verifiable on demand.
• Documents in private storage, served only through short-lived signed links, with every download checked against its recorded sha256.
• Counterparty uploads accepted only through single-use expiring links, stored without trusting their content type, and never advancing a consignment without human review.
• No patient data, by construction: no field exists to hold it.
• Data hosted in the EU (AWS eu-west-1, Ireland).