InkSwift is built for regulated industries — healthcare, finance, government contracting, and enterprise procurement.
Audit underway with an AICPA-accredited firm. Letter of engagement available on request.
Encryption, access controls, and audit logging that meet HIPAA Security Rule. BAA on Enterprise.
Lawful basis, DSAR workflow, regional data residency on request, sub-processor transparency.
Signatures meet US ESIGN, UETA, and EU eIDAS simple electronic signature standards.
TLS 1.2+ in transit, AES-256 at rest. Signature images and audit data are encrypted column-level.
Row-level security on every tenant table. No engineer has standing access to customer documents.
Every view, sign, and send event is hashed and timestamped. Exportable as a court-ready PDF certificate.
Automated dependency scanning, secret rotation, and 24/7 anomaly detection on auth events.
We notify customers in writing 30 days before adding any new sub-processor.
| Provider | Purpose | Region |
|---|---|---|
| Supabase / AWS (us-east-1) | Primary database, auth, file storage | United States |
| Cloudflare | Edge runtime, DDoS protection, WAF | Global |
| Paddle | Payments and tax (PCI-DSS Level 1) | EU / US |
| Resend | Transactional email delivery | United States |
Pre-signed GDPR-compliant DPA available for Business and Enterprise plans. Standard contractual clauses included.
Request DPAArchitecture diagrams, encryption details, incident response runbooks, and penetration test summaries.
Request whitepaperWe respond to security reports within 24 hours. PGP key available on request.
security@inkswift.com