Security of E-Sign's Electronic Signature

At eSign, security and privacy are at the heart of everything we do. With both the latest cyber and physical security measures in place, you can be sure your data and network are protected with eSign.

Operating from UK-based, ISO 27001-certified data centres, our state-of-the-art servers are protected with commercial-grade firewalls, border routers, and network management systems, as well as 24-hour on-site security and strict physical access controls.

Compliant with industry- recognised standards, you can rest assured that our security system will protect your data from loss, damage and cyberthreats.

Our access control and compliance policy ensures your data is never compromised. At E-Sign, we leave nothing to chance; we’re constantly testing and improving our security system for the ultimate protection.  

• Vulnerability testing by third parties. 
• SSL encryption, meaning your data is protected and safe from hackers.
• Malware protection.
• Digital audit trail and Certificate of Completion.
• Annual UK Government approved Third-party penetration testing.
• Code reviews.

• Confidentiality– At E-Sign, we understand that confidentiality is essential. Our security policy includes data encryption as standard, so you can be sure your data is in good hands.  
• Integrity– Our security capabilities protect the integrity of your digital services for peace of mind that our E-Sign solutions will strengthen your cybersecurity, and never compromise it.  
• Availability– Our stringent security measures ensure your data is protected from cybercriminals, and always available and accessible when you need it.  
• Authentication– With two factor authentication and ID verification, we ensure we verify the identity of both users and document signers before they can access sensitive data.  
• Read our disaster recovery statement

E-Sign provides 24/7 onsite security with stringent physical access controls that align with widely recognised industry standards, including ISO 27001 and Cyber Essentials Plus. We also deploy advanced security software and hardware to safeguard the physical integrity of E-Sign’s eSignature services, as well as the associated computer systems and networks that handle customer data.

This is managed through a centralised system that regulates access to the production environment using a global two-factor authentication process. The isolated production environment is secured by industry-leading network management systems, antivirus software, and malware detection tools. The antivirus software is integrated with automated processes that alert E-Sign’s cyber incident response team immediately upon detecting potentially harmful code.

Depending on the industry in which an organisation operates as well as the relevant legal and regulatory requirements, different organisations have different appetites for risk security. We at E-Sign are aware of this. Because of this, security is a top priority in the research, design, and development of all of our products, and they are all constructed with configurable security in mind.

Cyber Essentials is a United Kingdom government information assurance scheme that is operated by the National Cyber Security Centre (NCSC). It encourages organisations to adopt good practice in information security.

Cyber Essentials also includes an assurance framework and a simple set of security controls to protect information from threats coming from the internet.

It was developed in collaboration with industry partners, including the Information Security Forum (ISF), the Information Assurance for Small and Medium Enterprises Consortium (IASME), and the British Standards Institution (BSI), and it is endorsed by the UK Government. It was launched in 2014 by the Department for Business, Innovation and Skills. 

An ITHC, or IT Health Check, is an IT security assessment that’s part of the compliance process for many government computer systems in the UK. 

Generally performed by an external service provider, an ITHC touches on both applications and infrastructure and involves an element of penetration testing. 

This accreditation is essential for any company wishing to supply services to public sector organisations via the Public Service Network.

By meeting these requirements and more, E-Sign is able to supply our digital solutions on the PSN, making us the only e-signature on the market with the ability to do so.  

To flag and quarantine malicious spam on mail servers, enable both Sender Policy Framework (SPF) lookup functionality and Domain-based Message Authentication, Reporting & Conformance (DMARC). The combination of these technologies helps protect against malware spam attacks. Learn more about SPF and DMARC. Check the status of your domain mailer servers here.