Trust, explained
Know who can access a document, how to close a link and what to save for your records.
Passwords are stored as salted, slow hashes. Account sessions expire after seven days and are revoked when you sign out. A password change or recovery reset signs out all other sessions.
Save your private recovery code. Email verification and email password resets are not enabled. An email address or stated signer name is not proof of identity.
Each recipient has a separate link. Anyone holding that link can act as that recipient, so share it privately. Add an access code and share the code separately for extra protection.
Senders can replace a pending recipient’s link or revoke all links. Guessing attempts are limited.
The completion record includes names, signatures, consent, timestamps, IP addresses and browser details. Signed evidence lets you check that a downloaded PDF matches the completed record.
SignZero does not independently verify a signer’s identity.
Documents are stored on the service’s server and sent over HTTPS. They are not end-to-end encrypted. The sender can delete documents and templates from their dashboard.
Expiring a link stops recipient access; it does not automatically delete the document. Download completed copies before their links expire. Operational backups may retain earlier copies.
Accounts store your name, sign-in email, password hash and plan. We store uploaded documents and signing activity to provide preparation, signing and completion records. We do not send signing invitations or account emails at present.
An account is now required to upload and manage documents. If you used an earlier guest workspace, creating an account moves that browser’s guest documents into the account and retires its guest recovery key.
Use the contact details on ScreenZero’s security page to report it privately. Please avoid accessing other people’s documents.