Security

Here is how Lock & Quill protects your documents, described plainly and without claiming certifications we don't hold.

Documents

• Files are stored in private storage. They are never public and never listed anywhere; every download uses a link that expires within minutes.
• All traffic is encrypted in transit (HTTPS/TLS), and stored data is encrypted at rest by our infrastructure providers.
• Each workspace's documents are isolated from every other workspace, enforced on the server for every request and again by database rules.
• Once a document is sent, signers see a frozen copy. Editing or deleting your template later cannot change what they signed.

Signing links

• Each signer gets a unique link built from 256 bits of randomness. We store only a one-way fingerprint of it, so a copy of our database would not reveal working links.
• A link stops working the moment its owner signs or declines, and when the sender voids the document.
• Senders can add an access code that the signer must enter first. Five wrong tries lock the link.
• Signing pages are never indexed by search engines, send no referrer, and load no analytics.

Proof and tamper-evidence

• Every completed document carries a certificate of completion: who signed, when, from which IP address and browser, their consent to sign electronically, and the full timeline.
• We record a SHA-256 fingerprint of the original and of the finished PDF. Change a single character and the fingerprint no longer matches.
• Anyone holding a finished PDF can check it at lockandquill.com/verify. The check happens in your browser; the file is not uploaded.

Email you can trust

• Signing emails come only from lockandquill.com and link only to lockandquill.com/sign/…
• They always name the real sender and their email address, and the document's title.
• We never ask a signer for a password, a payment or bank details. An email that does is not from us.
• Each workspace, and each recipient address, has a daily email limit so the service can't be used for bulk mail.

Accounts

• Passwords are handled by our authentication provider and stored only as salted hashes. We never see them.
• Admins can deactivate a teammate instantly; their access ends on the next request.

What we don't claim

Lock & Quill provides standard electronic signatures under the U.S. ESIGN Act and UETA. We do not currently offer certificate-based digital signatures, notarization, or identity verification by ID document, and we hold no SOC 2, HIPAA or ISO attestations today. If your use needs one of those, please ask us before relying on the service for it.

Report a problem

Found a vulnerability, or received a suspicious email using our name? Write to security@lockandquill.com. We read every report.