Security and HIPAA

Acceptie is built to keep signed documents private and provable. This page summarizes how. The Business Associate Agreement, the terms and the privacy notice are the binding versions.

How we protect every document

• Documents are encrypted in transit and at rest.
• Signing links are single-use and expire. A public template link opens no document itself: each person who uses it gets their own new document and their own single-use link, and an organization in HIPAA mode must protect a public link with an email code or a PIN.
• Signing emails never carry the document itself.
• Document content and field values are never written to application logs, and access is logged.
• Every completed document is digitally sealed, with an audit certificate of who signed and when. Any change to a sealed PDF breaks its seal.
• Two-step verification is available to every member, and our own staff who could reach your documents use it.
• Acceptie runs on Amazon Web Services, and our AWS account is covered by the AWS Business Associate Addendum.

HIPAA mode

HIPAA mode is for organizations that send protected health information (PHI). It comes with every paid plan and is not available on Free.

• An owner or admin with two-step verification turns it on in Settings, HIPAA mode, by accepting the Business Associate Agreement. Acceptie records who accepted it, which version and when.
• Every member of a HIPAA organization must use two-step verification.
• Signers prove who they are before a document opens, with an email code or an access code you give them separately. Acceptie refuses "no verification" in HIPAA mode.
• Signing emails mask the subject line, so the email itself says nothing about the document.
• Until HIPAA mode is on, do not send PHI through Acceptie. If you move to Free or your subscription ends, HIPAA mode turns off, and records you already sent keep their protections.

Keep PHI out of the parts of a request that travel unprotected, such as the document title and the message to the recipient. Do not email PHI or other sensitive data to our support addresses.

Who handles your data

Amazon Web Services hosts the service, stores documents and keys, and delivers email. Stripe handles billing and never receives documents or signers. Text-message codes, when they are available, reach only the recipient's phone number and the code. The full list is on Subprocessors.

Keeping and leaving

Sealed records are kept under a retention lock for the period your plan sets: seven years from completion on paid plans while you keep an active or archive subscription, and one year on Free. If you cancel, you have 60 days to export everything; archive plans keep your records with us after you stop sending. See Cancelling and leaving.

Certification

We build Acceptie to the HIPAA standard and sign a Business Associate Agreement so you can use it for PHI. There is no official HIPAA certification, and we do not claim one. Acceptie's seal proves a document has not changed since it was sealed; it is our own seal, so some PDF readers will not show it as trusted until you trust it yourself.

Report a security issue

Email security@acceptie.com. Our security.txt has the same address.