Security
Last updated 20 October 2026.
How Signature Dash protects your account and your designs, who we rely on, and how to reach us about a security issue.
What's in here
1Who we run on
We don't run our own servers. Signature Dash is built on established suppliers, each of which has its security independently audited (for example SOC 2 or ISO 27001):
| Supplier | What they do for us |
|---|---|
| Supabase | The database and sign-in system, hosted in Sydney, Australia |
| Vercel | Runs the application at app.signaturedash.com and the signaturedash.com website |
| Cloudflare | Stores and serves signature images worldwide, and protects our website |
| Resend | Sends sign-in links and account email |
| Stripe | Takes payments. Card numbers never reach our systems |
| Anthropic | Suggests design improvements (“Polish my draft”). Receives design settings only, never contact details |
2How your data is protected
- Encrypted in transit and at rest. Every connection uses HTTPS, and our suppliers encrypt stored data.
- Each workspace is walled off in the database itself. Rules in the database decide who can read or change each row, not just the screens in the app. An anonymous visitor can't read any table, and our tests check that.
- Agencies and clients are kept apart. A client workspace only sees its own designs, and a client login can view, install and approve designs but can't change designs or branding.
- An activity log you can't edit. Publishing, plan changes, people joining or leaving and client workspace changes are recorded with who did them and when. Owners and admins can see it, and entries can't be edited or removed from the app or our staff console.
- Your data stays in Australia, except signature images (served worldwide so they load quickly) and payment and email processing. See our privacy policy.
3Signing in
- Sign in with a one-time link or code sent to your email, or with a password you choose.
- Two-step sign-in and passkeys (Face ID, fingerprint or Windows Hello) are available on every account.
- Owners and admins decide who joins a workspace and what they can do.
4How we make changes
- Every change must build successfully before it goes live, and we test changes before release.
- Changes to the database are written as numbered, reviewed scripts, so we always know what changed and when.
- Staff access to customer accounts is limited to a separate, protected console and is used only to support you.
5If something goes wrong
If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
6Reporting a security issue
If you think you've found a security problem, please tell us through our contact page and choose "A security issue". We'll reply within two business days. Please give us a fair chance to fix it before telling anyone else, and don't access or change other people's data while testing.
7Documents for your security review
Need something else for a security questionnaire? Ask through our contact page.