Security for contract data that stays confidential
NonDisclosures stores agreements whose whole point is secrecy. Encryption in transit, access control and a complete audit trail are part of every plan, and Company adds SSO, audit export and retention settings.
Protected from the browser to storage
In transit
Every page, signing link and API call uses TLS. Plain HTTP redirects to HTTPS.
At rest
Documents and uploaded files sit in private storage that is never publicly reachable; every download passes an access check. Integration secrets are encrypted in the database with an application key.
Secrets stored as hashes
Signing links and inbound integration URLs are random tokens kept only as SHA-256 hashes, so a database copy reveals no working link.
An audit trail that holds up
Certificate of completion
Signer email, IP address, browser, viewing and signing times in UTC and the document hash, attached to every signed PDF.
Tamper evidence
The SHA-256 hash of the exact text is fixed when the NDA is sent. Any change after that produces a different hash.
Links that expire
Personal signing links expire, and each reminder replaces the previous link.
The right people, and only them
Workspace roles
Owner, admin, editor and viewer on Business and Company. Viewers read and export, editors create and send.
Single sign-on
SAML SSO and audit log export on Company.
No cross-customer access
Every query is scoped to the workspace. Signers see only the NDA they were invited to.
Your data, on your terms
Export any time
CSV export of the register, signed PDFs with certificates, and an API on Company.
Deletion
Delete an NDA, a file or the whole account from the panel. Company sets retention periods.
Spam protection
Public forms use server-side bot traps, with no puzzles for people.
Security questions from buyers
Where is NDA data stored?
Documents, signatures and the audit trail are stored in private storage with an infrastructure provider in data centers with physical access controls. Every connection to NonDisclosures uses TLS.
Who can see an NDA?
Members of the workspace that created it, according to their role, and the signers it was sent to, through their personal signing link. Nobody else, including other customers, can open it.
Is the AI trained on our agreements?
No. When you run an AI review on a paid plan, the text is sent to an AI model provider only to produce that analysis, under terms that do not allow training on it. The result is stored in your workspace.
Can we export or delete everything?
Yes. The register exports to CSV, each signed NDA downloads as a PDF with its certificate, and the workspace owner can delete NDAs or the whole account. Company plans also set data retention periods.
How do you prove who signed?
Each signature records the signer's email, IP address, browser, the time of viewing and signing, and a SHA-256 hash of the exact text signed. These appear on the certificate page attached to the signed PDF.
Security questionnaire or a question we did not answer? Write to support@nondisclosures.com.