Security
Your agreements deserve careful handling
Contracts are some of the most sensitive things a business keeps. Here is, in plain language, how Inkwell protects them.
No passwords to steal
You sign in with a one-time code sent to your email. Codes expire in minutes, can only be used once, and are stored only as one-way hashes.
Private by default
Every document is checked against who is allowed to see it on every request. If it isn't yours or shared with you, Inkwell behaves as if it doesn't exist. Download links are signed and expire.
Signers prove it's them
People signing for you confirm their email with a one-time code. You can add an access code you share separately, and set the link to expire.
Sealed before signing
The exact version sent for signature is sealed. If you change the document, old requests are cancelled so nobody signs something different from what they were shown.
Tamper-evident proof
Every completed document gets a Certificate of Completion and a SHA-256 fingerprint. Anyone can drop the file on our Verify page to see if it has been altered — their file never leaves their device.
A full audit trail
We record when each document was created, changed, opened, signed or declined, with the signer's IP address and device. That history travels with the certificate.
Safe connections to other tools
API keys are stored only as one-way hashes and can be revoked any time. Webhook messages are signed so you can prove they came from Inkwell, and can only be sent to public https addresses.
Also in place
- Rate limits on sign-in, codes and signing attempts to slow down guessing.
- Connections to Inkwell are encrypted in transit (HTTPS).
- Documents are stored with a cloud storage provider; major providers encrypt stored data at rest.
- We don't sell your data or use your documents to train AI.
- Payments are handled by Paystack. We never see or store your card details.
Being straight with you
- Inkwell provides standard electronic signatures with email verification. It does not (yet) offer ID-document checks, single sign-on or a formal security certification such as SOC 2.
- Security is a continuing job. If you need something specific for your organisation, tell us.
Found a security problem?
Please tell us privately at Inkwell <[email protected]> with enough detail to reproduce it. Please don't access other people's data or disrupt the service while testing. We'll acknowledge your report promptly and keep you updated.