The short version
- This page lists the 21 security controls eDocYouSign runs, mapped to the AICPA SOC 2 Trust Services Criteria, and where an auditor or buyer can see the evidence for each.
- Most evidence comes straight from the product: the Security check, the tamper-evident audit log and the Compliance page's evidence pack.
- Items highlighted in yellow are kept by the operator outside the product, such as policies and backup records.
1. Control matrix
| ID | SOC 2 criteria | Control | Evidence |
|---|---|---|---|
| SEC-01 | CC1 Control environment | Written security policies Information security, access control, change management, incident response, business continuity and vendor policies, approved yearly | Policy documents and approval record [kept by the operator] |
| SEC-02 | CC2 Communication | Security commitments published Trust Center, this controls page, the SLA, Privacy Policy and Terms are public | trust.html, security-controls.html, sla.html |
| SEC-03 | CC3 Risk assessment | Yearly risk assessment Risks are listed with an owner and a fix date, reviewed every year | Risk register [kept by the operator] |
| SEC-04 | CC5 Control activities | Daily automated security check The site checks HTTPS, headers, file permissions, private folders, MFA, encryption settings and audit-log integrity, daily and on demand, and emails operators about new problems | Security check page: last run, recent runs; cron output |
| SEC-05 | CC6.1 Logical access | Multi-factor sign-in for every account An authenticator code is required at every sign-in; it can't be turned off per user | Security check row "Two-step sign-in required"; sign-in records |
| SEC-06 | CC6.1 Logical access | Single sign-on SAML and OpenID Connect through Okta, Entra ID, Google Workspace and others, on Business and Enterprise | Company SSO page |
| SEC-07 | CC6.1 Logical access | Session limits Sign-out after 15 minutes idle and every 12 hours at most; "sign out everywhere" ends all sessions | config.php session settings; audit log entries |
| SEC-08 | CC6.2 Access provisioning | Role-based access Owner, admin and member roles per workspace; invitations expire; removed users lose access at once | Team page; audit log (invite.created, member.role_changed, member.removed) |
| SEC-09 | CC6.3 Access reviews | Quarterly access review Owners review members and roles every quarter; operators review server, Stripe, Twilio and DNS access | Members export in the evidence pack; review record [kept by the operator] |
| SEC-10 | CC6.1 Encryption | End-to-end encryption of documents AES-256-GCM in the browser; keys wrapped by 20-character access codes (PBKDF2-SHA-256, 310,000 rounds); the server refuses unencrypted documents | Security check row "End-to-end encryption required"; stored files begin with the EDYS1 encrypted header |
| SEC-11 | CC6.7 Data in transit | HTTPS everywhere TLS 1.2 or newer, HTTP redirected to HTTPS, HSTS with preload | Security check rows "HTTPS" and "Website security headers" |
| SEC-12 | CC6.6 Boundary protection | Application hardening Strict Content Security Policy, CSRF tokens, rate limiting, input validation, no third-party scripts in the app or signing pages | Response headers; Security check |
| SEC-13 | CC6.8 Malicious software | Upload controls Uploaded images are re-encoded; documents must be encrypted PDFs; size limits on every upload | Branding and envelope upload rules |
| SEC-14 | CC7.2 Monitoring | Tamper-evident audit log Every sign-in, setting change, envelope event and payment is logged and linked by SHA-256 hash; any change breaks the chain | Audit log page "Chain intact"; CSV and JSON exports with row hashes |
| SEC-15 | CC7.3 Incident response | Incident response and notice Severity levels, hourly updates for critical incidents, customer notice within 72 hours for incidents affecting their data | Trust Center incident section; SLA section 4; incident log [kept by the operator] |
| SEC-16 | CC7.5 Recovery | Two-person document recovery Optional: two workspace administrators together can recover a lost document key; we hold no recovery key | Document recovery page |
| SEC-17 | CC8.1 Change management | Tested, verified releases Every release passes the automated end-to-end test suites; update packages are checked file by file with SHA-256, automatic updates need an Ed25519-signed manifest, and every update keeps a backup for one-click rollback | Updates page (installed version, backups); release notes |
| SEC-18 | CC9.2 Vendor management | Subprocessor list and reviews Hosting, Stripe, Twilio and Google are listed with purpose and data; reviewed yearly; 30 days' notice before adding one | Trust Center subprocessors section |
| SEC-19 | A1.2 Availability | Backups and restore tests Daily encrypted backups, kept 30 days, stored apart from the server; quarterly restore test | Backup logs and restore test record [kept by the operator] |
| SEC-20 | C1.2 Confidentiality | Data deletion Deleting a user or workspace removes its envelopes, templates, forms and logos; closed accounts are deleted within 30 days | Clients & users page; audit log (user.deleted, workspace.deleted) |
| SEC-21 | P-series Privacy | Minimal data on signer checks Phone numbers are masked in logs; SMS text is never stored; for photo ID checks only the verified name and country are kept | SMS page delivery log; envelope audit trail |
2. Getting the evidence
- Workspace admins: on the Compliance page, choose Download evidence pack. It holds your members and roles with sign-in and MFA status, your security settings, the audit log with its hashes, and the verification result of the audit chain.
- Site operator: the same pack also includes the latest Security check run and the SOC 2 readiness results.
- Buyers: email support@edocyousign.com for the completed security questionnaire, this matrix as a spreadsheet, or the SOC 2 report once it is issued.
3. Audit status
These controls have not yet been tested by an independent auditor. Status: [SOC 2 Type I audit planned for Q_ 20__]. See the compliance status in the Trust Center.
This page describes controls in place as of the date above. It is not a SOC 2 report. Items highlighted in yellow must be completed by the operator before publishing.