Security and where your documents are stored
Plain facts about where your documents live, how long we keep them, how signers are checked and what the seal means.
Stored in the EU or the US, you choose
SimpleSign365 runs in two places, and you pick a default when you set up your office:
- EU: Microsoft Azure, West Europe
- US: Microsoft Azure, Central US
Each office picks the EU or the US once, when it signs up, and cannot switch later. All its documents and signing history stay there. Nothing is copied to the other side.
What leaves the EU or the US
The key that seals finished PDFs is kept in the EU. To seal a document stored in the US, only a short fingerprint of the file is sent to that key. The document itself does not leave the US.
How long documents are kept
- Free plan: nothing is stored. The signed PDF is emailed to everyone, and the documents are deleted within 24 hours.
- Paid plans: documents are kept until you delete them.
- Signing record: who signed, when and from which email address, without the document content, is kept for 10 years.
Signer checks
Each signer gets a unique link and a one-time code sent to their email address. Their acceptance is recorded with the confirmed email address, name, time and the wording they agreed to.
The seal
When the last signer has finished, the PDF is flattened, a signing history page is added and the document is sealed once with a SimpleSign365 certificate and a trusted timestamp. A later change to the file breaks the seal.
The seal is made by SimpleSign365 on behalf of the sending office. It is not the signer's personal certificate. Signatures are simple electronic signatures plus the seal, not qualified or advanced signatures.
Current certificate. The seal certificate is self-signed for now. In Acrobat, the seal shows as intact, with the signer identity marked as not verified. We do not claim that Adobe trusts it. You can check any sealed PDF at simplesign365.com/verify, which confirms the seal and the signing history without needing certificate trust.
For your IT provider
There are no new passwords to manage, no mailbox rules and nothing to install. In short:
- Users sign in with their Microsoft account. There are no separate passwords to manage.
- One mail permission lets SimpleSign365 send the signing emails a user starts, as that user. It only sends what they start. It never reads mail.
- The permission can be removed at any time in the user's Microsoft account.
- In some Microsoft 365 setups an admin has to approve that permission once.
- Documents are stored in the EU or the US, your choice. Nothing is copied to the other side.
Technical details
- The seal is a PDF signature with a trusted timestamp. It covers a SHA-256 hash of the document, which is what is sent to the seal key. The key is held in a hardware-backed key vault in the EU.
- SimpleSign365 runs as two separate deployments on Microsoft Azure, one in the EU (Microsoft Azure, West Europe) and one in the US (Microsoft Azure, Central US), with no failover between them.
- Emails are sent through Microsoft 365 with a delegated permission for the signed-in user. That permission covers sending only.
- The check page confirms the seal and the signing history of any sealed PDF without needing certificate trust.
Legal documents
Read the Terms, Privacy policy, Subprocessors and Imprint. The DPA is still a draft.