Security & Legal Validity
Signing a document means trusting the tool that holds it. This page describes exactly what GSD does with your documents and what makes a signature collected here legally binding. Everything below describes controls that are in place today — where something is not in place, we say so rather than leave it to inference.
1. Are signatures from GSD legally binding?
Yes, for the great majority of business and personal agreements in the United States. Two laws govern this:
- ESIGN Act (Electronic Signatures in Global and National Commerce Act, 2000) — a federal law giving electronic signatures the same legal effect as ink on paper.
- UETA (Uniform Electronic Transactions Act) — adopted by 49 states, the District of Columbia, and the US Virgin Islands, establishing the same principle at state level.
Both require that the signer intended to sign, consented to do business electronically, that the signature is attributable to that person, and that a record is retained and reproducible. GSD is built to satisfy each of these:
- Intent and consent — a signer must actively place each signature; consent to electronic signing is presented before signing begins.
- Attribution — each signer receives a unique, single-purpose signing link. Senders can additionally require an access code, and every action is recorded with its timestamp and originating IP address.
- Record retention — the completed PDF carries a Certificate of Completion appended as a final page, listing every signer, every event, and the document's cryptographic hash. It travels with the file; nobody needs a GSD account to read it.
What is out of scope: some documents are excluded from ESIGN/UETA and generally still require paper or a notary — wills and testamentary trusts, adoption and divorce papers, court orders, and certain notices such as utility shut-offs or eviction. Some transactions also require notarization or witnessing that GSD does not currently provide. If your document falls into one of these categories, take legal advice rather than our word for it. This page is information, not legal advice.
2. How documents are protected
- In transit — every connection to gsdhere.com is encrypted with TLS. Signing links are HTTPS-only.
- At rest — documents are held in a private object store (Cloudflare R2) with no public URLs. Files are reachable only through short-lived, signed links issued after an authorization check, and uploads go directly to that private store, so document bytes never sit on our application servers.
- Integrity — GSD records a SHA-256 hash of both the original upload and the final signed PDF. Those hashes appear on the Certificate of Completion, so anyone holding the file can prove it has not been altered since signing.
- Passwords — stored only as bcrypt hashes. We cannot read your password, and neither can anyone who obtains the database. Google and Microsoft sign-in are supported so you need not create one at all.
- Audit trail — viewing, signing, declining, and delivery events are recorded with timestamp and IP address for every envelope.
3. Access controls available to you
- Roles — owner, admin, sender, and viewer, so team members get only the access their job needs.
- Access codes — require a signer to enter a code you share separately before the document opens.
- Trusted devices and IP allow-listing for accounts that want to restrict where the workspace can be reached.
- Retention control — completed documents are automatically deleted at the end of your plan's retention window (30 days on Free, one year on Pro, seven years on Business). Signers are warned before a document expires so they can save their copy.
4. Who else can see your data
We use a small number of external services to run GSD. Each sees only what its job requires, and none of them sell your data:
| Service | What it handles |
|---|---|
| Oracle Cloud Infrastructure | Application servers and database hosting (United States). |
| Cloudflare (R2) | Private document storage and content delivery. |
| Stripe | Subscription and payment processing. Card details go directly to Stripe; GSD never sees or stores them. |
| Twilio | SMS delivery, when a sender chooses to notify signers by text. |
| OpenRouter and its model providers | AI field detection, when you use it. Page images are processed transiently by providers operating under no-log, no-training policies; your documents are not retained by them and are never used to train models. See our Privacy Policy for detail. |
| Email delivery | Sending signing invitations, reminders, and completed documents. |
We do not sell your data, and we do not use the contents of your documents for advertising or for training our own models.
5. What we do not yet have
We would rather tell you this plainly than let a badge imply otherwise:
- No SOC 2 or ISO 27001 certification. These are audits we have not yet undertaken. We are a small, young company and are not going to pretend otherwise. If your procurement process requires one, tell us — knowing that changes our priorities.
- No remote online notarization and no identity verification (KBA) beyond access codes. If your transaction requires a notary or government-ID verification, GSD is not the right tool for it today.
- No HIPAA Business Associate Agreement. Please do not use GSD for protected health information.
6. Reporting a security problem
If you believe you have found a vulnerability, email support@gsdhere.com with "security" in the subject line and enough detail to reproduce the issue. It reaches the person who builds GSD, not a queue. We will acknowledge your report, keep you updated while we fix it, and we will not pursue legal action against anyone who reports a problem in good faith and does not access other people's data while investigating.
7. Questions
Security or compliance questions before you commit to GSD are welcome — including the awkward ones. Email support@gsdhere.com or use the support form. See also our Privacy Policy and Terms & Conditions.