Our Security Commitment
vScrawl is designed to support secure electronic-signature and document-workflow operations. We apply layered technical, organizational, and operational controls intended to protect documents, account information, audit records, and related service data against unauthorized access, alteration, loss, or misuse.
This Security Policy summarizes the safeguards used across the vScrawl platform. Security measures may vary by deployment model, subscription plan, integration configuration, and customer environment.
Security Governance and Compliance
Security responsibilities are incorporated into product development, infrastructure management, access administration, incident handling, and vendor oversight. vScrawl reviews its security controls as the platform, threat landscape, and applicable legal requirements evolve.
vScrawl is designed to support privacy and electronic-signature obligations that may apply to customers, including requirements associated with data protection and electronic transactions. Customers remain responsible for determining which laws, certifications, and contractual controls apply to their specific use.
- Policy governance: Security procedures and responsibilities are documented and periodically reviewed.
- Access accountability: Administrative and operational access is restricted according to job responsibilities.
- Privacy alignment: Personal data is handled according to applicable privacy commitments and customer instructions.
- Compliance support: Audit trails, permissions, authentication options, and document evidence help customers support their own compliance obligations.
Data Protection and Encryption
vScrawl uses encryption and access controls designed to protect service data throughout its lifecycle. Data transmitted between supported browsers, applications, APIs, and vScrawl services is protected using secure transport protocols.
Documents and related service data may be encrypted at rest using strong industry-standard encryption appropriate to the hosting or deployment environment. Encryption keys, credentials, and secrets are managed through controlled systems and restricted access procedures.
- Data in transit: Secure encrypted connections help protect information exchanged with the platform.
- Data at rest: Stored documents and service data are protected using encryption controls appropriate to the deployment.
- Credential protection: Passwords, tokens, API keys, and secrets are handled through controlled authentication and storage mechanisms.
- Tenant separation: Logical access controls are used to separate customer accounts and organizational data.
Infrastructure and Hosting Security
vScrawl may be deployed in cloud, on-premise, or hybrid environments, depending on the customer arrangement. For cloud-hosted services, physical and environmental controls are provided by established infrastructure providers and supported by vScrawl’s own configuration, monitoring, and access controls.
For customer-managed or on-premise deployments, infrastructure security is shared with the customer. The customer is responsible for the security of its facilities, operating systems, networks, backup locations, endpoint devices, and administrative access unless otherwise agreed in writing.
Application and Software Security
Security is considered throughout the software-development lifecycle. Development practices include controlled source-code access, peer review, dependency management, testing, and remediation of identified weaknesses.
Application components may be separated into isolated services or controlled execution environments to reduce unnecessary exposure and limit the impact of a potential failure.
- Security-focused code review and development guidance.
- Automated analysis and testing where appropriate.
- Controlled release and change-management processes.
- Review of third-party libraries and software dependencies.
- Remediation and prioritization based on risk and severity.
- Separation of development, testing, and production responsibilities where applicable.
Payment Information
Where paid subscriptions are offered, payment-card information may be processed by an authorized third-party payment provider. vScrawl is designed so that full payment-card details are handled by the payment provider rather than stored directly within the main vScrawl application.
Payment providers maintain their own security and compliance programs. Customers should review the applicable provider’s terms and privacy information when completing a transaction.
Third-Party Risk Management
vScrawl may rely on selected third parties for infrastructure, communications, identity verification, payment processing, monitoring, or other supporting services. Providers are considered according to the nature of the service, data access, security practices, and contractual commitments.
Third-party access is limited to what is reasonably necessary to deliver the relevant service. Provider relationships and access arrangements may be reviewed as business or security requirements change.
Threat Prevention and Attack Mitigation
vScrawl applies preventive and detective controls intended to reduce exposure to common web and network attacks. The specific controls used depend on the deployment architecture and hosting environment.
- Network filtering and controlled service exposure.
- Web-application protections against common injection and scripting attacks.
- Rate limiting and traffic controls where appropriate.
- Authentication, authorization, and session-management controls.
- Logging of security-relevant events.
- Protective measures intended to reduce denial-of-service and automated abuse risks.
Security Testing and Vulnerability Management
Security testing may include automated scanning, manual review, dependency analysis, configuration review, and penetration testing. Findings are assessed according to risk and prioritized for remediation.
vScrawl may also engage qualified independent security specialists where additional assurance or specialized testing is appropriate.
Monitoring, Logging, and Alerting
Service and infrastructure events are monitored to support availability, troubleshooting, performance management, and security response. Alerts may be generated for abnormal behavior, service degradation, unauthorized access attempts, or other relevant conditions.
Access to operational logs is restricted to authorized personnel. Log retention depends on the service, deployment configuration, legal requirements, and customer agreement.
Incident Response
vScrawl maintains procedures for identifying, assessing, containing, investigating, and resolving suspected security incidents. Response activities are coordinated according to the nature and severity of the event.
- Triage and validation of reported or detected events.
- Containment measures intended to limit further impact.
- Investigation and preservation of relevant evidence.
- Remediation and recovery actions.
- Notification to affected customers or authorities where required by law or contract.
- Post-incident review and improvement of controls.
Backups and Recovery
Backup and recovery controls are designed according to the relevant hosting environment and service configuration. Backups may be encrypted, access restricted, and stored separately from primary operational data.
Recovery procedures are intended to support restoration following operational failure, corruption, or other qualifying events. Backup schedules, recovery objectives, and retention periods may vary by plan, deployment model, and customer agreement.
Availability and Resilience
vScrawl uses architecture and operational practices intended to support reliable service delivery. Depending on the deployment, these practices may include service redundancy, health monitoring, controlled failover, workload distribution, and recovery procedures.
Any contractual uptime commitment applies only where stated in an executed service-level agreement. Planned maintenance, customer-managed infrastructure, third-party outages, and events outside reasonable control may be treated according to that agreement.
Key Application Security Features
The following controls are available or supported within vScrawl, depending on the selected plan, configuration, and deployment model.
| Security Feature | How It Supports Protection |
|---|---|
| Audit trails | Document and workflow activity can be recorded with relevant actions, timestamps, participant details, and technical information to support traceability. |
| Role-based access | Organizations can restrict documents, workflows, administrative functions, and settings according to assigned roles and permissions. |
| Single sign-on | Supported deployments may connect to an organization’s identity provider for centralized authentication and access management. |
| Encryption | Secure transport and encryption-at-rest controls are used according to the relevant hosting and deployment environment. |
| Tamper evidence | Signed documents and associated evidence can be protected so that later changes may be detected during validation. |
| Signature validation | Supported signature workflows may preserve certificate and validation information required for later verification. |
| API security | API access uses controlled credentials, authentication, permissions, and documented integration methods. |
| Activity monitoring | Operational and security-relevant events may be logged and monitored to support detection, investigation, and response. |
Audit Trails
vScrawl can generate evidence associated with a document workflow. Depending on the configured process, this may include participant actions, timestamps, document events, delivery information, authentication events, and relevant technical details.
Audit information supports traceability but does not replace a customer’s responsibility to determine legal admissibility, retention requirements, and evidentiary standards.
Role-Based Access Control
Organizations can use roles and permissions to manage access to documents, templates, workflows, administrative settings, integrations, and account information. Access should be assigned according to business need and reviewed periodically.
Single Sign-On and Identity Management
Where supported, vScrawl can integrate with an external identity provider to help organizations centralize authentication, enforce access policies, and manage user lifecycle events.
Customers remain responsible for correctly configuring their identity provider, assigning access, disabling departed users, and protecting administrator accounts.
Tamper Evidence and Document Integrity
Completed documents and associated signing evidence may include cryptographic protections intended to make unauthorized changes detectable. The verification result depends on the signature type, certificate status, document format, and validation software.
Long-Term Signature Validation
Supported signature workflows may preserve certificate, timestamp, and revocation information within or alongside the signed document. This can assist later validation even after a certificate has expired or changed status.
Customers should select a signature method and retention strategy appropriate to the legal and technical standards that apply to their transactions.
Customer Security Responsibilities
Security is a shared responsibility. vScrawl protects the platform and service components under its control, while customers remain responsible for their users, devices, credentials, workflows, integrations, and deployment environments.
- Use strong authentication and enable multi-factor authentication where available.
- Assign the minimum permissions necessary for each user.
- Review user access and remove accounts that are no longer required.
- Protect API credentials, signing certificates, tokens, and webhook secrets.
- Verify recipients using an authentication method appropriate to the transaction.
- Maintain secure endpoints, browsers, networks, and on-premise infrastructure.
- Report suspected misuse, credential compromise, or security incidents promptly.
Reporting a Security Concern
If you believe you have identified a security weakness, unauthorized access, or suspicious activity involving vScrawl, please report it responsibly to info@dictalabs.com.
Include sufficient information to help us understand and reproduce the issue, but do not access data that does not belong to you, disrupt services, use destructive testing, or publicly disclose the issue before an appropriate review can be completed.
Changes to This Security Policy
vScrawl may update this Security Policy to reflect changes in technology, services, security practices, legal requirements, or deployment options. The current version will be published in the Legal Center.
Last updated: August 4, 2026
