Cryptographic Security for Regulated Enterprises
Engineered from first principles for organizations that cannot compromise on data sovereignty, key custody, or evidentiary defense.
Seal with your own key
On the hosted service, Enterprise customers can seal their documents with their own .p12 certificate or a key in AWS KMS, Azure Key Vault, or Google Cloud KMS, and the private key stays in their cloud account. With self-hosted or private cloud deployments, your documents never leave your infrastructure, you hold your own encryption keys, and you can seal with a PKCS#11 HSM such as Thales Luna, Utimaco, Entrust nShield, YubiHSM, or AWS CloudHSM.
Multi-Tier Defense-in-Depth Topology
Layer 1: Identity & Authentication
Identity Assurance
FIDO2 / WebAuthn Passkeys
Phishing-resistant cryptographic hardware device tokens
SMS & Authenticator-App Codes
6-digit codes via your SMS provider (AWS SNS, Twilio, Unifonic, any HTTP gateway) or TOTP app codes
Enterprise OIDC Single Sign-On
Works with Microsoft Entra ID and other OIDC providers
Use Your Own Signing Key
VeeSign seals every completed document with a PAdES signature. On the Enterprise plan, an organization admin can seal with the organization's own key: upload a .p12/.pfx certificate, or connect a key in AWS KMS, Azure Key Vault / Managed HSM, or Google Cloud KMS. With a cloud KMS key, the private key never leaves your cloud account; only hashes are sent. Self-hosted deployments can also use any PKCS#11 HSM.
Hardened Tenant Isolation
Every database query is scoped to the team and organisation that owns the data, so one tenant never sees another tenant's records.
Tamper-Evident Audit Trail
Every signer action is recorded in a timestamped audit trail. VeeSign stores the SHA-256 fingerprint of each signed PDF, and any change to the file breaks its signature.
Role-Based Access & MFA
Granular administrative roles, WebAuthn passkeys and two-factor authentication, and OIDC single sign-on (works with Microsoft Entra ID and other OIDC providers).
Encryption in Transit & Restricted Access
All network traffic is encrypted with TLS. Access to stored files and records is restricted to authorized systems and staff.
Sovereign Air-Gapped Deployment
For intelligence and defense environments, VeeSign can be deployed completely disconnected from the public internet; timestamps then come from an internal timestamp authority.
What VeeSign Does Not Claim (Defensible Transparency)
Enterprise credibility demands technical precision and honesty. Conventional vendors frequently rely on marketing hyperbole. At VeeSign, we maintain strict clarity regarding our security claims:
No software can physically prevent a malicious actor with file access from modifying bits. What VeeSign provides is tamper-evidence: any modification breaks the PDF signature and no longer matches the stored SHA-256 fingerprint.
We do not claim that a basic email link signature has the same legal standing as a qualified electronic signature, and we do not describe national-ID signing as qualified. Signers can be authenticated by email link, access code, account sign-in, passkey, authenticator-app two-factor, email or SMS one-time code, or a national-ID signature, so compliance teams can choose the level their jurisdiction requires.
On the hosted cloud service, VeeSign holds the default sealing key unless your organization brings its own (a .p12 file or a cloud KMS key on the Enterprise plan). When you deploy VeeSign On-Premises or in a Private Cloud, you hold your own encryption keys and can seal with a .p12 certificate, a PKCS#11 HSM, or a cloud KMS key.
You are never locked into our cloud to prove a contract was signed. The audit certificate is attached to the PDF itself, and its PAdES signature and RFC 3161 timestamp can be checked in standard PDF software without VeeSign.