Everything you need to trust us with your contracts
One page for the questions your customers, your IT person or your auditor will ask: where the data is, who touches it, what is encrypted, what we are and are not certified for, and who to call.
At a glance
- Stored in the EU. Ireland (European Union). Run by a UK company, Infinity Square Labs Ltd.
- Encrypted. HTTPS for every connection; the storage provider encrypts data at rest with AES-256.
- Provable. Every finished contract carries SHA-256 hashes and a certificate anyone can check on the verification page.
- 4 companies help run the service, and 4 more only for features a sender switches on.
Where your data lives
The database and file storage run in a Supabase project hosted in the AWS eu-west-1 region (Ireland). Contracts, signatures, attachments, audit events and account details are stored there.
The app, this site and our API are served by Cloudflare from the data centre nearest each request. Our API reads and writes the database over an encrypted connection; contract files are not stored at the edge.
Emails pass through our email provider on their way to recipients, and billing details are held by Stripe; both are listed below with where they operate.
Encryption
- In transit. Every connection to airesdocs.com, the app and the API uses HTTPS. Details are on the security page.
- At rest. Our database and file storage provider, Supabase, states:
All customer data is encrypted at rest with AES-256 and in transit via TLS.
(Supabase security page, checked 11 October 2026). - Private files. There is no public file storage. A contract file can only be fetched through a short-lived link our API creates for its owner or for the signer holding a valid signing link.
Who processes data for us
These companies process personal data on our behalf. We update this list before adding a new one.
| Provider | Purpose | Location | Data involved |
|---|---|---|---|
| Supabase | Database (Postgres), sign-in and private file storage | Ireland (AWS eu-west-1) | Account details, contracts and their files, fields, signatures, attachments, audit events |
| Cloudflare | Hosting of this site, the app and the API, DNS and protection from attacks | Global network; requests are handled near the person making them. No contract files are stored at the edge. | Connection data (IP address, request headers) in transit |
| Stripe | Subscription payments, invoices and the billing portal | United States and EU (Stripe Payments Europe) | Billing name, address, email and payment method (we never see full card numbers) |
| Resend | Sending emails (invitations, reminders, completion notices, account emails) | United States | Recipient names and email addresses, contract title, sender name, signing link; the signed contract as an attachment when it is small enough |
| Provider | Purpose | When | Location | Data involved |
|---|---|---|---|---|
| Twilio | Text-message one-time codes that confirm a signer before they sign | Only when a sender asks for an SMS code | United States | The signer’s mobile number and the message containing the code |
| Stripe (Identity) | Checking a signer’s government ID before they sign | Only when a sender asks for an ID check | United States and EU | The signer’s ID document and photo are collected and checked by Stripe; we keep only the result (verified or not) and an error code, never the images |
| Stripe (Connect) | Taking a payment as part of signing, into the sender’s own Stripe account | Only when a sender adds a payment to a contract | United States and EU | The payer’s card and billing details are handled by Stripe; we keep the payment status and amount |
| Anthropic | The optional AI summary and questions about a contract | Only when the sender switches the AI assistant on for that contract | United States | The text of that contract and the question asked; we do not store the contract text sent |
How transfers outside the UK and EU are protected is set out in the data processing agreement.
Certifications and audits
AiresDocs does not hold an independent security certification such as ISO/IEC 27001 or a SOC 2 report. We will list one here only once it has been awarded, with the certificate or report reference.
The providers that host and process data for us publish their own security and compliance information:
Legal documents
- Security Encryption, hashing, the audit trail, signing links, staff access.
- Privacy policy What we collect, why, how long we keep it and your rights.
- Data processing agreement Our commitments when we process data for your business.
- Terms The agreement for using AiresDocs.
- Cookies Only what sign-in and preferences need. No tracking.
- Accessibility How we build for keyboard, screen-reader and low-vision use.
- Legal validity by country When an electronic signature binds, with the primary sources.
The general guide to electronic signature law is How electronic signatures work.
Security notices
There are no security notices. If an incident affects your data, the data processing agreement sets out how we tell you.
Report a problem
Found a security issue? Email security@airesdocs.com; the rules for testing are on the security page and in security.txt. For anything else, write to support@airesdocs.com.
Check us out on the free plan
Send a real contract, then check its certificate and hashes yourself.