Security Policy
How SignFlow protects your data — encryption, infrastructure, authentication, and session management.
Our Commitment to Security
LeonAI Ltd. is committed to protecting the security and integrity of your data. SignFlow implements industry-standard security practices to safeguard your documents and personal information.
Encryption
In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3, the latest transport layer security protocol.
At Rest: Documents stored in Cloudflare R2 and data in Cloudflare D1 are encrypted at rest using AES-256 encryption.
Infrastructure Security
SignFlow runs on Cloudflare's global edge network:
- Cloudflare Workers provide serverless compute at 300+ edge locations worldwide
- Built-in DDoS protection mitigates volumetric and application-layer attacks
- Web Application Firewall (WAF) protects against common web vulnerabilities
- Automatic SSL/TLS certificate management
- No origin servers to protect — fully edge-native architecture
Authentication
Google OAuth 2.0: Secure authentication delegated to Google's identity platform.
JWT Sessions: Stateless session tokens with configurable expiration.
API Tokens: Scoped API tokens for programmatic access with SHA-256 hashing.
Session Management
Sessions are stored in Cloudflare KV with the following protections:
- HTTP-only cookies prevent client-side script access
- Secure flag ensures cookies are only sent over HTTPS
- SameSite attribute protects against CSRF attacks
- Configurable session expiration
Audit Logging
All significant actions are recorded in an audit log:
- Document creation, sending, viewing, and signing events
- User authentication and session events
- API key creation and usage
- Organization and team management changes
Audit logs are retained for 90 days and include timestamps, user identity, IP addresses, and action details.
Rate Limiting
API endpoints are protected with rate limiting to prevent abuse:
- Authentication endpoints: 10 requests per minute
- API endpoints: 100 requests per minute per token
- File uploads: 20 requests per minute
Rate limit headers are included in API responses.
Incident Response
In the event of a security incident:
1. We will investigate and contain the incident within 24 hours
2. Affected users will be notified within 72 hours as required by GDPR
3. A post-incident report will be published for significant events
4. Remediation measures will be implemented to prevent recurrence
To report a security vulnerability, contact: care@leonai.io
Contact Us
For security-related inquiries:
Email: care@leonai.io
LeonAI Ltd.