Is SignFlow ISO 27001 certified?

LeonAI Ltd., the company that builds SignFlow, holds ISO/IEC 27001:2022 from the Standards Institution of Israel (certificate 1126333, valid to 26 October 2028).

Our SOC 2 Type 2 audit is in progress. Our infrastructure provider, Cloudflare, holds SOC 2 Type II.

What happens in a security incident?

We investigate and contain it within 24 hours, and notify affected users within 72 hours, as GDPR requires.

How do I report a vulnerability?

Email care@leonai.io with as much detail as you can. We investigate every report within 24 hours.

Where can I see whether SignFlow is up?

On status.leonai.io, which shows every LeonAI service live.

Securityyou can check.

Every claim on this page links to its proof: the certificate, the policies and the live status.

The live status of SignFlow: status.leonai.io (opens in a new window)

Open the ISO 27001 certificate Report a security issue

ISO/IEC 27001:2022 certificate of LeonAI Ltd., number 1126333, from the Standards Institution of Israel — The ISO/IEC 27001:2022 certificate of LeonAI Ltd. from the Standards Institution of Israel. Check it on the institute's site with certificate number 1126333. sii.org.il (opens in a new window)

Standards and audits

Security standards, their status, the issuer and the proof
Standard	Status	By	Proof
ISO/IEC 27001:2022	Certified, valid to 26 Oct 2028	Standards Institution of Israel · No. 1126333	Certificate (PDF) (opens in a new window)
SOC 2 Type 2	Audit in progress	Independent auditor	—
Israel Tax Authority remote-signing registration	In progress	Israel Tax Authority	—
Accessibility statement	Published	LeonAI Ltd.	Read it
Cloudflare infrastructure	SOC 2 Type II · ISO 27001 · ISO 27018	Cloudflare, our infrastructure provider	Cloudflare Trust Hub (opens in a new window)

The ISO certificate is held by LeonAI Ltd., the company that builds SignFlow, for the scope “Automations and integrations for companies”.

How your documents are protected

TLS 1.3 on every connection
AES-256 on everything stored
Two-factor sign-in for everyone
Sign in with Microsoft, Google or SSO
Rate limits on every endpoint
An audit log of every action

SignFlow runs on Cloudflare's edge network, with DDoS protection and a web application firewall built in, and no origin server to attack.

The submissions list in SignFlow: each document with its signers, status and dates

Every signature, provable

Every signed document comes with an audit trail: who signed, when, and from which IP address.

The signed PDF carries a digital seal, so a later change shows. Your organization's log keeps every creation, send, view and signature.

Who sees what

A signer sees only the document sent to them
Your team sees what their role allows
API keys are stored only as SHA-256 hashes

Choosing who signs a document in SignFlow

The SignFlow template builder, where each field is placed

The documents

Security policy
Encryption, infrastructure, access and incident response.
Privacy policy
What we collect, why, and for how long.
Terms of service
The agreement between LeonAI Ltd. and you.
Accessibility statement
How SignFlow is accessible, and whom to contact.
Live status (opens in a new window)
Every LeonAI service, in real time.
Report a security issue
care@leonai.io. We investigate within 24 hours.

Questions

Is SignFlow ISO 27001 certified?: LeonAI Ltd., the company that builds SignFlow, holds ISO/IEC 27001:2022 from the Standards Institution of Israel (certificate 1126333, valid to 26 October 2028).
Do you have SOC 2?: Our SOC 2 Type 2 audit is in progress. Our infrastructure provider, Cloudflare, holds SOC 2 Type II.
What happens in a security incident?: We investigate and contain it within 24 hours, and notify affected users within 72 hours, as GDPR requires.
How do I report a vulnerability?: Email care@leonai.io with as much detail as you can. We investigate every report within 24 hours.
Where can I see whether SignFlow is up?: On status.leonai.io, which shows every LeonAI service live.