# How Flowsign keeps your documents secure

From upload to sealed copy: how Flowsign encrypts, fingerprints and seals every document, and how to check a signed PDF in Acrobat yourself.

Source: https://flowsign.app/blog/how-flowsign-keeps-your-documents-secure
Published: 27 October 2026

Every completed package is sealed, and any edit after signing breaks the seal.

![Wellington's CBD waterfront across the harbour from Oriental Bay under a big blue sky](https://flowsign.app/marketing/places/wellington-oriental-bay.webp)

*Wellington's waterfront from Oriental Bay.*

## From your upload to their signature

From the first upload, every file is encrypted in transit with TLS and at rest with AES-256.

When you press send, Flowsign takes a fingerprint of each document. It's a code that changes completely if even one character of the file changes.

Sending something sensitive, like a salary letter? Turn on **Password protect signing** and recipients enter a password before the documents load. Share it with them separately, not in the invite email.

Want a code sent to their phone instead? SMS verification is available on request.

Each recipient gets their own link. Every view, consent, authentication step and signature is recorded with a timestamp, IP address and device.

![A package's Activity tab listing when it was created and sent, each invitation email and each signing session](https://flowsign.app/blog/packages-all-packages-preview-panel-activity.png)

*A package's Activity tab, with the time of each step.*

Once anyone has opened a package, it can't be changed. Spotted a typo? Void it and send a fresh one, so nobody signs a document that changed after they read it.

Video: [Signing a document](https://flowsign.app/videos/signing-a-document)

## Sealed the moment the last person signs

When the final signature lands, Flowsign finishes the copy in four steps.

1. **Check.** Each document's fingerprint is compared with the one taken at send. If the file has changed, sealing stops.
2. **Finish.** Signatures and answers are written into the document itself.
3. **Seal.** Each document gets a digital seal, with an independent timestamp recording exactly when.
4. **Store.** The sealed copy is written once and never overwritten.

That's what we mean by tamper-proof. Change a single character after sealing and the seal breaks, and Adobe Acrobat shows it.

It isn't a setting you can forget to switch on. Every completed package is sealed, and a completed package can't be edited at all.

The technical detail, for your IT team:

- **SHA-256 fingerprints** of every document, taken at send and checked at sealing.
- **A SHA-256 digital signature** from a 3072-bit RSA key.
- **An RFC 3161 timestamp** from an independent timestamp service.
- **A certification seal**, so Adobe Acrobat shows any later edit as a broken seal.

## A certificate that keeps the receipts

Every completed package comes with a certificate of completion. Recipients are emailed it with the sealed documents.

- **Each signer**, with their IP address, how they were verified and when they signed.
- **Each document's fingerprint** when sent and when sealed, so anyone can compare the two.
- **The full audit trail** of the package, from send to completion.

The audit trail is part of the certificate, so it's sealed too. Both are on every plan, Free included.

Say a contractor asks when their variation was signed, and by whom. The certificate answers it, and the [audit trail page](https://flowsign.app/features/audit-trail) covers the reports you can run.

## Only the right people get in

Not everyone in your organisation needs to see every contract.

- **Roles and permissions** on Team and up. Each role decides what a person can see and do.
- **The audit trail report** is open only to members whose role allows it.
- **Workspaces are kept apart.** One customer's documents can't be returned to another.
- **Single sign-on** on Enterprise. Your team signs in with SAML, and SCIM adds and removes users automatically.

![The Roles and Permissions settings page, with the Owner, Admin and Sender roles and the Admin role's permission groups](https://flowsign.app/blog/settings-roles-and-permissions.png)

*The built-in roles, and the permissions the Admin role grants.*

## Check it yourself

You don't have to take our word for any of this. Anyone holding a signed Flowsign document can check it.

1. Download a signed document from the completed package or the completion email.
2. Open it in Adobe Acrobat or the free Acrobat Reader.
3. Open the signature panel and find the Flowsign seal, with the time it was applied.
4. If the file has been changed since it was sealed, the panel shows the seal as broken.

Flowsign runs a check of its own too. Every download is compared with its fingerprint, and a file that no longer matches is refused.

The best test is your own. [Create a free account](https://my.flowsign.app/signup), send a package to yourself, sign it and open the sealed copy in Acrobat.

Got a procurement or IT review coming up? The [Trust centre](https://flowsign.app/trust) has the full security detail, and the [pricing page](https://flowsign.app/pricing) shows what each plan includes.