How we protect your documents
Plain answers about where your files go, how signatures are secured, and what we have not done yet.
Your files stay on your device when they can
Split, merge, compress, rotate, watermark, protect, unlock, OCR, convert and annotate all run inside your browser. Those files are never uploaded to NyxPrism.
Files are only sent to our servers when the feature needs it: signature requests, document sending, My Documents, and the AI tools. The Privacy Policy explains each one.
Signatures
Tamper-evident seal
Every completed document gets a digital seal (PAdES). If anyone changes the PDF after signing, PDF readers show that the seal is broken.
Certificate of completion
A final page lists every signer, their email, and when they viewed and signed.
Audit trail
Each step is logged with the time, IP address and browser: sent, opened, viewed, signed or declined.
Private signing links
Each signer gets their own hard-to-guess link that expires after 30 days. Requests can also need an access code.
Being upfront: right now the seal uses a certificate NyxPrism issued itself. It still catches any change to the PDF. However, Adobe Acrobat will say the signer's identity "could not be verified" until we switch to a certificate from Adobe's trusted list (AATL). That switch is planned.
Security practices
- All traffic uses HTTPS (TLS). The site and API send strict security headers.
- Sign-in uses Google Firebase Authentication. We never see or store your password.
- API keys are stored only as one-way hashes, and you can revoke them at any time.
- Each webhook is signed with its own secret (HMAC-SHA256) so your systems can check it came from us.
- Sign-in tokens for Google Drive and Dropbox are encrypted with AES-256-GCM.
- Every endpoint is rate-limited. Admin access needs two-factor authentication, and every admin action is logged.
- Payments are handled by Stripe. Card numbers never reach our servers.
Healthcare and HIPAA
Signing and notification emails go through Paubox, a HIPAA-compliant email provider. Email contents are kept general, and the document is only opened through the secure signing link.
Being upfront: NyxPrism is not SOC 2 audited yet. If your organization needs a Business Associate Agreement (BAA) or a security questionnaire, contact us before sending patient information.
Your control
- Delete signature requests, sent documents and stored files from the dashboard whenever you like.
- Download a copy of your account data, or delete your account for good, under Settings.
- Check live service health on the status page.
- Report a security issue to info@nyxprism.com. We reply within 48 hours.