Our Infrastructure Commitment
1. Data Storage Location
SignAndGo is committed to storing all customer document data within Australian borders. Our primary infrastructure is hosted on Google Cloud Platform (GCP) in the australia-southeast1 (Sydney) region. This includes:
- All uploaded documents (PDF, DOCX)
- Signed and completed documents
- Signature images and certificate data
- Audit trail records and event logs
- User and workspace data
2. Database Infrastructure
Our database systems are provisioned on Google Cloud Firestore, configured for the Australian region (australia-southeast1, Sydney). Document files are stored in Firebase Storage, also configured for the Sydney region. Database backups are stored within Australian data centers, ensuring your data never leaves the country even during disaster recovery scenarios.
3. Encryption Standards
All data is protected with industry-standard encryption:
- At rest: AES-256 encryption for all stored documents and database records
- In transit: TLS 1.3 encryption for all data transfers
- Signing tokens: Cryptographically secure, one-time-use tokens for document access
4. Third-Party Services
Some ancillary services may process limited metadata through international infrastructure:
| Service | Purpose | Data Processed | Security |
|---|---|---|---|
| Stripe | Payment processing | Billing info only | PCI DSS Level 1 |
| SendGrid | Email delivery | Email addresses | SOC 2 Type II |
| Twilio | SMS notifications | Phone numbers | SOC 2 Type II |
| Google Gemini | AI chat support (optional) | Chat messages only | SOC 2 Type II |
Important: Document content (PDF files, signature images, form data) is never sent to these third-party services. They only receive the minimum metadata required for their specific function.
5. Compliance Framework
SignAndGo is designed to support compliance with:
- Australian Privacy Act 1988 - Including Australian Privacy Principles (APPs)
- APP 8 (Cross-border disclosure) - We minimize overseas data transfers
- Electronic Transactions Act 1999 - Our signatures are legally binding
- Real Estate industry requirements - Suitable for property transactions
6. Enterprise Data Residency Options
For enterprise clients with strict on-shore processing requirements, we offer:
- Dedicated Australian-only infrastructure
- Custom data processing agreements (DPA)
- Audit and compliance reporting
- Option to disable AI features that may use international APIs
Contact enterprise@signandgo.com.au to discuss your specific requirements.
7. Verification and Auditing
You can verify our data residency commitments through:
- Request a data location certificate for your account
- Access audit logs showing where your data is processed
- Review our subprocessor list for complete transparency