Skip to main content

Check the safeguards before you switch.

Moving client contracts out of PandaDoc or DocuSign needs more than a lower price. Review how ZSign protects documents, what evidence you can export and which certifications are still pending.

  • Encryption protects documents in transit and at rest.
  • SHA-256 hash chains make changes to signing records detectable.
  • Signed documents are retained for at least seven years.
  • A DPA is available. SOC 2 certification is not yet in place.

20-minute call · top 3 templates rebuilt free · run both tools side by side

Keep access to your signed docs

Run both tools side by side while you test your 3 free template rebuilds. Before cancelling PandaDoc or DocuSign, export signed PDFs and their original audit trails, and check that your team can open them. New ZSign signing records do not replace that evidence.

For your security reviewer

Trust & transparency

In progress

SOC 2 Type II

Audit in preparation. We're putting the evidence-collection automation in place and will engage a CPA firm before pursuing the Type I attestation. Buyers in regulated industries: ask for the latest controls matrix at security@getzsign.com.

In place

Responsible disclosure

security@getzsign.com — we acknowledge within 1 business day, triage in 5, and credit the reporter in our changelog (with consent). No bug-bounty program yet, but we'll discuss case-by-case.

In place

Data Processing Agreement (DPA)

Standard DPA available for any paid customer. Review the current DPA template or request a counter-signed copy via support.

In place

Multi-tenant isolation

Document access is scoped to your organization. Database row security and automated checks help prevent access across customer accounts.

Planned

Status page

A public uptime and incident history page is planned. For current service or incident information, contact security@getzsign.com.

In place

Sub-processors list

Disclosed in the Data Processing Agreement and on request to security@getzsign.com. Customers are notified at least 30 days before any sub-processor change.

Questions about security?

Send your client's security questionnaire or ask for a DPA and the current controls matrix before moving any contracts.

security@getzsign.com