This is how we work with security today. We only describe what is actually in place — no certifications we do not hold.
Access to data
Every agreement belongs to an organisation and access is enforced at the database level. If you are not a member of the organisation you cannot read its agreements, wherever in the product you try.
Sign-in
Sign-in uses email and password or Google. Sessions refresh automatically and you can sign out of your account at any time.
Uploaded files
Uploaded agreements are stored in a closed area that is not public. Document links are time limited and tied to an authorised user.
Signing links
Each recipient gets a unique link for one agreement. The link only opens that agreement, and every open and signature is logged with a timestamp.
Evidence that cannot be rewritten
Events are stored separately from the agreement text and cannot be altered afterwards through the product. That is what makes the evidence pack worth anything.
What we do not have yet
During the pre-launch phase a few enterprise capabilities are missing.
- No SSO, SAML or SCIM yet.
- No two-factor sign-in yet.
- No completed external audits or certifications.
Report a vulnerability
If you find a security issue, write to security@okwerin.com with a description and steps to reproduce. We confirm receipt and come back with how we will handle it. Never test against other people's accounts or data.