Built with trust at the center.

Electronic signatures

Confirmly's signature workflow is designed with applicable electronic-record and signature requirements in mind (ESIGN Act and UETA). The signing flow captures:

• Intent to sign — an explicit consent statement the signer must confirm before signing.
• Electronic-record consent — a versioned consent text stored with each signed record.
• Attribution and signature association — the signature image, its SHA-256 hash, and the signer's IP and user agent are bound to the acknowledgment.
• Record retention and reproducibility — a signed PDF is generated and stored with its own SHA-256 hash.
• Access to completed records — completed acknowledgments are retrievable by the authorized agency.

These practices support electronic signature use but do not guarantee legal admissibility or validity in every circumstance.

Communications & consent

Confirmly delivers acknowledgment links to clients via text message on behalf of agencies. Messaging practices include:

• Consent-based delivery — a client provides opt-in consent before any message is sent.
• Opt-out handling — recipients can reply STOP to unsubscribe or HELP for support.
• Delivery tracking — delivery status and errors are recorded against each acknowledgment.

Confirmly does not represent that A2P 10DLC campaign registration is complete, nor that any specific TCPA certification has been obtained. Messaging configuration and registration status should be confirmed with the sending provider before relying on a particular sending path.

Data security

Records are protected in transit and at rest on infrastructure supplied by the platform provider:

• Encryption in transit — TLS 1.2 or higher for data moving between clients and services.
• Encryption at rest — AES-256 encryption for stored data.
• Protected API credentials — service credentials are safeguarded and not exposed to end users.
• Access controls — role-based access (admin / user) enforced through row-level security policies.

Encryption specifications reflect the hosting platform's documented controls as they apply to Confirmly's deployed data.

Record integrity

Each acknowledgment is preserved with integrity safeguards:

• Timestamped acknowledgments — viewed and signed timestamps recorded per record.
• Signature records — signature image and SHA-256 hash stored with the record.
• Document hashing — a SHA-256 hash of the canonical acknowledgment text is verified at signing.
• Document versioning — acknowledgments carry a version, with supersession references between versions.
• Activity history — an audit trail is appended to each record as events occur.
• Retrievable PDF records — a signed PDF is generated and stored for retrieval.

Hashing and versioning support integrity verification. They are not represented as making records tamper-proof or permanently immutable.

Privacy & access

Access to client documents is scoped and protected:

• Private document storage — uploaded files are stored privately and accessed via time-limited signed URLs.
• Authorized agency access — row-level security isolates records by agency and user.
• Protected signing links — public signing links are token-based, hashed, and expiring.
• Appropriate data handling — client data is used to complete the documented transaction.

Infrastructure assurance

Confirmly runs on infrastructure supplied by providers with documented platform security practices, including encryption in transit and at rest.

• Hosting on a managed platform with documented security controls.
• Reliance on the platform provider's transport and storage encryption.

Confirmly is not represented as independently holding SOC 2 Type II, ISO 27001, or equivalent certification. Any such certifications belong to the infrastructure provider and do not transfer to Confirmly.