Product Security

Product Security

Authentication Security

Authentication Modes

emSigner has multiple modes of authentication; users can use emSigner native authentication, protocols such as SAML 2.0 and Open ID connect for SSO, or integration with external multi-factor authentication systems through REST APIs, Office 365 Cloud AD, and Google accounts for user authentication.

Password Policy

emSigner's native authentication allows the administrators (only) to configure password policies to be imposed through the administrator settings. Administrators can choose the password complexity (length, alphabets, numbers, upper & lower cases, etc.), aging, and login attempts.

Two-factor Authentication (2FA)

emSigner's native authentication allows two-factor authentication for users through email/SMS based OTP's or through Google/Microsoft/emSigner Authenticator app.

Credential Security

We follow credential storage best practices by never storing passwords in a human-readable format. The storage of credentials is always the result of a secure, one-way hash.

Additional Product Security

Role Based Access Controls (RBAC)

Access to workflows and documents within emSigner is governed by Role Based Access Controls (RBAC) and can be configured at the granular level. emSigner supports various permission levels - at the user level and department level for initiators, signatories/reviewers, administrators, etc. Restrictions can also be imposed on the document level for pre-defined workflows and ad-hoc level workflows, including the document uploaded for signing, attachments (if any), and completion certificates.

Audit Logs

emSigner offers Audit Logs for accounts, with details related to account changes, user changes, actions performed, etc. The Audit Log is available in Administrator settings and can be exported in excel/pdf formats for further analysis. To know more about Audit logs and see what information is captured within the logs. View Audit Logs.

Document Log

emSigner captures various actions performed by the users on a document, which includes the Sent, Viewed, and Signed/Reviewed data along with the timestamp. It also captures the Operating System, browser, and IP address used by the user while performing the action (s) assigned to the participant. View Document Log.

Rate Limiting and Abuse Prevention emSigner implements rate limiting at the API gateway level to prevent misuse and ensure fair usage of API resources. The system monitors API requests at the IP level and applies a pre-defined threshold for permissible request volumes within a specific time window. When this threshold is exceeded, further requests are automatically blocked and an error is returned to the client.

Attachment Authentication (2FA)

emSigner allows the user to configure attachment visibility from the administrator module. Administrators can define whether or not the participants can view the attachment (s) on a workflow level.

Credential Security

We follow credential storage best practices by never storing passwords in a human-readable format. The storage of credentials is always the result of a secure, one-way hash.