Security and Legalities

How JuicedSign protects agreements, checks recipients' email addresses, and keeps a record of every signature.

Who can open an agreement

• Secure link: each recipient gets their own link by email, and only when it's their turn. Recipients later in the signing order can't open the agreement early.

• Open limit: a link can be opened a limited number of times. Set the number in Max JuicedSign Email Open Attempts in Account Settings (1 to 10, default 3). When a recipient goes over it, the old link stops working and JuicedSign emails them a new one. See When a signing link stops working.

• Access code: optionally, a recipient must also enter a code that comes in a separate email. After 5 wrong tries, the agreement is locked for them until you reset the counter. See Access codes.

• Access token: if a firewall blocks the link, the recipient can open the agreement with the token from the email instead. The same limit applies. See The signing experience.

• Agreements that are completed, declined, voided, or expired can't be opened for signing.

Email address checks

When you send, JuicedSign checks every recipient's email address before it creates the agreement:

1. Format: the address must be a valid email address.

2. Deliverability: an email verification service checks that the address can receive email. Addresses it rates as high risk are rejected, with the reason.

3. Unsubscribed: addresses that unsubscribed from JuicedSign are rejected. See Unsubscribe and resubscribe.

• Once an address passes, JuicedSign remembers it and doesn't check it again.

• Now and then, the deliverability check rejects an address that works. Check the address, or use another one.

• You can ask support to turn off the deliverability check for your account. Then you're responsible for the addresses: an agreement sent to a wrong address won't reach the recipient.

• For the messages, see Send an agreement.

Audit trail

• For every recipient, JuicedSign records when the agreement was delivered, opened, and signed, with the IP address, browser, and device.

• The agreement history records each event: opened, downloaded, approved, declined, finished later, printed to sign, access code counter reset, and completed.

• JuicedSign records a SHA-256 fingerprint of the document when the agreement is created, and as recipients sign.

• The certificate of completion summarizes the audit trail for each recipient. See Certificate of completion.

• The signed document and certificate are saved to your Quickbase app, or to your own Amazon S3 or Dropbox storage. See The signed document.

Infrastructure

JuicedSign is hosted on Amazon Web Services (AWS), in a tiered architecture:

• DNS and edge protection: Amazon Route 53 manages the JuicedSign domain. AWS WAF (Web Application Firewall) filters incoming traffic and blocks common attacks, such as SQL injection and cross-site scripting.

• Network isolation and load balancing: all resources run inside an Amazon VPC (Virtual Private Cloud). Elastic Load Balancing distributes requests across the application servers.

• Compute: the application runs on Amazon EC2 servers.

• Threat detection and vulnerability management: Amazon GuardDuty monitors for threats and anomalous activity. Amazon Inspector continuously assesses the servers for vulnerabilities.

• Monitoring and alerting: Amazon CloudWatch alarms track system health, performance, and security events. Amazon SNS sends alerts when they occur. Amazon SQS queues background processing, such as emails.

• Storage: documents are stored in encrypted Amazon S3 buckets, with access controls, while an agreement is in progress.

• Encryption in transit: all data and documents are transmitted over TLS 1.2.

Compliance

• SOC 2 Type II: compliance documentation is available on request.

21 CFR Part 11

FDA 21 CFR Part 11 sets requirements for electronic records and electronic signatures in regulated industries. When you use access codes, JuicedSign provides these Part 11 controls:

• The access code email comes from JuicedSign separately from the signing request. For a stronger second factor, you can give the code to the recipient through a different channel yourself, for example by phone.

• §11.50 also requires the meaning of each signature, such as review, approval, or authorship. Put it in your document next to each signature tag, for example Approved by.

• Approve or Decline tags don't appear on the certificate. For a Part 11 approval, use a Signature or Initials tag instead.

• Part 11 compliance also depends on your organization: validating your system and app, controlling who can send and change agreements in Quickbase, retaining records, and your procedures and training. JuicedSign provides the controls above; your quality and compliance team confirms that your overall process meets Part 11.

What makes an electronic signature valid

JuicedSign is built around the elements commonly required for an electronic signature to be legally valid. This isn't legal advice; check the rules that apply to your documents.