---
title: "Security"
slug: "security-and-legalities"
updated: 2026-10-08T16:01:16Z
published: 2026-10-09T17:11:00Z
canonical: "help.quickbase.com/security-and-legalities"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.quickbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and Legalities

How JuicedSign protects agreements, checks recipients' email addresses, and keeps a record of every signature.

## Who can open an agreement

- **Secure link**: each recipient gets their own link by email, and only when it's their turn. Recipients later in the signing order can't open the agreement early.
- **Open limit**: a link can be opened a limited number of times. Set the number in **Max JuicedSign Email Open Attempts** in Account Settings (1 to 10, default 3). When a recipient goes over it, the old link stops working and JuicedSign emails them a new one. See [When a signing link stops working](/quickbase-extensions/docs/manage-agreements#link-limit).
- **Access code**: optionally, a recipient must also enter a code that comes in a separate email. After 5 wrong tries, the agreement is locked for them until you reset the counter. See [Access codes](/quickbase-extensions/docs/access-codes).
- **Access token**: if a firewall blocks the link, the recipient can open the agreement with the token from the email instead. The same limit applies. See [The signing experience](/quickbase-extensions/docs/the-signing-interface#access-token).
- Agreements that are completed, declined, voided, or expired can't be opened for signing.

## Email address checks

When you send, JuicedSign checks every recipient's email address before it creates the agreement:

1. **Format**: the address must be a valid email address.
2. **Deliverability**: an email verification service checks that the address can receive email. Addresses it rates as high risk are rejected, with the reason.
3. **Unsubscribed**: addresses that unsubscribed from JuicedSign are rejected. See [Unsubscribe and resubscribe](/quickbase-extensions/docs/unsubscribe-option).

- Once an address passes, JuicedSign remembers it and doesn't check it again.
- Now and then, the deliverability check rejects an address that works. Check the address, or use another one.
- You can ask support to turn off the deliverability check for your account. Then you're responsible for the addresses: an agreement sent to a wrong address won't reach the recipient.
- For the messages, see [Send an agreement](/quickbase-extensions/docs/agreement-creation#common-messages).

## Audit trail

- For every recipient, JuicedSign records when the agreement was delivered, opened, and signed, with the IP address, browser, and device.
- The agreement history records each event: opened, downloaded, approved, declined, finished later, printed to sign, access code counter reset, and completed.
- JuicedSign records a SHA-256 fingerprint of the document when the agreement is created, and as recipients sign.
- The certificate of completion summarizes the audit trail for each recipient. See [Certificate of completion](/quickbase-extensions/docs/email-messaging#certificate).
- The signed document and certificate are saved to your Quickbase app, or to your own Amazon S3 or Dropbox storage. See [The signed document](/quickbase-extensions/docs/send-to-juicedsign-button-parameters#signed-document).

## Infrastructure

JuicedSign is hosted on Amazon Web Services (AWS), in a tiered architecture:

- **DNS and edge protection**: Amazon Route 53 manages the JuicedSign domain. AWS WAF (Web Application Firewall) filters incoming traffic and blocks common attacks, such as SQL injection and cross-site scripting.
- **Network isolation and load balancing**: all resources run inside an Amazon VPC (Virtual Private Cloud). Elastic Load Balancing distributes requests across the application servers.
- **Compute**: the application runs on Amazon EC2 servers.
- **Threat detection and vulnerability management**: Amazon GuardDuty monitors for threats and anomalous activity. Amazon Inspector continuously assesses the servers for vulnerabilities.
- **Monitoring and alerting**: Amazon CloudWatch alarms track system health, performance, and security events. Amazon SNS sends alerts when they occur. Amazon SQS queues background processing, such as emails.
- **Storage**: documents are stored in encrypted Amazon S3 buckets, with access controls, while an agreement is in progress.
- **Encryption in transit**: all data and documents are transmitted over TLS 1.2.

## Compliance

- **SOC 2 Type II**: compliance documentation is available on request.

### 21 CFR Part 11

FDA 21 CFR Part 11 sets requirements for electronic records and electronic signatures in regulated industries. When you use access codes, JuicedSign provides these Part 11 controls:

| Requirement | How JuicedSign meets it |
| --- | --- |
| **Two distinct identification components** for each signing (§11.200) | The recipient needs both their personal signing link, which only they receive, and their access code, which JuicedSign sends in a separate email. Neither one alone opens the agreement. Send the agreement with an access code for every signer. See [Access codes](/quickbase-extensions/docs/access-codes). |
| **Limited access attempts** | After 5 wrong access codes, the agreement is locked for that recipient until the sender resets the counter. Each signing link can be opened only a limited number of times. |
| **Signature manifestation** (§11.50) | The certificate of completion shows each signer's printed name, the date and time they signed, and their adopted signature. |
| **Signature linked to the record** (§11.70) | The signature is stamped on the signed document itself, and the certificate is saved with it, merged or as a separate file. |
| **Time-stamped audit trail** (§11.10(e)) | Every event is recorded with the date, time, IP address, browser, and device: delivered, opened, signed, approved, declined, access code counter reset, and completed. |
| **Consent to sign electronically** | Each recipient accepts the electronic signature terms before they can sign. The terms are part of the certificate. |

- The access code email comes from JuicedSign separately from the signing request. For a stronger second factor, you can give the code to the recipient through a different channel yourself, for example by phone.
- §11.50 also requires the meaning of each signature, such as review, approval, or authorship. Put it in your document next to each signature tag, for example *Approved by*.
- Approve or Decline tags don't appear on the certificate. For a Part 11 approval, use a Signature or Initials tag instead.
- Part 11 compliance also depends on your organization: validating your system and app, controlling who can send and change agreements in Quickbase, retaining records, and your procedures and training. JuicedSign provides the controls above; your quality and compliance team confirms that your overall process meets Part 11.

## What makes an electronic signature valid

JuicedSign is built around the elements commonly required for an electronic signature to be legally valid. This isn't legal advice; check the rules that apply to your documents.

| Element | How JuicedSign supports it |
| --- | --- |
| **Intent to sign** | The recipient adopts a signature and selects **Click to Sign** and **Finish**. They can decline instead. |
| **Consent to do business electronically** | Before signing, the recipient agrees to use electronic signatures and can read the electronic signature disclosure. The terms are on the certificate. |
| **Identifiable signer** | Each recipient gets their own link, optionally with an access code. Name, email, IP address, and device are recorded. |
| **Record of the signing** | The audit trail, the document fingerprint, and the certificate of completion. |
| **Record retention** | The signed document and certificate are saved to your app or storage, and every recipient gets the signed document by email. |