Browse help
Where your documents are kept
Where the files live, who can reach them, and how long we keep them.
Last updated
Your files are held in Cecur's own document storage service, on application servers and databases located in the European Union. That service is operated by Cecur Limited rather than by a third party, and the full list of the outside companies we do rely on is published at Sub-processors.
What is kept where
The uploaded original of every document, the completed signed version, and the certificate of completion all go to the same storage service. The envelope (the document you sent out for signature, together with the people asked to sign it), its recipients, the answers they gave and its audit trail live in our database. Both sit on infrastructure in the European Union.
Our own hosting being in the European Union is not the same as a promise that every piece of personal data stays inside it, and our Privacy Notice does not make that wider claim. Two things genuinely leave. Email is delivered by a United States company, so every signing invitation, reminder and completion notice passes through it, carrying the recipient's address, the document's name and the signing link. The library that draws the pages on the signing screen is served from a content delivery network in the United States, which sees a signer's IP address, browser and referring page but is sent no document content. Both are named, with what each processes, in the Privacy Notice and the sub-processor list.
Who can reach a document
- You and your colleagues, according to what your company has set. Every query is scoped to your organisation, and within it visibility is set separately from role, so a person can be limited to their own work or to their department. See Departments and who can see what.
- Your recipients, through the link you sent them, for as long as that link is live.
- Anyone you send the finished document to, because at that point it is a file in their hands.
- Anyone holding the verification reference printed on the certificate can see, without an account, that the chain is intact, the names of the signers, the times they signed and how many events are recorded. They cannot reach the document itself.
Every request for a file is checked against who is asking before any bytes are served, and the file's fingerprint is checked at the same moment: if it no longer matches the value of record, it is refused rather than handed over. Connections are encrypted in transit, including the connection to the database.
Your documents are never sent to any AI service, and there are no analytics or advertising services on cecursign.io. Our full position on security is at Security and evidence, and the Privacy Notice states what we do and do not claim.
How long we keep them
Your envelopes, documents, signatures and audit records are kept for as long as your account exists.
A draft you never sent can be deleted by you at any time. An envelope that has been sent, and its audit trail, stays on record. That is deliberate: the record of what was sent, to whom, and what happened next is the evidence the whole product exists to produce, and it would be worth considerably less if it could be quietly edited afterwards. Where somebody asks for a signing record to be erased, Data protection and your obligations explains how that request is handled.
If you stop using CecurSign, read-only access for exporting your material remains available for 30 days after the service ends. After that we will delete your data within 90 days of a written request. That deletion is carried out by us as a deliberate operation and it covers both halves: the records in the database and the stored files themselves, meaning the originals you added, the completed signed documents and the certificates. Backups are overwritten on their own cycle and are not edited individually, so a record deleted from the live service is not restored from one.
Those terms are set out in clause 9 of the Data Processing Agreement, which is the document your reviewer will want rather than this page.