Guide
Security & trust
Veylent is designed so that proving a signature never requires exposing a document, and so that the proof doesn’t depend on trusting us.
What is stored where
| Information | Where it lives | Who can read it |
|---|---|---|
| The document | Wherever you keep your files. It is never uploaded to a Veylent server. | Whoever you share it with |
| Signer details (name, email, organisation, position) | Encrypted, on your own Veylent server | Only someone holding the document (the key is in its QR code) |
| Document fingerprint and timestamp | Public blockchain | Anyone, but a fingerprint reveals nothing about the content |
| Accounts, saved signatures, text snippets | Your database | The account holder and your administrators |
How signer details are protected
Each signature’s details are encrypted with their own key (AES-GCM). That key is placed only in the QR code on the signed document, in a part of the web address that browsers never send to a server. When someone scans the code, their own device decrypts the details. Even the verification server never sees the key.
Tamper evidence
- Any change to a signed file, however small, changes its fingerprint and is detected when the file is checked in the Veylent app.
- Each signature covers the file exactly as that person saved it, so the app can show the version every signer saw, and flag anything added afterwards.
- Records on a public blockchain can’t be edited or deleted after the fact, by anyone.
- Only your organisation’s Veylent server can add records to your signing contract, and verification accepts records only from that contract, so look-alike records are rejected.
Access and sign-in
- Sign-in with one-time email codes, Google, or Microsoft. You choose which are enabled.
- Email codes expire after 10 minutes, work only for the address they were sent to, and stop working after a few wrong attempts.
- Sign-in and verification requests are rate-limited to blunt guessing and abuse.
- Per-user limits on how many documents can be signed are configurable.
Operational security
- Runs in your environment, behind your network controls and HTTPS.
- Standard security headers, strict cross-origin rules, and input size limits throughout.
- The server refuses to start with missing or weak settings, such as an example secret or a publicly known test key.
- The source code is available under the Business Source License, so your security team can review exactly what runs.
Legal and compliance considerations
Veylent gives you strong, independent evidence of who signed what, and when. Whether an electronic signature meets a specific legal requirement depends on your jurisdiction and the type of document (for example, ESIGN and UETA in the United States, or eIDAS in the European Union). We’re happy to discuss your requirements with you and your counsel.