Your data is safe
inside the EU
We encrypt every document, comply with GDPR and eIDAS, and your data never leaves the European Union. Security is not an add-on — it is the foundation.
How we protect your data
Two layers of encryption ensure your documents are protected at all times — at rest and in transit.
Encryption at rest
Every document, signature and metadata is encrypted with AES-256 — the same standard used by banks and government institutions. Keys are managed through an HSM (Hardware Security Module) and rotated regularly.
- AES-256-GCM encryption
- Key rotation every 90 days
- HSM key management
- Per-tenant storage isolation
Encryption in transit
All communication between you and our servers uses TLS 1.3. Older protocol versions (TLS 1.0, 1.1) are disabled. HTTPS is enforced via HSTS.
- TLS 1.3 (minimum TLS 1.2)
- HSTS with max-age 1 year
- Perfect Forward Secrecy
- OCSP stapling & CAA DNS records
Access control
Role-based access control (RBAC) ensures every user only sees their own documents. All access events are audited and logged with timestamps.
- RBAC access roles
- Audit log of all actions
- OTP signer verification
Infrastructure & backups
We run on EU-regional infrastructure with daily backups, multi-AZ replication and automatic failover. Backups are encrypted and stored separately.
- Daily backups, 30-day retention
- Multi-AZ replication
- Automatic failover
E-signature under eIDAS
The eIDAS regulation defines three levels of electronic signature. zipzipdoc creates an Advanced signature — legally binding across the EU for the vast majority of business documents.
| Characteristic | Simple signature | Advanced signature | Qualified signature |
|---|---|---|---|
| Identity verification | None | OTP / email | eID card / biometrics |
| Audit trail | Basic | Full (IP, timestamp, OTP) | Full + certificate |
| Legal weight (EU) | Low | High | Highest |
| Suitable for | Internal documents | Contracts, NDAs, employment agreements | Notarial acts, state filings |
| zipzipdoc | Yes — default | Not planned |
The Advanced signature is sufficient for 95% of business documents. A Qualified signature is only required for notarial acts and government filings.
Your rights & privacy
Data in the EU
All data is stored and processed exclusively in the EU. No transfer to third countries without Standard Contractual Clauses.
Data subject rights
You can export, correct or delete all your data at any time. Access via Settings → Data or via our contact form.
DPA available
A Data Processing Agreement is available for all customers to sign. Contact us via our contact form.
Sub-processors (approved, all with DPA)
Security questions
Glossary
Not sure about a term? Browse our glossary of key e-signature and security concepts.
Full GDPR details
Data subject rights, sub-processors, DPO contact — all in one place.
Try zipzipdoc securely
14 days free. No credit card. Your data is safe.
No credit card · 14 days free · Cancel anytime