Most eSigning Solutions Have Access to Your Data: Here’s What to Look Out For

Picture yourself 300 years ago. Imagine you’re sending a letter. Like, a real, snail-mail, paper-based letter using the postal service. You’re sending a confidential document and therefore have sealed the letter with an old-school wax seal to make sure nobody tampers with it. 

The letter arrives with the seal intact. But a few days later, you start seeing things happen that can only be known after reading your letter all around. It turns out the postal service, in charge of delivering your letter, had a way to open both the envelop and the seal, read the contents and re-seal it all – with no trace left behind. 

Now instead of a letter, think an eSignature document. Instead of postal service, think eSignature provider. And instead of a sealed envelope, think an encrypted document. 

Most forms of “encryption” still allow for backdoor access to your documents. Unless it’s asymmetric end-to-end encryption, and especially if your eSignature provider operates under the “rule of least privilege” or offers any kind of AI-driven content tools, your privacy is at risk. 

Most eSignature companies talk about security and encryption somewhere in their marketing material. Unfortunately, both terms are vaguely defined and leave ample room for interpretation – at the cost of your privacy. 

Why Even “Encryption” Does Not Prevent Access to Your Documents

How many sensitive documents your organization sends out highly depends on the nature of your business. For some companies, it might be one out of 100 documents that contain sensitive information. For others – think law firms or research labs – it might be most documents. In any case, chances are you’ll sooner or later send an eSignature document the contents of which need to remain confidential. And that’s where the trust factor comes in. 

Many organizations who don’t trust their eSignature provider operate with “no-sign lists”: Those lists define what type of document can be sent for digital signature and – more importantly – what type cannot. No-sign lists are widespread, which might come as a surprise, given how most modern eSignature providers mention security and encryption somewhere in their product description. 

Unfortunately, not all encryption is created equal. There are different grades of encryption – 128bit, 256bit, and so on. Then, there are different “points” where data gets encrypted – often only once the documents have been stored on the providers’ servers. Further, there are different types of encryption, like symmetric and asymmetric. And last but not least, there are different ways to handle encryption, and especially the key required to decrypt the documents. 

Confused yet? Luckily, the solution is simpler than the problem. You’ll want to opt for asymmetric, full end-to-end encryption, which takes care of all the issues mentioned above. If that’s not what you’re using, you’re risking your privacy because there are ways to access your data. 

Here Are the Signs Indicating Your eSignature Provider Can Access Your Documents

Terminology around security and encryption gets technical and confusing very quickly. Luckily, there are clear signs that your privacy is actually not as protected as you might think with your provider. 

Privacy-first providers…	Because without it…
Offer proper encryption	Your most sensitive documents have zero protection
Encrypt locally on your machine	Your data floats around unencrypted for an undefined period of time
Opt for asymmetric encryption	You’re sharing a key with the recipient, creating an unnecessary risk
Have a “rule of no privilege”	There is a privilege to access your data, and it’ll be used by someone
Offer no tools that require access to your content	Your unencrypted data could easily get lost in the endless world of artificial intelligence
Don’t ask for your keys	Anyone who gets access to your documents also gets access to your keys

Still sound a bit confusing? Let’s look at the issues in detail. Go through the following list and ask yourself if that’s happening with your current eSignature provider.

The worst: No mention of encryption at all

If your provider does not mention encryption at all, you should run – fast. In a world where cybercrime is rampant, it’s simply not acceptable anymore to not even attempt to protect your users. Omitting encryption completely is either a sign of laziness or incompetence, and both should ring the alarm bell. 

If your documents float around unencrypted, consider them public knowledge. Sure, you can assume that most people don’t open documents that don’t belong to them, but that’s like living in a rough neighborhood and leaving your front door wide open, hoping nobody wanders in to have a look around. 

Too late: Server-side encryption

If your documents only get encrypted once stored on the providers’ servers, it might be too late already. Between the moment you create them and the time they get encrypted, there are many ways to intercept your data: Your WiFi connection can be accessed, your ISP might track your activities, or someone could simply gain access to your providers’ servers before the documents are actually being encrypted, even if that space is only a few seconds.

If your documents are going anywhere unencrypted, they will likely be intercepted. Once your data leaves your local machine, you lose control over it. You’ll never know how many points it touches until it reaches the destination (your eSignature providers’ servers), and even once it does, you don’t know at what point encryption actually occurs.  

Not enough: Symmetric encryption

With symmetric encryption, the key to encrypt and decrypt your documents is the same, creating a security issue. It’s a simpler solution, easier to integrate, but the flaw is obvious: If someone can get their hands on the encryption key or figure out the encryption code, they can also decrypt the document. 

Just like you don’t share a door lock with your friend, you should not share an encryption key with your recipients. No locks of two houses are the same, and likewise, the key to encrypt a document should always differ from the one required to decrypt it. 

A warning sign: The “rule of least privilege”

While it sounds positive, the ominous “rule of least privilege” actually means that your eSignature provider can access your data. It’s meant to provide peace of mind to users, stating that only people (as in, positions or roles) who absolutely require it will be granted access. But the issue is plain to see: If your eSignature provider has the power to grant someone – anyone – access to your data, Pandora’s box is open. 

You don’t define “privilege”, and you don’t control job titles and positions and your eSignature provider. This means that, while certainly good marketing, the “rule of least privilege” puts access to your most sensitive data completely out of your control, to be changed at a moment’s notice without you ever even knowing about it. 

Not worth it: Smart content tools

AI-driven tools can only be “smart” if they have access to your content. Because without it, they’d be limited to the name of the file, which usually does not reveal anything of use. Features like “Life-Cycle Management and Analytics” or “Proposal Management Software” can certainly help improve the efficiency of your workflow, but they need to know what you’re working on to do so. 

Once you open up your content to Artificial Intelligence, you’ll never know where it ends up. One does not have to be a conspiracy theorist to see the possibilities AI has with unencrypted content: Tracking, analytics, marketing, and mass collection of all kinds of useful data. And that’s a price no increase in efficiency is worth paying. 

(Bonus) A joke: Sending along the decryption keys

Masking it as an efficient process, some providers ask you to send the decryption key along with your encrypted documents. And while there’s no argument that sending one package is more efficient than sending two packages, sending both the encrypted documents and the key required to decrypt them in the same package is just shy of an all-out invitation to grab your content – for anyone involved in transmitting it. From your spying neighbor to your ISP to your government and finally your eSignature provider: If the key is there, it’ll be used eventually, in some shape or form. 

When was the last time you locked your front door and then taped the key to it in plain sight? Right – never. Because doing that simply makes no sense whatsoever.

The Bottom Line

It may seem like a conspiracy theory at first, but unfortunately, it’s the brutal truth – and quite easy to prove: Most eSignature providers have the means to access your sensitive documents. 

That does not mean they will access them, but it certainly means that there is a way to do so, which can be exploited. If the type of encryption offered is anything less than asymmetric and end-to-end, there are risks involved that pose a serious threat to your privacy. 

And your eSignature provider is by no means the only risk: As soon as your documents leave your local device unencrypted or accompanied by the decryption key, they’re up for grabs. Whether that’s your snooping neighbor who exploited your weak WiFi protection, the owner of the coffee shop down the road who monitors all traffic on the WiFi they provide, or your government listening making broad use of lacking privacy laws in many countries: If you’re sending around unencrypted data, a privacy breach is not a question of “if”, but rather “when”. 

Don’t risk your peace of mind – or your business: Opt for asymmetric, full end-to-end encryption and rest assured your data is private. No matter what.