Security and privacy

#Data we access

• Directory profile data (name, email, title, department, phones, location, photo, manager, groups) with read-only permissions.
• Gmail signature settings only. We never read, store or process email content.

#Protection

• Row-level security isolates every workspace's data in the database.
• SCIM tokens and invite links are stored only as SHA-256 hashes.
• Directory values are escaped before they're put in a signature.
• Every privileged action is recorded in your audit log (Settings → Audit log), which you can filter and export.

#Support access

When you ask us for help, WorkplaceSignatures support may need to look at your workspace. They don't become members and never see your password:

• Every visit has a reason and a time limit (at most 8 hours), and it ends on its own.
• Read-only by default. Support sees what a Viewer sees and can't change anything. Only a small number of senior staff can open a workspace with Admin access (never Owner), for example to fix a template you asked about.
• Staff must use two-factor authentication or a passkey to enter any workspace.
• You can see every visit: owners and admins find them under Settings → Team → Support access (when, read-only or admin, why, and whether it's still active).
• Support is visible to them, too. While staff are inside your workspace, a red banner (with an End session button) shows on every page, including the signature studio.
• Owners can end a visit at any time with End next to an active visit; access stops immediately and the audit log records who ended it.
• Changes are marked. Anything support changes is in your audit log with the actor WorkplaceSignatures support, plus an entry when a visit starts and ends.
• Support never appears in your member list, never counts as a seat, and can't invite people, change roles, billing or the payment method.

#Your account

• Passkeys: Account settings → Passkeys → Add a passkey. Your device asks for Face ID, Touch ID, Windows Hello, your phone or a security key. From then on, choose Sign in with a passkey on the sign-in page: no email or password needed. You can rename or remove passkeys on the same page. Add one on each device you use, or use a passkey saved in your password manager or iCloud/Google account so it works everywhere.
• Two-factor authentication: a passkey sign-in already counts as two-factor authentication (it needs your device and its unlock). If you'd rather keep using a password, go to Account settings → Two-factor authentication → set up an authenticator app; every password sign-in then asks for a code. On the code screen you can choose Use a passkey instead.
• Text message (SMS) codes are not available.
• Sign out other sessions and change your password or email under Account settings. Changing your password signs out your other devices.
• Forgot your password? Use Forgot password? on the sign-in page.
• "Too many attempts": after 10 sign-in tries for one address in 15 minutes (or 5 sign-up, confirmation or reset emails in an hour, or 5 wrong current passwords on Account settings), wait 15 minutes to an hour and try again. A passkey sign-in isn't affected.

#Your data, your way

Export employees, seat history, invoices, the audit log and a templates backup at any time from Settings → General → Export data. After cancellation, data is kept for 24 hours (longer only while a price request you made is pending, up to 7 days) and then permanently deleted. Invoices and payment records are kept.