control_area: access-control

control_name: Access control

statement: Access control: SSO/MFA; RBAC; key rotation and secrets management.

source_section: Annex II — Security measures (summary)

extracted_from: content

confidence: high


control_area: continuity

control_name: Business continuity

statement: Continuity: backups, redundancy, disaster-recovery objectives.


control_area: cryptography

control_name: Encryption

statement: Cryptography: TLS in transit; encryption at rest where applicable; keys protected by FIPS 140-validated HSMs (Level 3 where applicable).

caveat: Where applicable.


control_area: customer-controls

control_name: Customer controls

statement: Customer controls: API key hygiene; permission scoping; revocation tools.


control_area: governance

statement: Governance: policies, least privilege, background-checked personnel.


control_area: incident-response

control_name: Incident response

statement: Incident response: runbooks, on-call, breach notification.


control_area: monitoring

control_name: Monitoring

statement: Monitoring: centralized logs/metrics with AWS CloudWatch; alerting.

deployment_scope: Customer-managed deployment


control_area: sdlc

control_name: SDLC and vulnerability management

statement: SDLC: code review, dependency scanning, CI secrets hygiene.


control_area: systems-security

control_name: Systems security

statement: Systems security: hardened images, patching, change control, segmentation.


control_area: vendor-risk

control_name: Vendor risk

statement: Vendor risk: Subprocessor due diligence; SCCs/UK addendum as needed.


control_area: vulnerability-management

statement: Vulnerability management: scanning and periodic penetration testing.


control_name: HIPAA operations-only scope

statement: The Services are not designed to receive or store PHI. Customer must not send PHI in document content, filenames, content-derived metadata, or support materials. If required, TS may execute a HIPAA Business Associate Rider (Operations-Only) that covers Operational Metadata (e.g., API logs, SHA-256 digests, certificate/validation status data) and expressly excludes document content. See our HIPAA Rider.

deployment_scope: Account, billing, support, and site data

caveat: Operations-only scope.

source_section: HIPAA (operations-only)

evidence_text: The Services are not designed to receive or store PHI. Customer must not send PHI in document content, filenames, content-derived metadata, or support materials. If required, TS may execute a HIPAA Business Associate Rider (Operations-Only) that covers Operational Metadata (e....


control_name: International transfer safeguards

statement: Where Customer Personal Data is transferred to TS in the U.S. or another third country, the parties incorporate the appropriate Standard Contractual Clauses (EU 2021/914 C2P) and, as applicable, the UK IDTA/UK Addendum and Swiss addenda. If there is conflict, the SCCs/addenda control for the transfer.

source_section: International transfers

evidence_text: Where Customer Personal Data is transferred to TS in the U.S. or another third country, the parties incorporate the appropriate Standard Contractual Clauses (EU 2021/914 C2P) and, as applicable, the UK IDTA/UK Addendum and Swiss addenda. If there is conflict, the SCCs/addenda ...


control_area: retention

control_name: Retention, return, and deletion

statement: At termination or upon Customer request, TS will delete or return Customer Personal Data, unless retention is required for legal, security, audit, or trust-program reasons; in that case, TS will protect the data per this DPA and delete on the next standard cycle. Typical retention windows are described in the Privacy Policy.

source_section: Retention, return & deletion

evidence_text: At termination or upon Customer request, TS will delete or return Customer Personal Data, unless retention is required for legal, security, audit, or trust-program reasons; in that case, TS will protect the data per this DPA and delete on the next standard cycle. Typical reten...


control_name: Security incident notification

statement: TS will notify Customer without undue delay after becoming aware of a Personal Data Breach involving Customer Personal Data and will provide information reasonably available to assist Customer with legal notification duties and remediation.

source_section: Security incidents


control_name: Authorization & flow-down

statement: Authorization & flow-down. Customer authorizes TS to use Subprocessors to provide the Services. TS will impose data-protection obligations no less protective than those in this DPA and remains responsible to Customer for each Subprocessor’s performance of those flow-down obligations (subject to the limitations in the Agreement).

caveat: Subject to stated conditions.

source_section: Subprocessors

evidence_text: Authorization & flow-down. Customer authorizes TS to use Subprocessors to provide the Services. TS will impose data-protection obligations no less protective than those in this DPA and remains responsible to Customer for each Subprocessor’s performance of those flow-down oblig...


control_area: architecture

control_name: Hash-only workflow

statement: Hash-only workflow. We process SHA-256 digests, timestamps, and certificate status (OCSP/CRL) required for signing/verification.

deployment_scope: Service operations

source_section: Architecture at a glance


control_name: Hosted in the U.S.

statement: Hosted in the U.S. Infrastructure runs on AWS U.S. (Central).


control_name: No PDF storage

statement: No PDF storage. We do not ingest, store, or inspect document content or filenames.


control_name: Access control

statement: Access control. SSO/MFA, role-based access (RBAC), least privilege, audited admin actions.

source_section: Core security controls


control_name: Business continuity

statement: Business continuity. Backups, redundancy, and disaster-recovery objectives for critical systems.


control_name: Encryption

statement: Encryption. TLS in transit; encryption at rest where applicable.


control_name: Key management

statement: Key management. Signing keys are protected by FIPS 140-3 Level 3-validated HSMs; keys are generated, stored, and used within the cryptographic boundary.


statement: Monitoring. Centralized logging and metrics via AWS CloudWatch; alerting and incident response runbooks.


statement: SDLC & vulnerability management. Code review, dependency scanning, secrets management, periodic penetration testing.


control_name: (a) Roles

statement: (a) Roles. We act as a service provider/processor for customer content and as a business/controller for account, billing, and site interactions. (b) Sales/sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. (c) Rights. You may have rights to know, delete, and correct certain personal information, and to not be discriminated against for exercising rights. Submit requests to privacy@trusted-signatures.com. (d) Disclosures. Categories collected align with §2; sources include you/your organization, your devices, and our service providers; purposes are in §3; disclosures are in §4.

source_section: 11. Additional disclosures for California & certain U.S. states

evidence_text: (a) Roles. We act as a service provider/processor for customer content and as a business/controller for account, billing, and site interactions. (b) Sales/sharing. We do not sell personal information and do not share it for cross-context behavioral advertising. (c) Rights. You...


statement: (a) No PDF storage. TS does not upload or store your PDF documents for Publisher sealing; we may process and retain non-content document digests and verification metadata for audit and fraud-prevention. (b) Identity products. For Publisher Identity (AATL OrgID / EU Advanced OrgID), identity data you supply is used to coordinate with CAs/RAs and related trust services for issuance, revalidation, suspension, or revocation. CA/RA decisions and program rules (e.g., AATL/EU trust lists) govern lifecycle outcomes. (c) Long-term validation (LTV). If you instruct TS to attach OCSP/CRL and/or RFC 3161 timestamps, associated third-party validation metadata may be processed and retained to support verification.

source_section: 12. Product-specific notes

evidence_text: (a) No PDF storage. TS does not upload or store your PDF documents for Publisher sealing; we may process and retain non-content document digests and verification metadata for audit and fraud-prevention. (b) Identity products. For Publisher Identity (AATL OrgID / EU Advanced Or...


statement: We never upload or store your PDF documents.

source_section: 2. Information we collect


statement: We keep personal information only as long as necessary for the purposes in this Policy or as required by law. Illustratively:

source_section: 5. Data Retention