Security & Trust

How a Caseliq signature holds up

• Attribution. Every signer verifies control of their email with a one-time code before the signature screen unlocks. Where the device supports it, the signing act itself is a WebAuthn assertion — a cryptographic signature over the exact document hash, gated by the signer's fingerprint or face.
• Intent. The full agreement is presented inline; signing requires an explicit agreement checkbox, an identity attestation, a typed legal name, and a clearly labelled signing action. The exact consent wording shown is quoted verbatim on the certificate of completion.
• Record. Every step — link opened, summary viewed, code verified, checkbox ticked, signature applied — is appended to a per-agreement hash chain with server-side UTC timestamps. Altering any historical entry breaks every hash after it.
• Tamper evidence. The executed PDF's SHA-256 fingerprint is stored in a global hash chain and anchored daily via a Merkle root that can be independently timestamped (RFC 3161). Anyone can check a PDF at /verify — the file is hashed in the browser and never uploaded.
• Fairness. Plain-English summary first, a document-grounded AI that explains but never advises, no countdown timers, and a decline option on every screen. These are deliberate: an informed signature is a stronger one.

What we deliberately do not claim

Caseliq signatures are simple electronic signatures. We do not claim advanced or qualified signatures under eIDAS, government identity verification, or notarization. Email verification proves control of an inbox at a moment in time; authority to bind a company rests on the signer's attestation — the same posture as every mainstream e-signing product, stated plainly.

Platform security

• Ceremony links carry 256-bit single-use tokens, stored only as hashes.
• Signing is bound to the first device that opens the link.
• One-time codes are salted-hashed, expire in 10 minutes, and lock out after repeated failures.
• Executed documents live in private storage; downloads are authenticated.
• Strict security headers, rate limiting, and no third-party scripts on signing pages.