Security built into every document
GingerDocs encrypts your documents, scopes every action to a role, and records the whole lifecycle in a tamper-evident, hash-chained audit log.
How a document is protectedSecure
Built around the controls
behind major standards
GingerDocs is designed to support the encryption, access-control, and audit requirements that frameworks like these are built on.
SOC 2 controls
Designed around the security, availability, and confidentiality criteria SOC 2 is built on.
HIPAA in mind
ePHI is encrypted at rest and in transit, with role-scoped access for healthcare workflows.
GDPR principles
Data minimization, account deletion with a 30-day grace period, and full data export.
Strong audit trail
A hash-chained, append-only log gives every document a verifiable record of events.
Three layers of protection
for every document
Encryption, isolation, and auditability — each implemented independently so a single failure can't compromise your data.
Encryption
Documents are encrypted at rest and protected with TLS in transit. Downloads use short-lived, signed URLs.
- AES-256 encryption at rest
- Download URLs expire after 5 minutes
- Original PDF is never overwritten
Access control
Sessions use httpOnly cookies, recipients sign with revocable tokenized links, and roles scope what each person can do.
- Owner and member team roles
- Revocable recipient signing tokens
- Email one-time codes verify new signing devices
- Share links with password & view limits
- Log out of other devices in one click
Auditability
Every lifecycle event — created, sent, viewed, signed, completed — is hashed and chained to the one before it.
- SHA-256 hash chain, append-only
- Signer IP address & timestamp recorded
- Element edits tracked in version history
Layered by design
Identity, authorization, encryption, and storage are handled as distinct layers, so each document is protected end to end.
Identity
httpOnly session cookies; Google sign-in; tokenized recipient links
Authorization
Owner/member roles; per-document policy
Encryption
AES-256 at rest; TLS in transit
Storage
Encrypted object storage; signed, expiring download URLs
Tamper-evident from creation to completion
Each event is hashed together with the previous one, so the whole history is verifiable and any change to an earlier record breaks the chain.
Document audit log● Verified
hash #4831 ✓
hash #4830 ✓
hash #4829 ✓
hash #4828 ✓
hash #4827 ✓
Anyone can confirm a finished
document is genuine
Every completed document carries a Certificate of Completion with a unique reference number. Recipients and third parties can verify it independently — no GingerDocs account required.
Reference number + email
Enter the reference number printed on the certificate and an email tied to the document to confirm it's authentic.
Download the verified copy
A successful check shows the document's status and lets you download the signed PDF with its certificate attached.
Recipient identity checks
Before anyone views or signs on a new device, GingerDocs emails a one-time code to confirm they control the address.
Have a security or compliance question?
Tell us about your requirements and we'll walk you through how GingerDocs handles encryption, access control, and the audit log for your use case.