Skip to content

Site search

Type to search Pages

Security & privacy

What we run, who touches your data, and what we don't claim.

This page states what Signura actually runs today — where records live, which providers process personal data, and what remains unbuilt — so a security reviewer can check rather than take our word.

The controls a reviewer can check.

Hosting and where records live

This site is delivered by Netlify. The records behind it are held in a Neon-managed Postgres database provisioned for Signura alone — not a shared multi-tenant store — and traffic between a browser and the service is encrypted in transit.

Named sub-processors, published

These providers process personal data, and no others: Netlify hosts and delivers the site, Neon runs the database, Resend sends transactional email, Plausible measures usage without cookies, and Cloudflare provides the Turnstile check on public forms. The list is published, not furnished on request.

Consent enforced by category

Cookie consent is enforced by category. Usage measurement is cookieless, identifies nobody, and loads only after you have consented. No advertising or cross-site tracking cookies are set.

Abuse prevention without profiling

Public forms are protected by Cloudflare Turnstile, which distinguishes a person from a bot without building a profile of the visitor.

The posture, stated plainly.

What exists here today

It is worth being exact about scope, because vagueness on a security page reads as absence. Signura is pre-launch. This website is the only surface we operate publicly, and it renders no authenticated product: there are no dashboards, no stored customer payloads, and no operational path for staff into a system that does not yet exist.

For that reason we make no claim about role-based permissions, in-product audit logs or an evidence ledger — there is nothing of the kind to inspect, and describing one would be describing something we have not built. When those surfaces exist, we will document them here in the same concrete terms we use for what runs now.

What is automated, and where a human decides

Signura is an AI-born company: AI colleagues carry the recurring operating work, and named humans at Cohort Ventures hold the consequential decisions, approve changes, and carry fiduciary duty for them.

On the live site, the only automation touching a visitor is cookieless usage measurement — which loads solely after you consent by category — and the Turnstile check that keeps automated abuse off public forms. Neither profiles you, and nothing here commits you to anything or acts on your behalf. The reliance mechanics described elsewhere on this site are the product we are building; their governance boundaries — configured scope, value thresholds, expiry, and escalation of anything ambiguous to an accountable human — are set out on our product page, not asserted here as if already live.

What we do not claim

A reviewer deserves the gaps stated as plainly as the controls. We publish no uptime figure and offer no availability guarantee, because we have made no such commitment we could honestly stand behind; inventing one would fabricate the very number a buyer most relies on.

As a neutral exchange, our own role is deliberately narrow: we do not become a party you rely on beyond the integrity of the proof we carry and the accuracy of the freshness and revocation status we report. Everything we collect and why is set out in our Privacy Policy, and what, if anything, is stored in your browser is set out in our Cookie Policy.

For your security review

What a security review actually asks.

What happens if there is a security breach?

We do not publish a breach-notification timetable, because we will not commit to one we cannot yet keep. How we handle personal data is governed by our Privacy Policy, and business customers receive data-processing terms that state our obligations in writing before any data changes hands. If you suspect a weakness, tell us at hello@signura.ai.

Can we get data-processing terms before we send you anything?

Yes. Business customers can request data-processing terms from us in advance, and we agree them before any customer data is processed. Write to hello@signura.ai to start that.

What do your agents do without a human in the loop?

On this website, nothing acts autonomously beyond cookieless measurement and the Turnstile check. In the product we are building, relying-side agents proceed only within the scope, value thresholds and expiry a human governor configures, and route anything ambiguous or high-risk to that human. No material commitment is made on agent discretion alone.

What can I ask you about my own personal data?

You can ask what personal data we hold about you, ask us to correct it, and ask us to delete it. Send the request to hello@signura.ai and a person will handle it.

How do we report a security vulnerability?

We run no paid bug-bounty programme. There is a published disclosure process that sets out what is in scope, what good-faith research means here, and what a reporter can expect back. Report by writing to hello@signura.ai.

Which security certifications do you hold?

We hold no independent security certification and no completed third-party audit today, and we will not claim one we have not earned. What we can show instead is concrete and checkable: what is encrypted, which providers process data, and where a human, not an agent, decides.

Bring us a security question.

If you are the person signing off on using Signura, tell us what your review needs. Write to us and a person will answer — we do not run an automated security desk.