Built so the record can be checked, not trusted.
A notarized document should hold up years later in front of someone who has never heard of us. Everything here exists so it can.

The seal is a chain of checks.
Not a picture of a stamp. Each step leaves something a third party can recompute.
- SHA-256 on every sealThe sealed file is hashed and the hash is written to the record. Verification recomputes it; a changed byte shows as altered.
- RFC 3161 timestampTrusted time from an independent authority is applied when the seal is created, so the moment of sealing does not rely on our clock.
- Platform sealThe PDF is signed with the platform's certificate through SSL.com's cloud signing service, and archived as PDF/A with the certificate of completion.
- Public verificationAnyone with the seal code or QR code can open the verification page. No account, no login.

Sample data.
Where the data lives, and who can reach it.
Locked retention storageSealed documents and recordings move to object storage with a retention lock: nothing can be deleted or overwritten during the retention period, which can only be extended.
Signed, expiring linksDocuments and recordings are served through time-limited signed links.
Identity through WorkOSSign-in and single sign-on are handled by WorkOS; the platform never stores passwords.
Identity verificationSigners are verified with a government ID scan and a selfie match before a remote session opens. The result, not the ID image, is written to the session record.
Audit trailEvery session, envelope and order carries a timeline of who did what and when, hashed alongside the record.
TenancyEach office is its own tenant. Roles decide who can see and do what inside it.
We do not hold a third-party security certification today. If your office requires one, tell us during the walkthrough and we will show you what is in place and what is planned.
Reporting a problem.
If you believe you have found a security issue in Notarized, write to us through the contact page and choose "Something else". Include what you saw and how to reproduce it. We read every report and reply from a real inbox.
Please do not test against other customers' accounts or data.