Live check
Anyone drops a saved message. Signet7 hashes it, reads the seal and the listing, and returns a result. The default path does not keep the raw letter. Recipients never install.
Trust Center
What happens to a message.
Send this page to a buyer, a lawyer, or IT. It is the desk for privacy, security, and retention — as the product runs today. A pass on the check is still not a blessing. See what a result means.
Today
Live, off, or not this.
| Control | Today |
|---|---|
| Public check keeps the letter | Off. The letter is hashed in memory. Default check does not keep it. |
| Evidence ledger | Off unless an authorized operator turns it on. Then hashes and check facts — not the readable email. |
| Company desk | Live. Work email, people, named work emails. No Signet7 password. We email a one-time link. |
| Desktop app | Unsigned preview. Named work emails on the office computer that runs it. The desk can show last-seen. Not message bodies. |
| Optional records vault | Off unless they turn it on. They hold the recovery key. Cap 10 GB. Recipients never use it. |
| Checkout / Stripe | Off. Stripe is not a live subprocessor. |
| Ads, pixels, model training | Off. We do not sell personal data. We do not train a generative model on company mail. |
| SOC 2, ISO, FedRAMP | Not this. No certification, no pen-test report on this page. |
Data
Three doors. Three different piles.
Company desk
The company names work emails, people, and listing keys. Signet7 does not keep a password for that account. Status lines from the app can show last-seen. Bodies do not.
Company app
Runs on the office computer that they set up. It sits on named work emails. Optional vault, if they turn it on, stays on that office computer. Signet7 cannot read those letters.
Security
How the product is built to fail closed.
Seals
Supported mail uses Ed25519. A torn seal fails the check. A pass means the protected words still match that key — not that the email is wise or safe to pay.
Unknown actions
The decision surface fails closed on an unknown action. Signet7 returns allow or block. The caller still has to enforce it.
Download
The zip is an unsigned preview. Windows SmartScreen and Mac Gatekeeper will warn. Using named work emails still needs a company account. Recipients should not download it.
Retention
How long it stays.
Letters
Not kept by default. Transient uploads are deleted after the check. There is no seven-year default. Counsel still decides what the company must keep.
Ask us to delete
Email samuel.sanderson@signet7.io with the word Delete. Or call POST /api/v1/privacy/deletion-request on an operated instance. That purges transients. It does not silently rewrite historical hash rows.
Cancel
Checkout is not live. There is no converting trial. See Cancel.
Who else
Who can see a scrap of this.
| Who | Why | Today |
|---|---|---|
| GitHub Pages | This website | Live. Ordinary request logs. |
| Amazon Web Services | Optional private deploy | Not claimed as a live production account on this page. |
| Stripe | Checkout adapter | Not a live subprocessor. |
| Their mail host | IMAP or Microsoft Graph if they connect it | They control that. Signet7 does not become their mail host. |
Full list: Data providers. AI use: AI.
Papers
The long documents.
Privacy and Terms are still draft until counsel signs them. This Trust Center is how the product behaves now. It is not those contracts.
Privacy · Terms · Providers · Safety · Disclaimer · Contact
Security reports: samuel.sanderson@signet7.io.