Certifications & Regulatory Compliance

​

Compliance Status Overview

---

​

SOC 2

SOC 2 (Service Organization Control 2) is a framework for managing and auditing the security, availability, processing integrity, confidentiality, and data privacy in cloud and IT service organizations, established by the American Institute of Certified Public Accountants (AICPA).

​

What SOC 2 Covers

​

SOC 2 Type II

Documenso maintains SOC 2 Type II certification, which includes:

• Type II audit - Tests controls over a period of time (not just at a point in time)
• Independent auditor - Third-party CPA firm evaluates controls
• Annual renewal - Audits conducted annually to maintain certification

​

Obtaining SOC 2 Reports

SOC 2 reports are available to customers and prospects under NDA:

• Visit documen.so/trust to request access
• Reports include detailed control descriptions and test results
• Available for due diligence and vendor assessments

---

​

21 CFR Part 11

21 CFR Part 11 is a regulation by the U.S. Food and Drug Administration (FDA) that establishes the criteria for electronic records and electronic signatures to ensure their authenticity, integrity, and confidentiality in FDA-regulated industries.

​

Industries Affected

21 CFR Part 11 applies to organizations in:

• Pharmaceutical manufacturing
• Medical device manufacturing
• Biotechnology
• Clinical research and trials
• Food and beverage production
• Any FDA-regulated industry using electronic records

​

Main Requirements

​

Electronic Signature Requirements

Under 21 CFR Part 11.50, electronic signatures must:

​

Part 11 Compliance Features (Enterprise)

The following features are available with Enterprise licensing for 21 CFR Part 11 compliance:

• Validation documentation - IQ/OQ/PQ documentation
• Enhanced audit trails - Extended retention and reporting
• Advanced access controls - Granular permissions and approval workflows
• Compliance templates - Pre-configured workflows for regulated industries
• Signature meanings - Customizable signature manifestations
• Training records - User training and certification tracking

​

Self-Hosted Part 11 Compliance

Self-hosted deployments seeking 21 CFR Part 11 compliance should:

---

​

ISO 27001

ISO 27001 is an international standard for managing information security, specifying requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

​

What ISO 27001 Covers

​

Current Implementation

While formal ISO 27001 certification is planned, Documenso already implements many ISO 27001 controls:

• Information security policies
• Risk assessment processes
• Access control and authentication
• Encryption at rest and in transit
• Incident response procedures
• Security monitoring and logging
• Vendor security assessments

​

Timeline

ISO 27001 certification is targeted for 2025. Progress updates are available on the roadmap.

---

​

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. law designed to protect patient health information’s privacy and security and improve the healthcare system’s efficiency and effectiveness.

​

HIPAA Applicability

HIPAA applies to:

• Covered entities - Healthcare providers, health plans, healthcare clearinghouses
• Business associates - Vendors that process PHI on behalf of covered entities

If you use Documenso to process Protected Health Information (PHI), Documenso acts as a business associate and must comply with HIPAA.

​

HIPAA Requirements for Business Associates

​

Business Associate Agreement (BAA)

A BAA will include:

• Permitted uses and disclosures of PHI
• Safeguards to protect PHI
• Breach notification obligations
• Termination procedures
• Subcontractor requirements

​

Self-Hosted HIPAA Compliance

Self-hosted deployments used for PHI should implement:

• Encryption at rest and in transit (TLS 1.2+)
• Access controls and authentication (MFA recommended)
• Audit logging of all PHI access
• Automatic session timeout
• Secure backup and disaster recovery
• Documented security policies and procedures
• Workforce training on HIPAA requirements
• Risk assessments and mitigation

​

Timeline

Full HIPAA compliance and BAA availability are targeted for late 2025. Track progress on GitHub.

---

​

Other Compliance Frameworks

​

GDPR (General Data Protection Regulation)

Documenso complies with GDPR for EU data protection. See GDPR for detailed information.

​

PIPEDA (Canada)

Documenso’s privacy practices align with PIPEDA (Personal Information Protection and Electronic Documents Act) requirements for Canadian privacy law.

​

CCPA (California Consumer Privacy Act)

Documenso supports CCPA compliance through data access, deletion, and portability features.

​

FedRAMP

For U.S. government deployments, consider self-hosting Documenso in a FedRAMP-authorized environment.

---

​

Compliance for Self-Hosted Deployments

Self-hosted Documenso deployments have additional flexibility and responsibility for compliance:

​

Advantages

• Data residency - Store data in your chosen jurisdiction
• Infrastructure control - Choose your own security controls
• Customization - Configure features to meet specific requirements
• Validation - Conduct your own system validation
• Audit access - Direct access to databases and logs

​

Responsibilities

• Infrastructure security - Implement appropriate safeguards
• Configuration - Enable security features correctly
• Monitoring - Detect and respond to security incidents
• Updates - Apply security patches promptly
• Documentation - Maintain compliance documentation
• Training - Train users on security and compliance

​

Compliance Resources

For self-hosted compliance:

• Review Security Configuration
• Implement Audit Logging
• Configure Access Controls
• Review Signing Certificates

---

​

Requesting Compliance Documentation

For compliance-related documentation requests:

​

SOC 2 Reports

• Visit documen.so/trust
• Requires NDA

​

21 CFR Part 11

• Contact sales for Enterprise licensing
• Validation documentation included with Enterprise

​

Security Questionnaires

• Email: [email protected]
• Standard questionnaires available
• Custom security reviews for Enterprise customers

​

Data Processing Agreements

• GDPR DPA available upon request
• HIPAA BAA (when available)
• Custom agreements for Enterprise

---

​

Disclaimer

Compliance requirements vary based on:

• Your jurisdiction and applicable laws
• Industry-specific regulations
• The type of data you process
• Your role (controller vs processor)
• Specific use cases and risk factors

Consult with qualified legal and compliance professionals to:

• Determine your compliance obligations
• Assess whether Documenso meets your requirements
• Implement appropriate policies and procedures
• Conduct risk assessments
• Prepare for audits and certifications

---

​

Related

• GDPR - Data protection compliance
• E-Sign Compliance - ESIGN, UETA, eIDAS regulations
• Standards - Technical standards (PAdES, X.509, PDF/A)
• Security Policy - Security practices and measures
• Self-Hosting - Deploy on your own infrastructure