Overview
Bleinks runs on a hardened single-server production stack in a European data centre, with encrypted object storage for live documents and immutable off-site backups for disaster recovery.
Encryption in transit
Public traffic uses HTTPS/TLS via nginx. Signing links are single-use tokens scoped to a document and expire with the document or within 30 days.
Encryption at rest
Live PDFs are stored in MinIO with server-side encryption (SSE-S3 + KMS). Signed PDFs are written as new immutable object keys — we do not overwrite a completed document.
Access control
Senders authenticate with Firebase Authentication. API routes verify Firebase ID tokens (including revocation checks). Public signing routes never accept sender JWTs; they use the signing token only.
Tenant isolation
Document access is scoped in Postgres. Signers only see the document they were invited to, via their token.
Audit logging
Legally relevant events are written to an append-only audit_logs table. Application roles cannot update or delete those rows. Completed signatures produce an audit certificate alongside the sealed PDF.
Malware scanning
Uploaded PDFs are scanned with ClamAV. Uploads that fail the scan are rejected (fail-closed).
Backups and recovery
Off-site backups use restic to Wasabi with Object Lock. Restore procedures have been exercised and documented internally.
Retention and deletion
Default retention is 90 days after document completion, configurable per organisation. GDPR export and delete endpoints exist for account holders (/api/me/export, /api/me/delete).
Hosting
Application, database and hot object storage run on a Hetzner cloud server. Auth is provided by Google Firebase. Transactional email currently uses IONOS SMTP from hello@bleinks.com.
Subprocessors (summary)
- Hetzner — compute / hosting
- Firebase (Google) — authentication
- Wasabi — immutable backup storage
- IONOS — transactional email (SMTP)
- Stripe — payments (disabled until deliberately activated)
Customer responsibilities
You remain responsible for choosing appropriate documents, verifying recipient identity where your use case requires it, and obtaining legal advice for high-value or regulated agreements.
Contact
Security questions and vulnerability reports: hello@bleinks.com.
Bleinks does not display security certification badges we have not earned. Penetration testing status will be published when an independent assessment is complete.