Built so a signed NDA holds up.
Last updated: 17 June 2026
FRIENDA's whole job is to make a confidential agreement provable later. That only works if the platform itself is trustworthy. Here's how we secure it, in plain terms.
Encryption
- In transit — all traffic uses HTTPS/TLS (1.2+), terminated at Cloudflare's edge.
- At rest — account data, NDAs, and signed PDFs are stored encrypted on Cloudflare's infrastructure (D1, R2, KV).
- Secrets & tokens — signing, download, and session tokens are HMAC-SHA256, purpose-bound, and short-lived; passwords are PBKDF2-hashed; biometric data never leaves your device.
Tamper-evidence & the audit trail
Every signed PDF's bytes are SHA-256 hashed at signing time and stored, so any later change is detectable. The audit trail is an HMAC-chained hash sequence — each event links cryptographically to the one before it, so events can't be silently inserted, reordered, or removed. Anyone can re-check a record at ndafriend.com/verify/<id> without an account: it recomputes the chain and compares the stored document hash. Each signed PDF also carries a Certificate of Completion with signer identity, authentication method, timestamps, IP, and the exact consent text agreed to.
Access control
- Private-by-default NDAs: a signed agreement is reachable only by the involved parties (signed in) or via a short-lived, single-use download link.
- App lock with Face ID / Touch ID and passkeys (WebAuthn).
- Least-privilege access to production; session revocation on password reset.
- A locked-down browser security policy (Content-Security-Policy, HSTS, frame denial) so the web app can't be hijacked to exfiltrate your session.
Legal validity
Signatures are captured following e-signature best practices — affirmative consent, intent to sign, identity and authentication signals, and a retained, reproducible record — to be valid electronic signatures under the U.S. ESIGN Act and UETA and Japan's Act on Electronic Signatures. You decide whether an electronic signature is legally sufficient for your document and situation; we do our best and follow best practices, but don't guarantee enforceability — see our Terms. Our Privacy Policy covers data handling (including India's DPDP Act and Japan's APPI).
Infrastructure & sub-processors
FRIENDA runs on Cloudflare (US), which provides certified, audited data centers (SOC 2 / ISO 27001) — we inherit physical and environmental security from them and own the application logic, authentication, key management, audit-trail integrity, and data deletion on top. The full list of sub-processors is at ndafriend.com/subprocessors.
Certifications
FRIENDA is an early-stage product and does not yet hold its own formal certifications. We're sequencing toward SOC 2 Type II (the standard procurement bar for an e-signature provider) and will publish attestations here as they're achieved. In the meantime we rely on and can point to our infrastructure provider's certifications.
Reporting a vulnerability
We welcome reports from security researchers and will not pursue legal action for good-faith testing that respects the rules below.
- Email security@ndafriend.com with steps to reproduce. We aim to acknowledge within 3 business days.
- Do test only against your own accounts/data, stop at the first proof of a vulnerability, and give us reasonable time to remediate before disclosing.
- Don't access or modify other people's data, run denial-of-service or spam/social-engineering attacks, or degrade the service for others.
- Machine-readable contact: /.well-known/security.txt.
Contact
Security questions or a customer security review — security@ndafriend.com.