Security Practice

Effective date: April 12, 2026•4 min read•ID: k-SECURITY

This document describes the security practice for ksign.co. Please read it carefully. By using our services, you agree to the conditions outlined herein.

1. Information Security Program

ksign maintains a comprehensive written information security program, including policies, standards, procedures, and related documents that establish criteria, means, methods, and measures governing the Processing and security of Customer Content and the ksign systems or networks used to Process or secure Customer Content ("ksign Information Systems") in connection with providing the Services under the Agreement.

Information Security Program

ksign maintains a comprehensive written information security program, including policies, standards, procedures, and related documents.

Acknowledgement of Shared Responsibilities

The security of data, including Customer Content, that is accessed, stored, shared, or otherwise Processed via ksign Services is a shared responsibility between ksign and Customer. ksign is responsible for the implementation and operation of the ksign information security program. Customer is responsible for appropriately implementing access and use controls and configuring certain features and functionalities of ksign Services that Customer may elect to use.

ksign Personnel Confidentiality

ksign will ensure that ksign Personnel: (a) are bound by confidentiality obligations with respect to Customer Content substantially as protective as those set forth in the Agreement; and (b) are subject to appropriate training relating to the Processing of Customer Content.

2. Security Controls

In accordance with its information security program, ksign shall implement commercially reasonable physical, organizational, and technical controls designed to ensure the security, integrity, and confidentiality of Customer Content.

Updates

ksign will maintain programs and routines to keep the ksign Information Systems up to date with the latest upgrades, updates, bug fixes, new versions, and other modifications.

Firewalls

ksign will configure and maintain firewalls to protect both Customer Content and ksign’s non-public data.

Anti-Malware

ksign will use up to date anti-malware tools (including anti-virus software) configured for automatic updates designed to mitigate threats from viruses, worms, Trojan horses, spyware, ransomware, and other malicious code that can reasonably be detected.

Testing

ksign will regularly test its security systems, processes, and controls to ensure they meet the requirements of these Security Practices.

Access Controls

ksign will maintain an access control policy to control Personnel access to any ksign Information Systems that include Customer Content.

3. Use of Third Parties

Third parties engaged by ksign in accordance with the Agreement will, at a minimum, maintain substantially similar levels of security as required by these Security Practices.

General Security

Third parties engaged by ksign in accordance with the Agreement will, at a minimum, maintain substantially similar levels of security as required by these Security Practices.

Data Hosting

Any third-party cloud service provider (“CSP”) that ksign utilizes to host and Process Customer Content, including without limitation its current provider Amazon Web Services, will have at a minimum, industry standard physical security precautions in place and conform to ISO 27001 or equivalent certification standards.

4. Business Continuity and Disaster Recovery

ksign will maintain a disaster recovery (“DR”) program designed to address the recovery of the Services following a disaster. At a minimum, the DR program will include: (a) validation testing of procedures used to regularly create backup copies of Customer Content; (b) annually reviewed and updated inventories listing all critical ksign Information Systems; and (c) annual review, testing and updating of the DR program.

5. Security Breach

ksign will notify Customer in writing without undue delay upon ksign becoming aware of confirmed Security Breach.

Procedure

ksign will investigate and, as necessary, mitigate or remediate a Security Breach in accordance with ksign’s security incident policies and procedures.

6. Auditing and Reporting

ksign conducts various audits, risk assessments, and other monitoring activities to ensure the effectiveness of its security measures and controls on an ongoing basis.

Monitoring

ksign conducts various audits, risk assessments, and other monitoring activities to ensure the effectiveness of its security measures.

Audit Reports

ksign uses external auditors to verify the adequacy of its security measures and controls for the Services, including AICPA SOC2 standards.

Penetration Testing

ksign uses external security experts to conduct penetration testing of the Services at least annually and maintains a year-round bug bounty program.

Customer Audit

If Customer legally requires information for its compliance with applicable laws, ksign will work with Customer to provide requested assistance.

7. Definitions

Key definitions used throughout ksign's security documentation.

Agreement

The agreement that governs Customer’s access to and use of the Services.

Customer

The individual or entity that executes or accepts an Order or registers for free trial access.

Customer Content

Any text, personal information, document layouts, source code, pictures, video, images, or data files uploaded to the Services.

Security Breach

A breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Content.