Privacy Policy
Last updated: September 4, 2026
If the Dutch and the English text differ, the Dutch version prevails. The Dutch text is at /privacy.
Core principle
PARAMANT collects only what is strictly required to operate your account and run the service.
An email address is required to create an account and recover access; it is personal data, and it is stored. No phone number. We do not log IP addresses for analytics or profiling. An IP is processed for security and abuse-prevention only (rate limiting, the session record, an audit log, and the DPA signature record). The audit trail keeps a masked address for up to 400 days, and one log holds a full address for longer than any timer; both are named below. Only a strictly-necessary session cookie (no tracking cookies). No tracking pixels. No analytics. No advertisements. We never sell your data.
How sending works (the ParaSend web app)
Files sent through the web app are encrypted client-side in your browser using post-quantum cryptography (ML-KEM-768 + ECDH P-256 + AES-256-GCM + HKDF-SHA256) before they ever reach our servers. The relay never sees plaintext on that path. The one place it does is the hosted signing ceremony on the /v1 API, where the document is sent to us so that we can run the ceremony; we hold it, sealed at rest under our own key, until that envelope ends.
Files travel encrypted in blocks of at most 5 MB: in the live hand-over in blocks padded to exactly 5 MB, for a one-time link or a send to a person without padding, at the encrypted size. Each block exists only in RAM on our relay server. On the Community plan it is permanently and irreversibly destroyed after the first download (burn-on-read); a paid plan buys more reads per link through the API before that same destruction, up to 10 on Firm and 100 on Enterprise. Encrypted payload data is never written to disk. From a transfer, the only thing persisted to disk is cryptographic hashes in the public Certificate Transparency log: no file content, no keys, no plaintext. (Account data, listed below, is stored separately to run your account.)
Community plan blobs expire after 1 hour maximum. Firm blobs after 24 hours. Enterprise blobs after 7 days. All are destroyed earlier once the last read of the link is spent.
How ParaSign document delivery works
When you request signatures, your browser encrypts the document with AES-256-GCM before upload. The signing relay stores the encrypted capsule with the envelope until its expiry: 30 days unless the request asks for another term, and never longer than 365 days. The relay does not receive document plaintext or the document key. The personal signing link contains the key in its URL fragment; browsers do not send that fragment to the relay.
When a signer places a visible seal or date, the relay stores the signed field type, page number and normalized coordinates in the envelope. It does not receive document text, a drawn signature image or free-form field content. The placement is covered by the signer’s ML-DSA-65 signature.
The recipient must also sign in with the exact invited email address. The link alone cannot retrieve the ciphertext. If you choose Paramant email delivery, Resend Inc. (United States) processes the recipient address, message and complete signing link. It does not receive document plaintext or a key. You can instead create links without sending email.
What we process
| Data | Purpose | Storage | Shared |
|---|---|---|---|
| Encrypted blob (blocks up to 5 MB; padded only in the live hand-over) | One-time secure transfer | RAM only · burn-on-read | Never |
| ParaSign encrypted document capsule | Deliver the document with a signing request | Redis · expires with the envelope | Hosting provider stores ciphertext only |
| Personal ParaSign invitation link | Bind one recipient to one encrypted document and signing slot | Processed during delivery; not written to application logs | Resend (United States) only when you choose email delivery |
| SHA-256 hash of blob | Routing & delivery confirmation | RAM only · deleted after its last read | Never |
| API key (Firm/Enterprise) | Authentication & rate limiting | Loaded from config at startup | Never |
| Device ID (SDK users) | Key routing between sender and receiver | RAM only · cleared on restart | Never |
| Device ID hash (CT log) | Public tamper-evident audit log | Disk · /data/ct-log.json · SHA3-256 one-way hash only | Never |
| Signed delivery receipt | Proof that a transfer was delivered | Redis · 15 minutes, then deleted | Never |
| Aggregated relay statistics | System health monitoring | In-process counters only | Never |
| Email address | Account identity, login, recovery, signing-invite delivery, and telling the sender that someone signed (kept until the document is complete, at most 8 days). The addresses a sender invites to sign are kept readable, not as a hash, because we email those people that everyone has signed; an email cannot go to a hash. They are deleted as soon as the document is complete or someone declines, after 8 days at most. | Stored (server) · also kept as a hash for rate-limiting | Email provider (Resend, United States) for messages we send you |
| Sign-in factors: passkey public keys, TOTP secret (encrypted), recovery codes (hashed) | Account authentication | Stored (server) | Never |
| ParaSign signing public key + fingerprint | Verifiable signing identity | Stored (server) · public half only; the private key never leaves your browser | Public (its hash is in the CT log) |
| Plan + anonymised billing reference | Firm/Enterprise billing | Stored (server) | Payment processor (Mollie, EU) |
| Client IP + user-agent | Security, rate limiting | Session/rate-limit TTL | Never |
| Masked IP in the audit log (1.2.x.x) | Account audit trail | Redis · at most 400 days, and at most 1000 entries per account | Never |
What we never do
- Sell your data, or use it for advertising or profiling
- Log or store IP addresses for analytics or profiling (an IP is used for security and abuse-prevention only, in the logs named below)
- Use tracking cookies or browser fingerprinting (only a strictly-necessary session cookie is set after login)
- Run advertising or tracking scripts
- Share your data with third parties, except the operational subprocessors needed to run the service (hosting, transactional email, and payments, listed below)
- Write Ghost Pipe or ParaShare (the ParaSend web app) transfer payloads to disk. ParaSign request documents are different: their encrypted capsule may be persisted until the envelope expires.
- Load fonts, scripts, styles, or any other resource from a third party. Everything is self-hosted on paramant.app
No third-party requests
Every byte your browser loads on paramant.app comes from paramant.app. No web fonts from Google, no JavaScript or CSS from a CDN, no analytics, no tracking pixels, no embedded third-party widgets. Open your browser’s network inspector on any page: every request goes to one origin, and nowhere else.
This is deliberate. A single request to a third party leaks your IP address and the page you are viewing to that party before you have agreed to anything. So we self-host everything: fonts (a plain system font stack, zero font files downloaded), scripts, styles, and images all come from paramant.app.
What runs the service is operational, never tracking: our own edge (Caddy) terminates TLS directly on our server (see below); transactional email is sent server-side via our email provider; and a payment processor handles billing on its own pages. None of these is loaded into the site, and none follows you across it.
Local storage in your browser
For technical functionality, the following data is stored locally in your browser only. It never leaves your device:
- ECDH + ML-KEM key pairs: generated locally for end-to-end encryption (SDK / Ghost Pipe sessions)
- Nonce registry: replay-attack protection (SDK sessions)
- Status history (
paramant_status_v1): the last 24 hours of relay health checks your own browser made on the status page - Key of a document you sent for signing (
paramant.cosign.key.v1:…): when you send a document for signing on /sign, this browser keeps the key of that encrypted document, so you can open the complete signed document here later. It is your own document; the key is not sent to us. It is wiped when you sign out, when your session runs out, when another account signs in on this browser, when the request is withdrawn, declined or expired, as soon as you open the completed document here, and in any case after 24 hours. - Signing links of a request you sent (
paramant.cosign.links.v1:…): each signer's personal link, with the half of the document key that is also in the invitation, so you can send a signer the invitation again from your dashboard. They are stored encrypted, under a key that belongs to your account and that this browser holds in memory only. That half opens nothing without the invited email address signing in. They are wiped when you sign out, when another account signs in on this browser, when the request is complete or withdrawn, and when the request expires (at the latest after eight days). - Links of a send by name (
paramant.send.links.v1:…): each recipient's personal link, so you can send a reminder with the same link from your dashboard. Encrypted the same way. Such a link opens nothing without the code that goes to the recipient's mailbox. Wiped when you sign out, when another account signs in, when everyone has collected, and when the send closes (at the latest after eight days). - Your half of the key of a document you are asked to sign (
paramant.cosign.share.v1:…): when you open an invitation to sign, this browser keeps the half of the document key from that invitation link, so a link you have sent again later opens the document here too. It is stored encrypted, under a key that belongs to your account. That half opens nothing without the sign-in of the invited email address. It is not sent to us and is erased when you sign out, when another account signs in on this browser, once you have signed, and when the signing period ends (after eight days at the latest). - Which request you came from when you made an account (
paramant:signup-return): when you click “Create one for free” on an invitation to sign, this browser keeps which request and which signer it was, so that you come back to that request after setting up your account. Not the link itself, not the invite token and no key. It is not sent to us, and is wiped once it is used, when you sign out and in any case after 24 hours. - Authenticator tip seen (
paramant.sha1tip.v1): that you have seen the tip after signing in once, so it does not come back at every sign-in - Which account signed in here last (
paramant.local.owner): a hash of the email address, not the address itself. When another account signs in here, this browser wipes the previous account's draft and document keys. It is not sent to us. - Draft of a document you prepared (in IndexedDB, under the name paramant-sign-draft): if your session on /sign expires halfway, this browser keeps the document, the spot and the recipients, so everything is back after you sign in. All of it is encrypted with a key that belongs to your account and is not stored in this browser, so another account cannot open the draft. It is wiped as soon as you send or sign, when you start over, when you sign out, when another account signs in here, and otherwise after two hours. The document is not sent to us.
- Signature placement template (
parasign.placement.tpl.v1): where you last put a seal on a page, so the next document opens the same way - Seen signing fingerprints (
paramant_fp_…): a marker per signing key you have already been shown, so a known key is not flagged as new - Dismissed key-setup notice (
paramant.keysetup.dismissed.v1): that you closed the signing-key banner on your dashboard - A gift code you have not spent yet (
paramant.redeem.code): the code you typed on /redeem before you had an account. A code grants nothing on its own and is not a key to anything; it is kept only so that making an account, which finishes through a link in your email, does not cost you the code. It is deleted the moment the code is used. - Appearance (
paramant.theme.v1): whether you asked the site to follow your system, stay light or go dark, set on /account or with the sun and moon in the menu bar. Without it the site follows your system. Nothing is sent to us; the choice lives in this browser and on this device only. - Passkey / WebAuthn credentials: your passkey’s private key is created and held by your device or password manager. PARAMANT only ever stores its public key, server-side; the private key never leaves your device.
- ParaSign signing vault (IndexedDB): if you sign documents, your post-quantum signing key (ML-DSA-65) is generated and kept in your browser’s IndexedDB, encrypted either with your passkey (WebAuthn-PRF → HKDF → AES-256-GCM) or, if your passkey provider cannot do that, with a passphrase (PBKDF2 → AES-256-GCM). The private key never leaves your device; only its public half is registered to your account.
You can delete all local data at any time: browser settings → paramant.app → Clear site data.
Your API key, and which pages hold it
Your account has an API key. It is stored on our servers; nothing in the list above keeps it in your browser, and no page writes it to local storage. Some pages do load it into memory for as long as their tab is open, and we would rather name them than leave you to guess.
- Sending a file (
/parashare) does not. It asks our server for a session token instead. That token lives fifteen minutes, the relay accepts it on the nine requests a transfer makes and refuses it on everything else, and it is held in the page’s memory only, so closing the tab ends it. Revoking your API key revokes every token minted from it. On a self-hosted relay without our admin panel you can still type a key by hand on that page, and then it is in that browser for as long as the tab is open, which is why the page says so where it offers it. - Your account page (
/account) does, but only when you ask it to. Showing you your key is what that page is for, so it is the one page that still loads it. Opening Advanced account key is what fetches it; a visit that never opens that section never asks our server for the key at all, and nothing of it is on the page. - The pricing and dashboard pages (
/pricing,/dashboard) no longer do. They used to authenticate to the relay with the key itself, to start a checkout and to read your history. They now use the same kind of session token as the send page: a different token, minted for those pages, which the relay accepts on five requests (starting a checkout, spending a gift code on your own account, reading your own history, exporting your own signing audit, and reading the list of documents waiting for your signature) and refuses on everything else. It is not the send page’s token and cannot do what that one does, or the other way round.
Nothing on this list survives the tab. Closing the page ends it, and a later visit starts again from the server.
Servers & jurisdiction
All relay servers run on Hetzner infrastructure in Nuremberg, Germany (EU/DE). There is no infrastructure in the United States or outside the EU. The encrypted files sit only on those servers. Email still goes through Resend in the United States for now. A signing invite carries half of a split key, which opens nothing without the other half that only the signed-in recipient receives. For a send to named recipients the invitation carries the link with the token, and the pickup code is emailed too: whoever reads both emails can open the file. That is the one exception in the chain; we are moving to a Dutch provider. See the sub-processors below.
Network edge
TLS is terminated by our own edge (Caddy), running on the same Hetzner infrastructure in Germany, with post-quantum key exchange. There is no third-party reverse proxy or CDN in front of the site: your connection reaches our server and nowhere else. Short-lived connection metadata (IP, timestamp) is processed transiently for security and abuse-prevention as described above, never for analytics.
Logs that hold an address
One log holds a full client address, and it is not bounded by a timer. We name it rather than let the word “transient” do work it cannot do.
- Edge access log. Our own edge writes a server access log with the client address, the timestamp, the path and the user agent. We read it to tell real visitors apart from scanners, never to build a profile of a person, and it is not exported to anyone. The nginx configuration in this repository logs nothing; the edge in front of it does.
- Account audit log. Every audit entry keeps the network part of the address and drops the host part, so a full address is never written: 1.2.x.x for IPv4 and the first two groups for IPv6. Entries are bounded twice, by age and by count: nothing older than 400 days survives, and an account keeps at most its last 1000 entries. The 400 days is a default an operator can change.
- Admin service log, for contrast. Three operational log lines record a signup attempt, a pending signup and a rate-limited request to reset a second factor. They used to carry the full address, and one of them the account email in plain text. They no longer do: an address is truncated to its network before it is written (203.0.113.x for IPv4, the first three groups for IPv6) and an email keeps one character and its domain (d***@example.com). What lands in the container log is what is left after that.
None of these is used for analytics, profiling or advertising, and none is shared with a third party.
Subprocessors
A few operational providers are needed to run the service. None is loaded into the site, and none is used for tracking:
- Hetzner (Germany, EU): hosting and infrastructure.
- Bunny.net (Slovenia, EU): DNS hosting for paramant.app. It answers the lookup for our name; it is not a CDN or a proxy, and no request for a page or a file passes through it.
- Resend (Plus Five Five, Inc., United States): transactional email only (account verification, signing invites, telling the sender that someone signed (only the number of signatures, no file name or names), telling each invitee that everyone has signed (no link, file name or names), billing notices, and invitations to collect a file sent to named recipients). Resend receives the email address, the subject and the message with the link. For a signing invite that is the complete personal link. For a send to named recipients it also receives the file name the sender chose, and a one-time link with the token that unwraps the wrapped key. Collecting the file also takes a pickup code, and that too goes through Resend to the same address. So whoever reads both emails can open the file. Resend never receives the document itself and is never used for marketing. The transfer to the United States is covered by Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). That is the one exception in the chain; we are moving to a Dutch provider.
- Mollie (the Netherlands: a Dutch company, EU jurisdiction, GDPR-native): payment processing for paid plans. Checkout runs through Mollie today. Every payment is a one-off for the term you buy; there are no subscriptions, because the recurring layer stays switched off until an operator sets it. The relay sends Mollie the amount, a plan description and payment metadata (accountId, product, plan, interval), and no email address while the recurring layer is off. Only when the VAT is reverse charged are the business’s VAT number and the proof of the check added (vat, vatId, vatCheckedAt, vatConsultation). Card data is entered on Mollie’s own pages; PARAMANT never sees or stores card numbers, only your plan and an anonymised reference.
- Moneybird (the Netherlands: a Dutch company, EU jurisdiction): bookkeeping, and only when the operator of this deployment has connected an administration. It then receives the invoice or credit note itself: the document number, date, description, amounts and VAT, the billing details you entered (company name, invoice address, VAT number) and your email address, together with the PDF of the document. It receives nothing about your files, your transfers or your signatures.
- VIES (the European Commission’s VAT number check, ec.europa.eu, European Union): only when a business from another EU country checks out with a VAT number and the operator of this deployment has configured the seller’s VAT number. The relay then asks whether that VAT number is valid, so the VAT can be reverse charged. VIES receives only that VAT number and the seller’s VAT number, no name, email address, address or amount. What VIES answers (the date, the consultation number and the name and address it holds for the number) is kept with the invoice as proof of the check. If no payment follows, it is deleted after 30 days.
What each party receives and never receives, and whether it is active today: current status at /en/partners.
GDPR / AVG
We process the minimum personal data needed to run your account, on a lawful basis (performing the service you request, and our legitimate interest in keeping it secure). You can request access to, or deletion of, your account data by emailing us. The standard Data Processing Agreement (DPA) is published at /dpa and applies to all plans; anyone can sign it electronically, with no account and no paid tier required.
Temporary relay data is never retained longer than the applicable TTL (1 hour for Community, 24 hours for Firm, 7 days for Enterprise). In practice it is destroyed much earlier on download.
Children
PARAMANT is not directed at children under 13. We do not knowingly collect data from minors.
Changes to this policy
We may update this policy. Material changes will be noted via the "Last updated" date above. Continued use of the service after a change constitutes acceptance.
Contact
Questions about this Privacy Policy? Email info@paramant.app.