How SilverFern handles your data

PIPEDA

SilverFern is built and operated in Canada and follows the 10 principles of PIPEDA (Personal Information Protection and Electronic Documents Act):

• Accountability — single point of contact at privacy@thesilverfern.ca
• Consent — explicit at signup; granular per-feature where appropriate
• Limiting collection / use / disclosure — we collect only what's needed for the service
• Accuracy — users can update their profile at any time
• Safeguards — encryption in transit (TLS 1.3) and at rest, SHA-256 document hashing, PAdES signatures
• Openness — privacy policy publicly available; this page documents our practices
• Individual access + challenge — built-in data export and account deletion in your settings

GDPR (EU residents)

We process personal data of EU users on a legitimate-interest + contractual-necessity basis. Specific GDPR rights:

• Right of access — instant ZIP export at /portal/account
• Right to erasure — instant soft-delete with PII scrubbing; hard purge after 30 days
• Data portability — same export covers it (JSON + signed PDFs)
• Right to rectification — profile edits in dashboard
• Right to object — withdraw consent by deleting your account

We are not (yet) registered under the EU representative requirement of Article 27. If you're a B2B customer requiring a Data Processing Agreement, contact legal@thesilverfern.ca.

HIPAA-aligned

SilverFern is not currently a HIPAA Business Associate. We do not sign BAAs. However, the platform is operated using HIPAA-aligned controls:

• Encryption in transit + at rest
• Access logs for every document view, sign, and download
• Tamper-evident audit trails on every signed envelope
• Account-level and device-level session control
• Configurable retention + erasure

For PHI-related signing, we recommend a vendor with an executed BAA. We're tracking customer demand to determine when to formally pursue HIPAA compliance.

Security controls

• TLS 1.3 for all connections (auto-renewed Let's Encrypt + Cloudflare proxy)
• bcrypt password hashing (cost factor 12)
• SHA-256 hashing on all signed documents (tamper detection)
• PAdES cryptographic signatures (when enabled by sender)
• OpenTimestamps blockchain anchoring (Bitcoin) for tamper-proof timestamps
• HMAC-SHA256 webhook signatures
• HTTP-only secure cookies with SameSite=lax
• JWT-based sessions with revocable JTI for "sign out everywhere"
• Rate limiting on every public endpoint
• Per-key API rate limits scaled by tier

Data residency

All persistent data — Postgres database, signed PDFs, uploaded files — lives in Canada. Our application server is in Toronto.

Cloudflare is our edge proxy and may temporarily route traffic through their global network for DDoS mitigation; no customer data is persisted outside Canada.

Audit trails

Every signed document includes an audit certificate showing:

• Document ID + 12-character public certificate number
• SHA-256 hash of the signed PDF (tamper detection)
• Per-signer name, email, signing time, IP address
• Identity verification method when used (email OTP)
• Optional blockchain anchor (Bitcoin via OpenTimestamps)
• Optional PAdES cryptographic signature

Anyone can independently verify a document at thesilverfern.ca/silverdoc/verify.

Subprocessors

We notify customers via email at least 30 days before adding a subprocessor that handles personal data.