Which e-signature services can read your documents?

How we checked

We compared 21 e-signature services, Attest and 20 others. On October 11, 2026, we read what each one publishes about encryption: its security pages, help center, terms and documentation. The table quotes each one in its own words, translated where needed, and says whether the service can decrypt your documents, based on what it describes.

Two terms decide the answer:

• End-to-end encryption: a document is encrypted on your device and can be decrypted only by the people it is meant for. The service in between never holds a key that opens it.
• Encryption at rest and in transit: files are encrypted on the service's disks and on their way to and from it, with keys the service holds, so its software can open a document whenever it needs to. It protects against a stolen disk or an intercepted connection, not against the service itself.

What 21 e-signature services say about encryption

The 20 other e-signature services we compared come first, then Attest. Quotes are as published on October 11, 2026.

Service	What it says about encryption	Can the service decrypt your documents?
DocuSign	"Documents are encrypted in transit and at rest using industry-standard AES-256 encryption"	Yes. Customer-managed keys are a premium add-on (Docusign Security Appliance)
Adobe Acrobat Sign	"Any data stored by Acrobat Sign is encrypted at rest using AES 256-bit encryption"; TLS 1.2 or greater in transit	Yes. Its document processing service handles "encrypting and decrypting files"
Dropbox Sign	"All documents are stored and encrypted at rest using AES 256-bit encryption"	Yes
PandaDoc	"Data is encrypted when traveling and at rest"	Yes
SignNow	"TLS 1.2/1.3 to protect data in transfer and AES-256 bit encryption for storage and data at rest"	Yes
Zoho Sign	Uses the phrase "zero-knowledge architecture", and describes AES-256 at rest, TLS in transit and that "Zoho employees cannot view users' data in plain text"	It describes no mechanism, such as encryption on your device, that keeps its service from decrypting documents
Documenso	Cloud: database contents encrypted at rest, document storage on encrypted object storage, TLS 1.2 or higher in transit; it describes no end-to-end mechanism	Yes. When self-hosted, whoever runs the server holds the keys
DocuSeal	"Documents are encrypted in transit and at rest"; its qualified signature page mentions "end-to-end encryption"	It describes no mechanism behind the end-to-end wording
OpenSign	General wording, such as "advanced encryption methods" for document integrity; no statement on how stored documents are encrypted	No mechanism described
Youtrust (formerly Yousign)	"Data is encrypted when stored using the AES symmetric encryption algorithm with a 256-bit key managed by Youtrust"	Yes. The key is "managed by Youtrust"
Signaturit	Its terms say "the document is encrypted and sealed once the signing process has been completed", with the provider's qualified seal	Yes. By its terms, the provider itself encrypts and seals each document
Skribble	Data is "protected by AES-256 encryption" in ISO 27001 certified data centers in Switzerland or Germany	Yes. It describes encryption at rest, with no end-to-end mechanism
Clicksign	Stored documents are secured with "um algoritmo de cifra AES-256" (an AES-256 cipher); its llms.txt says "Utiliza criptografia de dados de ponta a ponta" (uses end-to-end data encryption)	It describes no mechanism behind the end-to-end wording, or who holds the keys
ZapSign	Says "não temos acesso ao conteúdo dos seus documentos" (we do not have access to the content of your documents); data travels over HTTPS/TLS and is stored on "servidores seguros" (secure servers)	It describes no mechanism behind the statement, such as encryption on your device
D4Sign	"Todos os dados são criptografados de ponta a ponta" (all data is encrypted end to end); documents are stored on AWS "com criptografia" (with encryption)	It describes no mechanism behind the end-to-end wording; the algorithm and the key holder are not stated
Autentique	Its privacy policy says "Arquivos e informações de suporte que possam conter dados sensíveis são protegidos por criptografia em trânsito e em repouso" (files and support information that may contain sensitive data are protected by encryption in transit and at rest); its terms of use have no encryption statement	It describes encryption in transit and at rest, and no mechanism that keeps the service out of documents
Mifiel	Standard documents: its privacy notice (version 3.1, September 25, 2026) lists "cifrado en tránsito y reposo" (encryption in transit and at rest). Its paid "proceso de firma privado" (private signing process) encrypts the document "en tu navegador con las llaves públicas de las e.firmas de los firmantes" (in your browser with the public keys of the signers' e.firmas)	In the private process, no: "ningún tercero, incluyendo Mifiel, puede descifrarlo" (no third party, including Mifiel, can decrypt it). It is a paid add-on, and every signer needs a valid SAT e.firma. For standard documents, it describes encryption in transit and at rest, and no mechanism that keeps the service out of them
Cincel	Its terms say the provider won't access document content "salvo para las acciones indispensables" (except for the essential actions) of the signing method and integrity checks; documents travel and are stored "con cifrado de nivel empresarial (SSL/TLS)" (with enterprise-grade encryption, SSL/TLS)	Its terms allow the access needed to run the signing method and prove integrity; no end-to-end mechanism described
Certicámara	Certifirma web: no encryption statement; documents are "almacenado en la nube para su acceso y verificación" (stored in the cloud for access and verification). Its WSSign product offers document encryption on the customer's own servers	No mechanism described for Certifirma web
ecert	Its Custodia storage "utiliza las últimas tecnologías de encriptación" (uses the latest encryption technologies); Portal Empresa ensures integrity "mediante cifrado" (through encryption)	No mechanism described
Attest	Every document is encrypted in the sender's browser with AES-256-GCM, and its key is locked separately to each party's own key	No. Attest stores your document only as ciphertext it can't read

We also read Multicert, a Portuguese provider of signing certificates rather than a send-for-signature service, so it isn't one of the 21. Its Multicert ID app promises "garantia de encriptação e proteção de dados" (guaranteed encryption and data protection), with no mechanism described.

What the comparison found

Attest was the only one of the 21 we compared that end-to-end encrypts every document, for every signer, by default.

Most services describe encryption at rest and in transit. Five services use the words "end-to-end" or "zero-knowledge", or say they have no access to content, without describing how: Clicksign, D4Sign, DocuSeal, ZapSign and Zoho Sign. That doesn't make their statements false. It means the pages we read don't describe how the service is kept from decrypting documents.

Mifiel, a Mexican service, is the one other vendor that describes encryption that keeps it out of the documents on its own service. In its paid private signing process, the document is encrypted in the browser with the public keys of the signers' e.firma certificates, so Mifiel can't decrypt it. It is a separately contracted add-on, and it works only when every signer holds a valid e.firma, the advanced electronic signature certificate of Mexico's tax authority (SAT). Attest encrypts every document this way on every plan, Free included, and its signers need no special certificate: they set up a passkey from their signing link.

None of the other 20 mentions zero-knowledge proofs, which let an Attest signer prove they signed an agreement without sharing it. Zoho Sign's "zero-knowledge architecture" describes who can access data, not proofs. None of the other 20 has each signer sign with their own passkey either: Documenso offers passkey re-authentication before signing, on its Enterprise Edition and for signers with a passkey on a Documenso account.

How to check any vendor's claim yourself

1. Find where the document is encrypted. End-to-end encryption happens in your browser or app, before the file leaves your device. "Encrypted on our servers" means the service had the file in readable form first.
2. Find who holds the key. Look for phrases such as "keys managed by" the vendor, "customer-managed keys" or "hardware security module". If the vendor holds or can use the key, it can decrypt the document.
3. Look at features that need the contents. Converting files to PDF on the server, generating previews, or summarizing documents with AI all require reading the document. Adobe's security overview, for example, describes a service that converts, decrypts and renders files for viewing.
4. Ask how a new signer gets the key. With end-to-end encryption, the key has to reach the signer without passing through the service in readable form.
5. Ask what happens if you lose every password and key. If support can still restore your documents, the service can decrypt them.

On Attest, step 4 is visible: a first-time signer sets up a passkey from their link, and the sender's browser releases the document to that signer's key once the sender approves with their passkey. Attest can't give anyone access, because it never has a key that opens the document. Attest never sees a private key, a passkey's secret or a recovery phrase, and it can't recover a lost recovery phrase.

What Attest can and can't see

Attest can't read your documents: they are encrypted in your browser with AES-256-GCM before upload and decrypted only in the parties' browsers. What signers type into the document, such as their signatures and text, is encrypted the same way. Attest does see the information around the document, as every signing service does: the title, file name, size and type, your note to the signers, account and signer email addresses, the signers' names, where fields are placed and when each step happened. Only fingerprints go on the public blockchain, never document content, titles or email addresses.

Your first 2 documents are free, in total, and the Signing plan is $5 a month for 20 documents. See how signing works.