Can your e-signature company read your contracts?

Why most services can read your documents

Most e-signature services describe their protection as encryption at rest and in transit. That means two things:

• In transit: your document is encrypted while it travels between your browser and their servers (HTTPS).
• At rest: it is encrypted on their disks, usually with AES-256.

Both are good practices, and with both, the service holds the keys. It can decrypt your document whenever its software needs to, for example to convert it or render it for viewing, as Adobe's security overview describes. Encryption at rest protects against a stolen hard drive. It does not keep your document away from the company that stores it, or from its staff with the right access.

Three kinds of encryption, side by side

	Encryption in transit	Encryption at rest	End-to-end encryption
Where the document is encrypted	On the connection to the service (HTTPS)	On the service's disks	In your browser, before upload
Who holds the key	The service, at its end of the connection	The service (DocuSign also sells customer-managed keys as a premium add-on)	Only the people you send it to
What it protects against	Someone intercepting the connection	A stolen disk or backup	The service reading stored documents, and a breach of its servers
Can the service read your document?	Yes, once it arrives	Yes, whenever its software needs to	No

What DocuSign, Adobe, Dropbox Sign and PandaDoc say

As published on their own pages on October 11, 2026:

• DocuSign: "Documents are encrypted in transit and at rest using industry-standard AES-256 encryption". Customer-managed keys are available only through its premium Security Appliance add-on.
• Adobe Acrobat Sign: "All data is encrypted in transit over HTTPS ... Any data stored by Acrobat Sign is encrypted at rest using AES 256-bit encryption", and its document processing service handles "encrypting and decrypting files".
• Dropbox Sign: "All documents are stored and encrypted at rest using AES 256-bit encryption".
• PandaDoc: "Data is encrypted when traveling and at rest".

None of the four describes end-to-end encryption, so their services can decrypt the documents they store. We compared 21 e-signature services in October 2026, Attest and 20 others, and Attest was the only one that end-to-end encrypts every document, for every signer, by default. That comparison quotes what each of the 21 says about encryption.

What end-to-end encryption means

End-to-end encryption means a document is encrypted on your device and can be decrypted only by the people it is meant for. Nobody in between holds a key that opens it, including the company that runs the service.

On Attest, it works like this:

1. When you upload a PDF, your browser encrypts it (AES-256-GCM) before it leaves your computer or phone.
2. The key that opens it is locked separately for each person you send it to, so only that person can unlock it, with their passkey or recovery phrase.
3. Attest stores and delivers the encrypted file. It never has a key that opens it.
4. Each signer's browser decrypts the document, and they read it, fill in their fields and sign with their passkey.

Before your browser locks the key to someone, it checks their public key against Attest's public key directory, so not even a key swapped in by Attest would be used.

Only fingerprints go on the public blockchain: short codes calculated from the signed record, which includes the document's own fingerprint, and from the signed pages. A fingerprint identifies exactly which document was signed, and nobody can rebuild the document from it.

What Attest still handles

To deliver a document and prove it was signed, Attest handles the information around the document, as every signing service does: the title, file name, size and type, your note to the signers, your account email, the signers' names and email addresses, where fields are placed and when each step happened. The contents of the document, the text of your contract, stay between you and the people you send it to.

The agreement's certificate shows the title, the file name, the verification code, the fingerprints of the document, the signed copy and the signed state, each signer's name and signing time, the blockchain anchor and each signature's evidence, never the document, and it shows signers' email addresses only to the parties. What each signer's passkey signs carries their name and, in place of their email address, a salted commitment to it (a fingerprint of the address and a secret value Attest gives only to the parties), so the signature evidence carries no email address and the signed copy names signers only by name. The certificate is public by default, so anyone with its link, code or the document's fingerprint can check it, and the sender can make it private, so only the parties see it and anyone else checks a zero-knowledge proof a party shares instead.

Why it matters

Contracts hold prices, salaries, terms, plans and personal details. When a service can read them, your confidentiality depends on that company's internal access controls, its subcontractors and its security, for as long as it keeps your files.

Breaches happen at well-known services too: in 2024, unauthorized access to the Dropbox Sign production environment exposed account details and the names and email addresses of people who had only received or signed a document, and Dropbox reported no evidence that documents themselves were accessed (what an e-signature breach exposes). With end-to-end encryption, the documents stored on a service are unreadable ciphertext, so a breach of the service's servers does not expose what your contracts say.

End-to-end encryption also answers a question that is hard to answer otherwise: whether a service uses your documents to train AI. A service that can't read your documents can't train on them.

How to sign privately with Attest

1. Sign in at attest.datahubz.com with your email and set up your signing key with a passkey and a recovery phrase.
2. Upload your PDF. It is encrypted in your browser before upload.
3. Add the people who need to sign and place their fields.
4. Each signer opens their link and approves with a passkey only they control, unlocked with Face ID, a fingerprint or the device PIN. They don't need an account or a password, and they never pay.
5. Everyone receives the same sealed copy, which carries its own evidence and a verifier, so anyone can check it for free.

Your first 2 documents are free, in total. After that, the Signing plan is $5 a month for 20 documents.