End-to-end encryption for documents, explained

The idea in plain terms

Picture a contract travelling in a lockbox.

• With encryption in transit and at rest, which most e-signature services describe, the courier locks the box on the road and in its warehouse, but with the courier's own keys. The courier can open the box whenever it needs to, and so can anyone who gets hold of the courier's keys.
• With end-to-end encryption, you lock the box before handing it over, with padlocks that only your recipients can open. The courier stores and delivers it but has no key. Neither its staff nor someone who breaks into its warehouse can read what is inside.

In e-signature terms, the courier is the signing service. Can your e-signature company read your contracts? quotes what DocuSign, Adobe, Dropbox Sign and PandaDoc say about their own encryption.

How it works, with the real numbers

End-to-end encryption uses two kinds of keys.

• A document key locks one document. Attest uses AES-256-GCM, a cipher where the same key locks and unlocks, with a fresh random 256-bit key for every document.
• Each person has a key pair. The public key can be shared with anyone and lets them lock something for that person; the private key is the only thing that unlocks it. Attest uses RSA-OAEP with 2048-bit keys and SHA-256.

Sending a document on Attest then goes like this:

1. Your browser creates a document key and encrypts the PDF with it, before anything is uploaded.
2. Your browser locks the document key separately with each party's public key. Before it does, it checks each public key against Attest's public key directory, whose roots are published on the Horizen blockchain, and refuses a key that isn't the published one.
3. Attest stores the encrypted PDF and the locked copies of the key. It holds no key that opens either.
4. Each signer's private key was created in their own browser and is stored only encrypted, under a key derived from their passkey or their recovery phrase. When they open the document, their browser unlocks their private key, unlocks the document key and decrypts the PDF, then checks it against the fingerprint recorded for the agreement.
5. What signers fill in (signatures, initials, dates, names, text) is encrypted in their browsers with the same document key, and the signed copy is stored encrypted the same way.

Attest never sees a private key, a passkey's secret or a recovery phrase, and it stores your document only as ciphertext it can't read.

What changes for your business

Question	A service that holds the keys	End-to-end, on Attest
Can the provider's staff open a contract?	Yes, with the right access	No
What does a breach of its servers reach?	Whatever the attacker can decrypt with the provider's keys	Ciphertext, plus the information around each document
Can it analyze documents or train AI on them?	It can read them, so its policies decide	No: it never has them in readable form
Who gives a new recipient access?	The provider can	Only the sender's browser, approved with the sender's passkey or their recovery phrase
If you lose access, who can open your documents for you?	The provider, since its systems decrypt them	No one but you: your passkey or recovery phrase opens your key, and Attest can't recover the phrase
What does it still see?	Everything	Account and signer email addresses; each document's title, file name, size and type; your note to the signers; the signers' names; where fields are placed; when each step happened; each passkey's label (its device type and browser, such as "iPhone · Safari", with when it was added and last used); and when and how each account signed in (email link or passkey)

That last row matters. End-to-end encryption protects what a document says, not the fact that it exists or who it involves. Keep terms out of titles, file names and notes, and make an agreement's certificate private when the names of the people signing are themselves confidential.

The trade-offs

End-to-end encryption moves some control, and some responsibility, from the vendor to you.

• You keep your own way back in. When you set up your signing key on the Security page, Attest shows a recovery phrase once: 32 characters in groups of 4. Attest can't recover it. Add a passkey on a second device from the Security page too: Attest asks you to unlock your key first, with a passkey you already have or your recovery phrase, and emails you whenever a passkey is added. If you ever reset your key, its passkeys are removed, documents encrypted to the old key can no longer be opened with your account, senders release pending documents to your new key, and Attest emails you; signed copies you already downloaded are ordinary PDFs and still open anywhere. A reset needs only a signed-in session, with no passkey or recovery phrase, so whoever controls your mailbox could reset your key too: keep your email account secure.
• New recipients need you once. Attest can't give a first-time signer access, because it has no key. When they set up their key, you're emailed, and the agreement shows the release as the one action it needs: you confirm it there and approve with your passkey, from your phone if you like. In Attest, nothing is released without that confirmation, and you can untick an address you don't recognize. If you haven't released it, Attest reminds you 1 hour and 6 hours after the signer is ready.
• No server-side reading. Anything that needs a server to read the document, such as server-side summaries, isn't possible. Attest shows documents to the parties by decrypting them in their own browsers.

How to check a vendor's "end-to-end" claim

Vendors don't all mean the same thing by the words. DocuSeal's HIPAA page, for example, says "Documents are encrypted in transit and at rest, safeguarding protected health information end to end" (as published on October 12, 2026), which describes encryption in transit and at rest. Five questions tell you which kind you are getting:

1. Where is the document encrypted: in my browser, or on your servers? End-to-end starts on your device.
2. Who holds the keys that decrypt it? If the answer includes the vendor, it can read the document.
3. How does a new recipient get access? If the vendor can grant access without the sender, the vendor holds a key.
4. If I lose my password or key, can you restore my documents? If yes, the vendor can decrypt them.
5. What do you still see? Every service that delivers documents handles some information around them, such as names and email addresses. Ask for the list.

Attest's answers: in your browser; only the parties, through their own passkeys or recovery phrases; only the sender's browser releases a document to a new signer; no, Attest can't recover your recovery phrase; and the list in the table above. We compared 21 e-signature services in October 2026, Attest and 20 others, and Attest was the only one that end-to-end encrypts every document, for every signer, by default.

Where it matters most

End-to-end encryption earns its keep on the documents a business would least like to see outside the parties:

• Employment: offer letters, salaries and compensation changes.
• Sales and purchasing: price lists, discounts and supplier terms.
• Finance and governance: term sheets, loan agreements and board consents.
• Partnerships: NDAs and the deals that follow them.

How to sign a confidential agreement privately gives the settings for each. Your first 2 documents on Attest are free, in total, and after that the Signing plan is $5 a month for 20 documents; the people who sign never pay.