Security & compliance
Guarded like the records they are.
Signed forms are legal records. We treat them that way — with binding signatures, a complete audit trail, encryption, and a data policy you can actually read.
ESIGN & UETA
Every signature meets federal ESIGN Act and state UETA standards, with signer intent captured explicitly.
Complete audit trail
Timestamps, IP addresses, device details, and document hashes recorded for every view and signature.
Encrypted end to end
TLS 1.3 in transit, AES-256 at rest, hosted in the United States with daily encrypted backups.
Your data stays yours
Export every document and its history at any time. No lock-in, no hostage negotiations.
Our commitments
What we do, in specifics.
Security pages are usually a wall of reassuring adjectives. Here is the actual list.
How signatures work
Each signer confirms their intent, sees the full document, and signs with a drawn or typed signature. We record the timestamp, the signer’s email, their IP address, and a SHA-256 hash of the signed file. If the document changes, the hash changes — which is how you can prove it didn’t.
Who can see what
- Owners and admins see every document in the workspace.
- Members see the documents they created or were assigned.
- Signers see only the document they were asked to sign.
- Nobody else — links expire and can be revoked at any time.
Data retention and deletion
Documents stay in your library until you delete them, or until your account is closed. Deleted documents are removed from active storage immediately and purged from encrypted backups within 30 days. You can export everything first — as PDFs, with a CSV of the audit history.
Schools, minors, and student records
Schools use Sidekick to collect family permissions, not to store academic records. We don’t sell data, we don’t train advertising models on it, and we don’t share it with third parties beyond the infrastructure providers required to run the service. Student information is limited to what a form asks for, and families can request deletion at any time.
Accessibility
Forms are built to meet WCAG 2.1 AA: keyboard navigation, visible focus states, labeled fields, and signature pads that work with assistive technology and without a mouse. If something isn’t working for a family you serve, tell us and we’ll fix it.
Need a security review packet? We’ll send our data processing addendum, subprocessor list, and retention policy. Email security@sidekickforms.com — a human replies.
Safe by default
Paperwork you can stand behind.
Legally binding, fully auditable, and simple enough that a volunteer can use it on the first try.