The signature model used by Pipefy is based on an auditable verification process. This model fully complies with the requirements of the U.S. eSignature Act and the European Union's eIDAS, with specific adaptations for the judicial audit context in Brazil. These adaptations include the verification of data such as complete name, date of birth, and the signatory's registration information.
Security measures for legal compliance
Below are the procedures and security measures implemented by Pipefy to ensure compliance with the legislation.
Document authenticity verification
The authenticity of a document in Pipefy is ensured through three digital authentication methods (the authentication triad):
MD5
SHA1
SHA256
Identity verification of the parties
The identity of signatories is confirmed through three authentication layers:
1. Unique code sent via email
Each signatory receives an exclusive link at the provided email address. This link, accessible only by them, confirms that the signatory has access to the specified email.
2. Personal data required at the time of signing
Full name
Date of birth
3. Automatically collected connection data
IP address
Geolocation
Device and browser identifiers
Browsing and access history
These data are stored for audit purposes and can be used in judicial cross-checking if the signature is disputed.
Alternative Authentication Methods
Personalized signature links can be sent directly to the signatory.
Upon accessing the link, the signatory can choose an additional authentication method:
Login via Facebook or Google
Phone number confirmation via SMS
Validation of an email address
Integrity and fraud detection
If a signature is questioned, Pipefy provides ways to verify authenticity and detect fraud:
Cross-checking collected data:
Pipefy's information can be compared with records from the internet provider, email service, or the signer's social networks.
Identifying suspicious access
The platform monitors users who access multiple accounts or attempt to sign documents with different personal data (e.g distinct names)
Cataloging abnormal behavior
The system detects, records, and blocks irregular or suspicious activities.
Requirements for signing
To sign a document on Pipefy, the user must:
Have access to the signer's email.
Possess the signer's personal data (name, and date of birth).
Even with this information, fraud is detected through connection verification and other tracking methods integrated into the system.
Signature appearance
The signature appearance on Pipefy is purely aesthetic. It is not used in the audit or validation process. The visual element is customizable by the signer and does not affect the digital verification of the document.