Security

What leaves the device

The document stays on the device until the user sends or shares it. The Python SDK posts JSON with the file name, media type, size, and the 96-character SHA-384 digest. Only that digest is anchored on Hedera, as a tamper-evident record. Optional cloud review with HashSign AI runs only when triggered. API JSON bodies are capped at 256 KB.

A consensus message carries docHash (SHA-384, 96 hex characters), hashAlgorithm (SHA-384), a timestamp, and, when hybrid mode is on, hybridAnchor (SHA-384, 96 hex characters). It does not carry the file. A hash shows that a document has not changed since it was sealed. It does not prove who signed it.

Keys and operators

API key secrets are stored as a cryptographic hash. Scopes are read, write, and sign. Rotating a key marks the previous credential rotated and returns the new secret once. Hedera operator credentials stay on the server. They are not browser environment variables.

If the operator id, key, or topic is missing, or a live submit fails, production throws instead of returning the mock topic 0.0.9001. Development can still return that mock receipt.

Browser responses

Production responses send HSTS, a content security policy, and nosniff. Mutations to the API from a browser origin outside the allow-list are rejected before the handler runs.

Questions: support@hashsign.app.