Bleinks is operated by Vaitly Limited (company number 16814185), trading as Bleinks. We design the product so trust claims match engineering reality.
Overview
Bleinks runs on a hardened production stack with encrypted object storage for live documents and off-site backups for disaster recovery. Application access for senders uses Firebase Authentication; signing links use single-use tokens.
Encryption in transit
Public traffic uses HTTPS/TLS. Signing links are scoped to a document and expire with the document or within 30 days, whichever is sooner.
Encryption at rest
Live PDFs are stored with server-side encryption. Signed PDFs are written as new immutable object keys — we do not overwrite a completed sealed document.
Access control
Senders authenticate with Firebase. API routes verify Firebase ID tokens (including revocation checks where enabled). Public signing routes never accept sender JWTs; they use the signing token only.
Tenant isolation
Document access is scoped in PostgreSQL. Signers only see the document they were invited to, via their token.
Audit logging
Legally relevant events are written to an append-only audit_logs table. Application roles cannot update or delete those rows. Completed signatures produce an audit certificate alongside the sealed PDF.
Malware scanning
Uploaded PDFs are scanned with ClamAV. Uploads that fail the scan are rejected (fail-closed).
Backups and recovery
Off-site backups use encrypted restic-style workflows to object storage with object lock where configured. Restore procedures are exercised and documented internally.
Retention and deletion
Default retention is 90 days after document completion, configurable for business customers where offered. Account holders can export or delete via Settings (/api/me/export, /api/me/delete).
Subprocessors (summary)
- Hetzner — compute / hosting
- Firebase (Google) — authentication
- Wasabi — immutable backup storage
- Brevo / IONOS — transactional email
- Stripe — payments (when activated)
Customer responsibilities
You remain responsible for choosing appropriate documents, verifying recipient identity where your use case requires it, and obtaining legal advice for high-value or regulated agreements. See our Terms of Service.
Contact
Security questions and vulnerability reports: hello@bleinks.com.
Privacy / Information Officer (Nasir Shiraz): info@vaitly.com.
Bleinks does not display security certification badges we have not earned. Independent assessment status will be published when complete.