Your documents, in the region you choose.
Documentas can be hosted in the United States, the European Union or Australia. It is built and run by Actual Reports OÜ, which is certified to ISO/IEC 27001:2022, on the same infrastructure as PDF Generator API.
Three regions, agreed with you
The deployment region decides where your documents are generated, signed and stored. Tell us your region during the walkthrough.
| Region | Typical fit |
|---|---|
| United States | Customers in North America, or anyone without a residency requirement |
| European Union | Customers who need personal data processed inside the EU, for example in Germany or Estonia |
| Australia | Customers in Australia and New Zealand |
Security, in plain terms
ISO/IEC 27001:2022
Actual Reports OÜ runs an information security management system certified by QRC, covering how the software is developed and how the infrastructure is managed.
Encrypted in transit
Connections use HTTPS with TLS 1.2 or 1.3 on PDF Generator API, which generates and signs Documentas documents.
Encrypted at rest
Signed PDFs are copied into Documentas’ own storage, encrypted, and kept until you delete them.
Resilient infrastructure
PDF Generator API runs on Amazon Web Services in at least two availability zones, with infrastructure as code for recovery.
Audit log
Every signer’s events and every submission’s steps are recorded with time and IP address, on every plan.
Roles and access
Owner, Admin, Member and Viewer roles per company. Removed access is recorded, never erased.
GDPR roles
For the personal data you collect with Documentas, such as form answers and the details of the people who sign, your organisation is the controller and Actual Reports OÜ is the processor. The data processing agreement sets out how we process that data on your behalf.
For the data of people who visit documentas.com or book a walkthrough, Actual Reports OÜ is the controller. The privacy policy explains that processing.
Retention and deletion
- Signed PDFs are stored, encrypted, with no expiry date, until you delete them.
- You can delete a signed or declined PDF under your retention policy. A minimal record of who signed and when stays.
- Deleting a form removes its submissions, its documents and its attachments.
- The link in the completion email stays open for 30 days.
- Files uploaded to signature validation are checked and then deleted from the check service.
- When the agreement ends, we return or delete your data as the DPA describes.
Signatures and evidence
Signers type, draw or upload their signature in the browser. The audit log records who opened, reviewed and signed, with times and IP addresses. On paid plans each signing is also sealed with a certificate and a trusted timestamp, so any later change to the file shows. Read what this means legally.
Sub-processors
The services that help us run Documentas are listed in Annex 1 of the data processing agreement.
Reporting a security issue
Write to info@actualreports.com with the subject “Security”. We acknowledge reports and keep you informed while we investigate.
Questions people ask
Questions about your region?
Book a 15-minute walkthrough and tell us where your data needs to stay.
A 15-minute video call. Bring the form or contract you use today.