Third parties that process data on behalf of ArcaSign. None receives documents in clear text or signer identity data except as strictly noted.
CDN, DDoS protection and network proxy
Traffic metadata (IP, headers). Does not access document content.
Storage of encrypted documents
PDF files encrypted with AES-256. The provider cannot read the content: the encryption key is not shared.
Cryptographic RFC 3161 time-stamping
SHA-256 hash of the signed document. Does not receive the full document or personal data.
Payment and subscription processing
Billing and credit card data. ArcaSign does not store payment data — everything goes directly to Stripe.
What we keep, for how long, and what happens when you cancel your account.
Kept while the account is active. Upon cancelling the subscription, you have 30 days to export and download all your cases before they are permanently deleted.
Kept for the entire life of the case and for an additional period of 5 years after the account is deleted, in compliance with the minimum retention periods for legally valid documents in Costa Rica.
Name, email and organization settings are deleted when the account is closed, except where the law requires us to keep them (e.g. billing records for 5 years under Costa Rican tax law).
You can request early deletion of your data by writing to support@arcasign.com. We process these requests within a maximum of 10 business days.
Any interruption or degradation of the service is documented here, including root cause and resolution time.
No incidents on record
We have had no service interruptions since launch.
ArcaSign depends on the digital signature service of the Central Bank of Costa Rica (BCCR). This is its current status.
BCCR external status: bccr.fi.cr
Have questions about privacy, security or how your data is handled?
Document management and legally valid electronic signatures, in a single platform.
San José, Costa Rica