Legalesign Service Definition Electronic signature and contract management service Legalesign Limited UN House, 4 Hunter Square, Edinburgh, EH1 1QW Tel: 0131 463 9099 Email: email@legalesign.com Overview Legalesign is an accessible online document signing and contract management service. It enables your contracts to be signed immediately from anywhere and for your organisation to organise, track and centrally manage those contracts rapidly and easily. The service is available through a website or an application programming interface (API). Legalesign is highly evolved to minimise the lifetime costs of using esignature software. Typically esignature software by itself creates large efficiency savings over alternatives and Legalesign s approach compounds this key benefit for our customers over the long term: Highly reliable - investment is biased toward infrastructure to minimise downtime (uptime is 99.9%); Adaptability the feature set is highly versatile to handle many different contract types and signing situations as they occur in your organisation; Easily scalable - a unique and highly scalable system architecture that enables the platform to rapidly and easily adapt to your organisational change over time; On-going efficiency improvements - a methodology of continuous improvement is used to deliver continuing and measurable efficiency improvements based on real-life scenarios from customers. Anyone can use Legalesign is designed around being intuitive and usable for the least tech-savvy person, so everyone can access it and training time is minimal; most users need no training or less than a few minutes from a colleague to get started. Online signing reduces the time to completion for your contracts, increases the number of contracts closed (against sending for a wet ink signature) and frees signers from the pain of having to print, sign, scan and return your documents. 1 st October 2015 1
Aside from the paper-saving environmental benefits, the benefits for organisations include having documents securely stored, sent in moments and tracked in real-time. Administration time, and cost, becomes significantly lower, the score for human error is reduced and contracts can be centrally monitored and controlled. The service is used by businesses across the UK including solicitors, insurance companies, accountants, a NHS body and others. The sizes of firms that use the service range from single person businesses to large multi-nationals. Getting started & Implementation A free trial is available from the website and on-boarding will take no more than five minutes. Your first step will be to create a group or team and add users as required. There are a full set of permissions to control the access rights and privileges of your users. Upon access, the system has walk-through explanatory information to inform you (and each new user) how to use features on each part of the site. Following that, support and training are available. Users upload a document (text, Word or PDF) that, subject to permissions, can be shared with other members of the team. After upload, fields can be added to the document that can either be edited upon sending (i.e. you can set up a generic template that can be repeatedly sent with its content customised for each signer), or set as form fields for signer(s) to complete any forms on the document. A document can be sent to multiple signers. The user sends the document out to signer(s) in a few moments and the document is tracked in real-time: when the email is sent, viewed, document opened, form fields complete and signed. Full email notifications are also available to inform users when a document is viewed or signed. The signing process has been studied over 1000 s of transactions and optimised to be easy and straightforward. After signing the document history (or audit trail ) is embedded in the document and the document is converted to standards compliant PDF, which is non-repudiable by being fully certified to the Adobe Certified Document Service level which includes long term validation (LTV). 1 st October 2015 2
Legalesign is highly versatile and extensive settings are available so the system can be customised to the preferences of the administrator(s) or individual users. All forward-facing communications and web pages sent or shown to signers can be customised and branded as required. The system s underlying team-based structure makes it straightforward to scale up through a large organisation, and for it to be easily adapted in line with organisational change over time. New teams can be added on demand. A team is a duplicated fresh copy of the system with additional multi-team management features. Legalesign s structure is also designed around change management practices to facilitate smooth rollout across a large organisation. The multi-team management features enable central visibility over documents across teams while being able to silo teams according to users access permissions and responsibilities. API access is included in the trial and is fully featured but restricted (there is a limit on who documents can be sent to). A trial key can be obtained from the user s personal settings page which is clearly marked on the website. Training Legalesign offers three one-to-one webinars of up to an hour. In addition, support is available during business hours for any immediate queries. Legalesign is made for team use and is therefore designed for easy usability by the least technically minded person. For the API, the support team is available for any questions and assistance for coding. A user dashboard is available for API users to review past requests which include debug error messages. The API documentation can be found at http://apidocs.legalesign.com/. Security Each user must create their own password to access the service. In addition, they can optionally set up two-factor authentication using a personally held device (e.g. mobile phone) that generates rotating PIN codes. Team administrators can select to improve their organisation s security by requiring their users to create passwords that are more complex and to force their users to reset their password every month (or less frequently if preferred). Administrators can easily retire individual users from groups with immediate revocation of access. Password brute force 1 st October 2015 3
protection is built-in. All passwords are securely hashed in storage (and data is encrypted at rest). All communications with the website are encrypted. The SSL certificate and SSL configuration is A graded by Qualsys. Aged SSL protocol are disabled. The system supports Perfect Forward Secrecy. All data is encrypted at rest. We operate a suite of ongoing security tools and methodologies for example, constant monitoring including intrusion detection and integrity checking, file checks, scans and file encryption. Access is strictly limited and controlled. While we have counter-measures for attacks on passwords, please make sure your own password is a good one (8 or more characters, mixed digit/letter and upper/lower case), and we recommend changing it intermittently. Technical requirements The service can be accessed from mobile phone, tablet or PC, and functions across all major web browsers. Internet Explorer 9 and above are supported. But users are encouraged to use the latest versions of browsers for the best experience, besides the wider security benefits gained from keeping their software updated. Technical details Legalesign uses Amazon Web Service (AWS) for its cloud infrastructure with storage and processing based in the United States. The service is a member of SafeHarbor and so relevant EU data privacy protection rights are followed. AWS has extensive compliance in place including ISO27001 and ISO9001, more details can be found at https://aws.amazon.com/compliance/. ISO27001 certification for Legalesign is anticipated for November 2015. The service is designed to be highly fault tolerant by using a highly reliable and fully redundant architecture, that scales upon demand. The service can be briefly unavailable during scheduled downtime for service updates and important servicing works. We give at least two weeks notice, unless a critical update is required, and will only carry out this during off-peak hours, usually 0200-0500UTC. Uptime for the service is currently 99.9%. 1 st October 2015 4
Business continuity Data is replicated across standby machines located in multiple isolated resources in near real-time and frequent point in time backups are taken to ensure seamless failover to alternate resources in the event of individual failures. Data is stored in both a highly available and fully redundant way. Despite extensive backup routines we would always recommend you store copies of your signed documents on your own systems too. For disaster events back-up is on-going to a separate cloud infrastructure in a different geographic area. Ordering and Cancellation Purchase - The service can be purchased on a monthly basis (annual invoicing available upon request). Payment can be made by automated debit at the start of each month, or we can issue an invoice with credit terms of 30 days. If you need to set up a purchase order please communicate with support. Cancellation - To cancel the account the nominated account holder can inform us at anytime in writing. There is no cancellation cost. Thereafter the facility to send documents will expire at the end of that billing month. Documents can still be accessed after termination but cannot be sent. Removal of data - After termination deletion of documents and a full removal of all data is available upon request at cost, otherwise Legalesign engineers periodically purge data for closed accounts (at no cost) but only after approval from the account holder. More information & Contact Details Visit https://legalesign.com or email us at email@legalesign.com or call 0131 463 9099. 1 st October 2015 5