All your data, always at home

With most signing services that’s a hard question. Ours has a short answer: on our own servers, in Canada, and nowhere else.

Request a demo

Our hardware, our country

We don’t rent space from a hyperscaler and we don’t ship your envelopes to a data centre in another country. NimbleSign runs on machines Nimble owns and operates, in our three Protected B facilities in Aurora, Ottawa and Winnipeg.

Hardware we own

No third-party cloud in the middle. The servers belong to Nimble, sit in our own Protected B certified facilities, and are run by security-cleared Canadian staff.

Every rack in Canada

No foreign parent, no offshore processing, no CLOUD Act exposure. Your envelopes stay under Canadian jurisdiction and Canadian law from the moment you upload.

Kept intact, kept encrypted

Your envelopes are yours alone, protected in storage and in transit, and backed up so a bad day for a hard drive is never a bad day for you.

Residency isn’t the same as sovereignty

It’s the distinction most providers blur, and it’s the one that matters when someone asks who could compel your records.

Data residency

Your data sits in Canada

A “Canada region” from a US-owned provider gets you this much. The servers are here; the company answering the subpoena isn’t.

Data sovereignty

Your data answers to Canadian law

Stored, processed and governed here, with no foreign parent and no foreign court that can reach it. That’s what NimbleSign gives you.

The long version, on nimble.ca

What comes with every signature

Anyone can paste a signature onto a PDF. This is what makes yours hold up.

Proof it was them

Every signer confirms a one-time code before the envelope opens. Where a document needs more, turn on two independent factors: the link goes by email and the code by text, and the email fallback is refused rather than taken quietly.

Proof they meant to

They agree to sign electronically, and that agreement is kept with the envelope.

Proof of when

Each step is timestamped, so there’s no argument about the date.

Proof nothing changed

Every step is hash-chained to the one before it, and the finished envelope is sealed. The certificate verifies against that chain and says pass or fail, so an edit after the fact does not just look wrong - it fails a check anyone can run.

What is actually on the certificate

It is not a badge. It is a PDF generated for every completed envelope, sealed alongside the documents themselves, and this is what it carries.

The envelope and its verdict

The envelope name and ID, who sent it, which assurance level it ran at, when it was created and completed, whether signing was sequential or parallel, and whether the audit chain verifies intact or reports tampering.

Every signer, individually

Name, email and signing order, the moment they opened it, the moment their identity was confirmed, and the moment they signed, with the IP address they signed from.

A fingerprint of everything

A SHA-256 hash of each document as uploaded, as signed and as sealed, and one of each signature image. Any later edit produces a different hash.

The seal itself

Which certificate sealed it, that certificate’s thumbprint, and whether an independent trusted timestamp was applied.

The whole history, numbered

Every event in order, each with its actor, its IP address and its timestamp in UTC.

Anyone challenging a signature is asking for exactly this. It is produced for every completed envelope rather than on request, and it verifies on its own.

Where that leaves you

Two questions every procurement review asks, answered before you have to.

It holds up

A signature made through NimbleSign is a valid electronic signature in Canada under PIPEDA, and in the United States under ESIGN and UETA, because the three things those laws ask for are the three things the record above establishes: who signed, that they meant to, and that nothing changed afterwards.

A small number of federal uses call for a “secure electronic signature”, which is a narrower standard built on certificates from a government-recognised authority. That is not what this is, and we would rather tell you now than have your reviewer find it.

And if you leave

You take everything with you. For 30 days after an account closes you can export your completed envelopes and their certificates in ordinary formats, and what you have already downloaded keeps working: a sealed document verifies on its own, without us and without an account.

There is no version of this where your own records are held behind a subscription.

Bring your privacy officer to the demo

Request a demo