Discover how Signi simplifies the document workflow in companies like yours.
Updated 9 November 2026
On 6 November 2026, we discovered that an attacker with a registered account had exploited a vulnerability in the application and temporarily gained access to the contact details of people to whom documents are sent for signature via Signi. The data concerned primarily included first name, last name, email and phone number, and for a very limited number of contacts also other stored data such as address, date of birth, company name, company ID, VAT ID, position or custom user fields. We fixed the vulnerability within a few hours and immediately blocked the attacker’s account. Stored documents, their content, checklists, access credentials and other sensitive data were not affected.
On this page, you will find information on what the incident means for you and how we can help.
The incident does not affect you if you have no contacts stored in your workspace, or if you use contacts exclusively for personal purposes. In that case, no further obligations arise for you.
If you have contacts stored in your workspace to whom you send documents for signature in the course of your business or professional activity, you are their controller under the GDPR and Signi acts as the processor. The following steps apply to you.
The incident must be reported to the Office for Personal Data Protection (Úřad pro ochranu osobních údajů) within 72 hours of receiving our email. The report can be submitted via the form on the website uoou.gov.cz, or through the data box qkbaa2n. If you are based outside the Czech Republic, you submit the report to your own supervisory authority.
Notification is not required only where the data breach is unlikely to pose a risk to the affected individuals. For name, email and phone number, the main risk is targeted phishing or vishing. In combination with other data, such as date of birth or address, this risk increases further. We therefore recommend that you submit the report.
You are obliged to inform the affected contacts if the breach poses a high risk to them. Even so, we recommend informing your contacts about the incident. If you decide not to inform them, record the reason for that decision. If there are too many contacts, refer them at least to our public notice.
Keep our email about the incident and a record of the steps you have taken as a result. The Office for Personal Data Protection may request them.
This information does not replace a legal assessment of your specific situation. If you have a data protection officer or a lawyer, we recommend passing it on to them.
On request, we will provide you with the number and list of affected contacts in your workspace, as well as other materials needed to report the incident. If you have any questions, please contact us by email at gdpr@signi.com.
We will send you the supporting documentation as quickly as possible. However, do not wait for it before making the notification. The information in our incident email is sufficient for the submission: what happened and when, which categories of data subjects and personal data are affected, the likely consequences, and the measures we have taken. If you do not yet know the exact number of affected contacts in your workspace, state in the notification that you will provide it later. The GDPR allows information to be provided to the authority in phases without undue further delay (Article 33(4) GDPR). The ÚOOÚ form allows you to submit both an initial notification and a subsequent supplement to it. Keep a copy of the submitted notification and the date of submission so that you can refer to them in the supplement.
Digitalization of signing and company processes is our topic. We write about how to move from paper to digital documents. And we show that it's not such a rocket science.
