Discover how Signi simplifies the document workflow in companies like yours.
ANNOUNCEMENT · 7 November 2026, Updated 9 November 2026
In the interest of protecting your data to the fullest extent and in line with our principles of transparent communication, we are informing you of a security incident that occurred in the Signi application in recent days.
On 6 November 2026, we discovered that an attacker with a registered account had exploited a vulnerability in the application and temporarily gained access to the contact details of people who receive documents for signature through Signi.
The data involved was mainly first name, last name, email address and phone number. For a very small number of contacts, it also included other stored details, such as address, date of birth, company name, company ID, VAT ID, job title or custom user fields.
Stored documents and their content, checklists, login credentials and other sensitive data were not affected.
The main risk arising from this incident is unsolicited electronic communication and fraud by phone or email (typically phishing or vishing). For records that include an address or date of birth, fraudulent messages may be more personalized and therefore appear more convincing. However, we currently have no information that the data has been published or misused.
We therefore recommend extra caution with unexpected emails, text messages and phone calls, especially if someone asks you for passwords or payment details, or asks you to click a link.
a) We fixed the vulnerability within a few hours.
b) We immediately blocked the attacker’s account and cut off their further access to our systems.
c) We are investigating the incident intensively. We will keep updating this page with any significant new findings.
If you store contacts in the Signi application, you are their controller and you may be obliged to report the incident to your local data protection authority (in the Czech Republic, Úřad pro ochranu osobních údajů, in Slovakia, the Office for Personal Data Protection of the Slovak Republic) within 72 hours of receiving our notification. You can find further information and detailed instructions here. On request, we will provide you with the supporting materials, including a list of the affected contacts in your workspace.
You do not need to wait for our supporting documentation before making the notification. You can submit the notification without delay using the information in our notice, and provide the exact list of affected contacts and any further details at a later stage, as permitted by Article 33(4) GDPR.
If you have any further questions, please contact us at gdpr@signi.com.
We sincerely apologize for any inconvenience.
On behalf of Digital Factory s.r.o.
Martin Berger
The Signi application is operated by Digital Factory s.r.o., company ID 06988377, with its registered office at Sokolovská 694/102a, 186 00 Prague 8.
Digitalization of signing and company processes is our topic. We write about how to move from paper to digital documents. And we show that it's not such a rocket science.
