Data Residency

This page explains where the data you entrust to MauriSign is stored, how it is kept separate from other customers' data, and how long it is retained. It complements our Privacy Policy, which governs how we handle personal data under the Mauritius Data Protection Act 2017.

MauriSign runs on managed cloud infrastructure. Application data — including documents, signatures and audit trails — is held in a managed PostgreSQL database, and document files are stored in managed object storage. We select hosting regions with the requirements of our Mauritian customers in mind and continue to work toward local data residency as our infrastructure matures.

Every customer account is isolated at the database level using PostgreSQL row-level security. Access is scoped to a single account on every query, so one customer's documents can never be read from another customer's session. This isolation is enforced by the database itself, not only by application code.

Data is encrypted in transit using TLS. Operator-managed secrets are encrypted at rest using AES-256-GCM. Passwords are never stored in plain text — only as secure one-way hashes. Signing keys used to seal documents are held separately, and the private production key is kept offline.

Sealed documents and their audit trails are retained for 10 years, reflecting their evidential value. If you close your account, personal data is deleted following a 30-day grace period, subject to any legal obligation to retain signed records. You can request an export or deletion of your data at any time from your account settings or by contacting us.

We rely on a small number of infrastructure and email providers to operate the Service (for example, cloud hosting and transactional email). These sub-processors act on our instructions and are bound by confidentiality and data-protection obligations. For questions about our current sub-processors, contact support@maurisign.mu.