Security and data residency in Rwanda
Your documents stay in Africa, under your control.
Documents, signer details and audit records are stored in Kigali, Rwanda, and never passed to outside services. Every signed document carries proof anyone can check.
- ✓ Stored in Kigali
- ✓ No outside services
- ✓ Independent proof
How we protect your documents.
Encryption in transit
Every connection uses TLS. Backups are encrypted.
Isolation
Each customer's data is kept separate, and checked by automated tests on every release.
Access control
Roles per person, two-factor authentication and passkeys. Single sign-on on Scale and Enterprise.
Monitoring
The service is monitored around the clock. Live status is public at status.gewapesign.com.
Safeguards
Approval steps and a dry-run mode before anything is cancelled, and one-click pause for automations.
No third parties
Your documents are never passed to outside services. The website and app load nothing from other companies.
Evidence that does not depend on us.
Stored in Kigali, backed up in Rwanda
Documents, signer details and audit records are stored in our Kigali region, with encrypted backups in a second location in Rwanda. Enterprise customers can ask for a dedicated region or their own infrastructure.
- Kigali region
- Encrypted backups in Rwanda
- Dedicated region on Enterprise
Proof anyone can check
Every signed document is sealed, has a tamper-evident audit trail and an independent, timestamped proof anchored in a public blockchain.
- Sealed PDF and SHA-256 fingerprint
- Chained audit log
- Verify at gewapesign.com/verify
Registered with Rwanda’s data protection authority.
Gewape Cloud Rwanda Limited is registered with the National Cyber Security Authority (NCSA), Data Protection and Privacy Office, under Law N° 058/2021 on the protection of personal data and privacy:
- Data controller · registration No. 001/0130/1225
- Data processor · registration No. 002/0018/1225
Issued 16 December 2025, valid until 16 December 2027. For the documents you send, we act as your data processor: you decide what is signed and by whom, and we process it on your instructions. For account and billing details, we are the data controller. See the Privacy Notice.
Reporting a vulnerability
Report it through support@gewapesign.com and mark it as a security report. We reply to every report. Please give us reasonable time to fix an issue before you disclose it.
Read more in the Privacy Notice, the Terms of Service and the Electronic Signature Disclosure.
Frequently asked questions
Where are my documents stored?
In Kigali, Rwanda. Documents, signer details and audit records stay in Rwanda and are never passed to outside services. Enterprise customers can ask for a dedicated region.
Is my data encrypted?
Every connection to GewapeSign uses TLS, and backups are encrypted.
Who can see my documents?
Only the people the sender chooses, and Gewape staff who need it to run the service. Staff do not open an organization's documents without its permission, except where the law requires it.
Do you use my documents to train AI?
No. We do not sell your data, use it for advertising or use it to train AI models.
Your next contract could be signed today.
Your first 5 documents are free. No card, no time limit. Signers never pay.