Prygenix / Security

Security at Prygenix

Your documents are yours. Most of what our software does happens on your own computer, and what reaches our servers is kept to the minimum and protected.

Documents stay on your device

Prygenix PDF Studio opens, signs and saves PDFs inside your browser or the Windows app. They are not uploaded.
The Revit add-ins work entirely inside Revit on your computer; your models are never sent to us.
Only a document you choose to send to others to sign is uploaded, and it is deleted on the date you choose.

Encryption

Every Prygenix site and service is served over HTTPS (TLS).
Documents sent for signing are stored encrypted with AES-256-GCM.
Seals and signatures saved in the PDF Studio web app are encrypted in your browser with a key that cannot be exported; the Windows app encrypts them for your Windows account.

Passwordless sign-in

No passwords to leak or reuse: you sign in with a one-time 6-digit code sent to your e-mail.
Codes expire after 10 minutes and allow 5 attempts; codes and sessions are stored only as hashes.
Sign-in and every API are rate-limited against guessing.

DSC private keys never leave the token

For Class 3 DSC signing, the certificate's private key stays on your USB token; the software receives only the signature.
The Prygenix PDF Studio Helper accepts requests only from pdf.prygenix.com and asks you before every signature.
Signatures can carry a trusted timestamp; only a fingerprint (hash) is sent to the timestamp service.

Tamper-evident licences and documents

Licences are certificates signed with Prygenix's private key and verified on your computer, so they work offline and cannot be forged.
Every signed document gets an ID and a SHA-256 fingerprint; Verify tells you whether a file is exactly the one you signed.
Documents signed by others include an audit trail: verified e-mail, time and IP address of each signer.

Privacy by default

No advertising, analytics or tracking scripts in our apps.
We keep only what a licence needs: your name, e-mail, company and the device a key is active on.
You can ask for a copy of your data, or for it to be corrected or erased, under India's DPDP Act 2023. See the Prygenix PDF Studio privacy notice and the privacy policy.

Infrastructure

Services run on a private server (VPS) behind a firewall, managed and updated by Prygenix.
The licence database is backed up every day; the last 30 days are kept.
Check the health of every service at any time on the system status page.

For companies

A company admin controls who has a licence, and can take one back or release a device at any time.
Every assignment, activation and release is logged in the licence manager.
Need a security questionnaire answered or a data processing agreement? Write to sales@prygenix.com.

Responsible disclosure

Found a security issue?

Please tell us privately at support@prygenix.com with the subject "Security report", including steps to reproduce. We will confirm receipt and keep you updated while we fix it. Please do not access other people's data or disrupt the service while testing.