KMS-grade PAdES sealing
Every executed document is sealed with a server-held signing key, PAdES-structured, then SHA-256 fingerprinted — and verified before it is ever filed.
Why it's different
Built to hold up under scrutiny — not just to collect a signature.
A 7-year evidence vault
Signed PDFs and audit certificates land in a hardened, versioned, access-protected store — built for write-once, locked 7-year retention you can't accidentally lose.
Multi-tenant white-label
Your logo, your colors, your domain. Signers see your brand end-to-end — from the invite email to the signing page to the sealed certificate.
Cap-table-native
Signing isn't a bolt-on. A completed equity award flips the grant to active and writes a hash-chained audit event automatically — no copy-paste between a signer and a spreadsheet.
Hard-Gate compliance
Real equity documents can't be sent until certificate, key custody, signer step-up, and counsel-approved consent are all in place. Compliance is enforced in code, not a checklist.
How it works
Issue, sign, seal, file — one continuous loop.
The same engine the server writes with drives the signing flow, so what gets signed is exactly what gets filed.
- 01
Issue
Create a grant or SAFE in TableStakes; it becomes a signing envelope.
- 02
Sign
The signer opens a branded signing page — your logo, your colors — and signs with email-OTP or KBA step-up by document type.
- 03
Seal
On completion, the document is PAdES-sealed, fingerprinted, and locked into your 7-year evidence vault.
- 04
File
The cap table updates itself: the grant goes active and a tamper-evident audit event is chained — no manual reconciliation.
Trust by construction
The architecture is the product.
Independently audited, with no critical exploit found in the live deployment. Here's what that rigor looks like.
Proven end-to-end, not a demo
A real envelope walked the full sign-and-file loop in production — with two sealed evidence objects (signed PDF + audit certificate) and a hash-chained audit event on file.
Tamper-evident by construction
Fail-closed HMAC webhook verification (constant-time, replay-windowed), re-verification of source-of-truth status, and PAdES validation before anything is written.
Least-privilege perimeter
Tenant-isolating Postgres row-level security (deny-by-default on secret tables), least-privilege service accounts, and PAP-enforced versioned evidence storage.
Idempotent, exactly-once filing
A status-guarded atomic transaction means a document is filed once and only once — even on webhook retries.
Bring signing inside your cap table.
We're onboarding early teams. Tell us about your equity documents and we'll show you the sealed, audit-grade loop.
No account needed to reach us — just email hello@prospectbutcher.co.