Security
Last updated October 31, 2026
SignApp is the electronic signature service operated by Brookwood Capital Advisors. Signing requests are a favorite disguise for phishing, so here is exactly what a real one looks like and how we protect what you sign.
Recognizing a genuine signing request
- It's sent from info@sign-app.com, and the email names the person who sent you the document. Replying goes straight to them.
- The Review & Sign button links to https://sign-app.com/sign/ followed by a long random code. Hover over the button (or long-press on a phone) to check before you click.
- You won't be asked to create an account, enter a password, pay, share bank details, or download anything to sign.
If an email doesn't match all of the above, or you weren't expecting a document, don't click it. Check with the sender using a phone number or email address you already have, or forward it to taylor@brookwoodcapitaladv.com and we'll tell you whether it's real.
How signing links work
- Every signer gets their own link. Links can't be guessed and aren't shared between people.
- We store only a one-way fingerprint of each link, never the link itself.
- Links expire after 30 days and stop working once you've signed. Reminders always carry a fresh link, and the old one stops working.
- All pages and downloads are served over encrypted HTTPS.
How signed documents are protected
- Files are served to browsers only through SignApp's own access-checked links; storage addresses are never exposed.
- Each completed document ends with a Certificate of Completion: the envelope ID, a SHA-256 fingerprint of the document, and every signer's identity, timestamp, IP address, and browser.
- Anyone holding a copy can verify it against our records using its envelope ID and check that it hasn't been altered.
Reporting a problem
To report a suspicious email that claims to be from SignApp, or a security issue with this site, email taylor@brookwoodcapitaladv.com. We read every report.