Vinesign FedRAMP Secure Configuration Guide

1. Purpose

This document provides the secure configuration baseline for Vinesign, the eSignature platform within the Filevine Application Suite. It is intended for submission to FedRAMP auditors (3PAO) as part of the FedRAMP 20x Low/Moderate authorization package. The configurations described herein establish the minimum-security settings required for federal agency use of Vinesign.

Filevine has achieved FedRAMP 20x Authorization and is listed in the FedRAMP Marketplace. Vinesign’s eSignature solution is the first product in the Filevine suite to receive official authorization, making it one of only two eSignature tools with this distinction.

2. Scope

This guide covers the following Vinesign security configuration areas:

• User Authentication and Two-Factor Authentication (2FA)
• Signer/Document Two-Factor Authentication
• Gesture Authentication (Biometric Identity Verification)
• Document Expiration Policies
• Signature Type Restrictions
• Team Member Access Controls and Role-Based Permissions
• Notification and Audit Logging Configuration
• Document Verification and Blockchain Integrity
• Privacy Controls for Documents and Templates

3. Secure Configuration Summary

The following table summarizes the recommended secure configurations for Vinesign in a FedRAMP environment. Each setting is detailed in the sections that follow, with supporting screenshots from the application.

4. User Authentication (2FA)

4.1 Configuration Description

Vinesign supports Two-Factor Authentication (2FA) for platform users who log in to the Vinesign admin interface. When enabled, users receive a verification code via email that is required for sign-in, adding a second authentication factor beyond the password.

4.2 FedRAMP Secure Configuration

Required Setting: Two-Factor Authentication Enabled = ON

• Navigate to Settings > Two-Factor Authentication section.
• Enable “Two-Factor Authentication Enabled” to require 2FA for all organizational users.
• This is an organization-level setting managed by Vinesign Admins.
• Default: Off. Must be explicitly enabled for FedRAMP compliance.

4.3 FedRAMP Control Mapping

This configuration supports the following FedRAMP / NIST 800-53 controls:

• IA-2: Identification and Authentication (Organizational Users)
• IA-2(1): Multi-Factor Authentication to Privileged Accounts
• IA-2(2): Multi-Factor Authentication to Non-Privileged Accounts

4.4 Screenshot Evidence

The Organization Settings area in Vinesign Admin Settings, where SSO is configured:

5. Signer Document Two-Factor Authentication

5.1 Configuration Description

In addition to user-level 2FA, Vinesign supports document-level two-factor authentication for signers (recipients). When enabled, the signer must enter a verification code sent via email before they can access and sign the document. The code expires after 60 minutes.

5.2 FedRAMP Secure Configuration

Required Setting: Signer Two-Factor Authentication Enabled by Default = ON

• Navigate to Settings > Two-Factor Authentication section.
• Enable “Signer Two-Factor Authentication Enabled by Default” so all new documents and templates require signer 2FA.
• This setting can be overridden at the individual document or template level. For FedRAMP environments, organizations should enforce it at the org level and instruct users not to disable it.
• Default: Off. Must be explicitly enabled for FedRAMP compliance.

5.3 FedRAMP Control Mapping

• IA-2: Identification and Authentication (Organizational Users)
• IA-5: Authenticator Management
• IA-8: Identification and Authentication (Non-Organizational Users)

5.4 Screenshot Evidence

The Signature settings panel in Admin Settings where signer 2FA default is configured:

6. Gesture Authentication (Biometric Verification)

6.1 Configuration Description

Vinesign Gesture Authentication provides an additional layer of identity verification by requiring the signer to upload a photo of themselves performing a randomized gesture (e.g., thumbs up, peace sign). This photo is recorded as part of the document audit trail and verification record. Gesture authentication is a unique feature among eSignature platforms and strengthens non-repudiation assurance.

6.2 FedRAMP Secure Configuration

Recommended Setting: Require Gesture Authentication = Enabled per Document/Template

• When creating or sending a document, check the “Require gesture authentication” checkbox in the Signers section.
• This can also be configured at the template level, so it is pre-set for all documents created from that template.
• For FedRAMP environments, organizations should consider requiring gesture authentication for all high-sensitivity documents.
• Default: Off. Configurable per document or template.

6.3 FedRAMP Control Mapping

• IA-5: Authenticator Management
• IA-8: Identification and Authentication (Non-Organizational Users)
• AU-10: Non-Repudiation

6.4 Screenshot Evidence

Document send screen showing gesture authentication and 24-hour expiration checkboxes:

Signer experience when gesture authentication is required:

7. Document Expiration Policy

7.1 Configuration Description

Vinesign allows organizations to set expiration windows for signing links. Once expired, the document can no longer be signed by the recipient. Available options include 1–7 days, 14, 30, 60, or 90 days. Additionally, a 24-hour expiration can be applied at the individual document level. The expiration time period resets for each recipient in multi-signer documents.

7.2 FedRAMP Secure Configuration

Required Setting: Default Expiration = 7 days or less

• Navigate to Settings > set the default expiration to 7 days or less.
• For highly sensitive documents, consider using the “Expire in 24 hours” option at the document level.
• Expired documents can no longer be signed and must be resent, reducing the window of exposure for unsigned documents.
• Default: 90 days. Must be reduced for FedRAMP compliance.

7.3 FedRAMP Control Mapping

• AC-11: Session Lock (analogous – limits access window)
• AC-12: Session Termination
• SC-10: Network Disconnect

8. Signature Type Restrictions

8.1 Configuration Description

Vinesign supports three signature input methods: Draw (freehand drawn signature), Type (typed name rendered in a signature font), and Upload (upload a signature image file). The organization admin can control which methods are available to signers.

8.2 FedRAMP Secure Configuration

Recommended Setting: Allow signer to type signature = OFF | Allow signer to upload signature image = OFF

• Navigate to Settings > Signature section or configure per document in Signature Settings.
• Leave “Allow signer to type signature” and “Allow signer to upload signature image” unchecked.
• Drawn signatures provide stronger non-repudiation than typed or uploaded signatures, as they are unique per signing event.
• Consider enabling “Additional Signer Info” to include date/timestamp and signer reason in signature fields (compliant with SSA and FDA 21 CFR Part 11 standards).
• Default: Draw only (both type and upload are off). This is already the secure default.

8.3 Screenshot Evidence

Signature Settings panel showing type and upload options (both should remain unchecked):

Signer’s signature creation dialog showing Draw, Type, and Upload tabs:

9. Team Member Access Controls

9.1 Configuration Description

Vinesign provides role-based access controls through its Team management interface. Admins can assign users as standard Users or Team Administrators, enable or disable individual accounts, and control document/template privacy on a per-user basis.

9.2 FedRAMP Secure Configuration

• Apply the principle of least privilege: assign Team Administrator role only to designated security administrators.
• Enable “Private Documents” and “Private Templates” for all users to ensure documents are only visible to the creator and Admins.
• Regularly review team member list and disable accounts for users who no longer require access.
• Default: Private Documents and Private Templates are Off for each user. Must be enabled per-user by an Admin.

9.3 FedRAMP Control Mapping

• AC-2: Account Management
• AC-3: Access Enforcement
• AC-6: Least Privilege
• AC-6(1): Authorize Access to Security Functions

9.4 Screenshot Evidence

10. Notifications and Audit Logging

10.1 Configuration Description

Vinesign provides configurable email notifications for document lifecycle events: Sent, Viewed, Declined, Signed, and Completed. These serve as an audit trail for document activity. Automatic signer reminders can also be configured to reduce the risk of documents going unsigned beyond the expiration window.

10.2 FedRAMP Secure Configuration

Required Setting: All notification types (Sent, Viewed, Declined, Signed, Completed) = Enabled

• Navigate to Settings > Notifications and enable all event types for email notifications.
• If integrated with Filevine, also enable the Filevine notification column to create audit notes in the associated project.
• Enable “Send Signers Automatic Reminders” and configure aggressive reminder frequency (Day 1, Day 2 at minimum).

10.3 FedRAMP Control Mapping

• AU-2: Audit Events
• AU-3: Content of Audit Records
• AU-6: Audit Review, Analysis, and Reporting

10.4 Screenshot Evidence

11. Document Verification and Integrity

11.1 Configuration Description

Vinesign provides comprehensive document verification through multiple mechanisms:

• Digital Signatures (PKI): Documents are locked using Public Key Infrastructure after all signatures are collected. A Hardware Security Module (HSM) verifies and locks documents, with each signature individually verified.
• Blockchain Verification: All Vinesign eSignature activity is recorded on a private blockchain. Documents can be verified for authenticity, integrity (unaltered), and currency (most recent version).
• Document Hashing: Each completed document receives a unique hash and timestamp, enabling tamper detection.
• Public Verification Portal: Anyone can verify a Vinesigned document at app.vinesign.com/verify, confirming its authenticity to third parties such as judges, commissioners, or auditors.
• Document History: A complete audit trail is maintained showing all document activity including creation, sending, viewing, signing, and completion with timestamps, recipient info, and IP addresses.

11.2 FedRAMP Secure Configuration

These verification features are built into the platform and do not require configuration. They operate automatically for all Vinesign documents. Organizations should include the document verification page as part of their records retention process.

11.3 FedRAMP Control Mapping

• AU-10: Non-Repudiation
• SI-7: Software, Firmware, and Information Integrity
• SC-13: Cryptographic Protection
• SC-28: Protection of Information at Rest

11.4 Screenshot Evidence

12. Additional Security Configurations

12.1 Messaging Settings

Organizations should review and customize the default email messages sent to document recipients. The messaging settings allow customization in both English and Spanish. For FedRAMP environments, consider adding security language reminding signers not to forward signing links and to verify the sender before accessing documents.

12.2 Organization Settings

In the Organization Settings, admins can opt to attach a copy of the unsigned document to the initial email sent to signees, and include a document’s ID and verification URL on signed documents. For FedRAMP environments, enabling the verification URL on signed documents is recommended to facilitate independent third-party verification.

12.3 SAML 2.0 / SSO Support and User Access Lifecycle Management

12.3.1 Configuration Description

Filevine’s architecture supports SAML 2.0, providing single sign-on capability through secure Identity Providers (IdP) such as Microsoft Entra ID (Azure AD), Okta, or Google Workspace. Authentication is managed centrally through Filevine Identity (FVID), which serves as the authoritative source for user provisioning, product-level access assignment, and account lifecycle management across all Filevine products including Vinesign.

Vinesign enforces a defense-in-depth approach to access control with two independent layers: (1) centralized identity and product access management via FVID/SSO, and (2) application-level user enablement within the Vinesign Team management interface. Both layers must be addressed when provisioning or decommissioning user access.

12.3.2 FedRAMP Secure Configuration

Required Settings:

• SSO/SAML 2.0 integration with an agency-approved Identity Provider = REQUIRED
• FVID Access Expiration for temporary/contractor accounts = SET TO DEFINED DATE
• Vinesign application-level Enabled checkbox for deprovisioned users = UNCHECKED

User Provisioning Procedure:

• Create or invite the user in FVID Account Manager (the centralized identity layer).
• Assign “Vinesign” under Product Access in the Edit User panel. Only grant products required for the user’s role.
• For temporary, contractor, or time-limited accounts, set the Access Expiration field to a defined end date. Do not leave Access Expiration set to “No Expiration” for non-permanent personnel.
• Assign appropriate role and privacy settings (Enabled, Team Administrator, Private Templates, Private Jobs) in Vinesign under Team → Edit Team Member.

User Decommissioning / Termination Procedure (must be completed within 24 hours of separation or role change):

• Step 1 – Revoke SSO/IdP Access (Primary Control): Disable or remove the user’s account in the organization’s Identity Provider (e.g., Entra ID, Okta). This immediately prevents SSO authentication to all Filevine products including Vinesign.
• Step 2 – Remove Product Access in FVID (Secondary Control): In FVID Account Manager → Users → Edit User, remove “Vinesign” from the user’s Product Access list. This revokes the user’s authorization to the Vinesign product at the platform level regardless of IdP status.
• Step 3 – Disable in Vinesign Application (Defense-in-Depth): In Vinesign → Team → Edit Team Member, uncheck the “Enabled” checkbox and click Save. This disables the user at the application level, ensuring access is revoked even if SSO or FVID controls are inadvertently misconfigured.

Periodic Access Review Requirements:

• Conduct quarterly reviews of the FVID user list and Vinesign Team member list to identify and disable inactive, separated, or unnecessary accounts.
• Verify that all enabled Vinesign users correspond to active FVID accounts with current Vinesign product assignments.
• Confirm that temporary and contractor accounts have Access Expiration dates set and that expired accounts have been fully decommissioned.
• Review Team Administrator role assignments to ensure only authorized security/admin personnel retain elevated privileges (principle of least privilege).

12.3.3 FedRAMP Control Mapping

This configuration supports the following FedRAMP / NIST 800-53 controls:

• AC-2: Account Management – Establishes procedures for creating, enabling, modifying, disabling, and removing accounts
• AC-2(2): Automated Temporary and Emergency Account Management – Enforced via FVID Access Expiration dates
• AC-2(3): Disable Accounts – Accounts disabled when no longer required, via both FVID and Vinesign application controls
• IA-2: Identification and Authentication (Organizational Users) – SAML 2.0 SSO via agency-approved IdP
• IA-4: Identifier Management – Centralized user identity managed through FVID
• PS-4: Personnel Termination – Three-step decommissioning ensures access is revoked upon separation
• PS-5: Personnel Transfer – Product access and role assignments updated upon role change via FVID and Vinesign Team settings

12.3.4 Screenshot Evidence

FVID Account Manager showing centralized user management with per-product access assignments, Tenant Admin status, and Access Expiration controls:

Vinesign application-level user controls showing the Enabled checkbox that must be unchecked to disable a user at the application layer:

12.4 Encryption

All Vinesign data is encrypted in transit and at rest. This is a platform-level control and does not require customer configuration. Encryption supports the following FedRAMP controls: SC-8 (Transmission Confidentiality and Integrity), SC-13 (Cryptographic Protection), and SC-28 (Protection of Information at Rest).

13. FedRAMP Configuration Checklist

Use the following checklist to verify all secure configurations have been applied before audit submission:

1. User 2FA enabled for all organizational users  [Location: Settings > Two-Factor Authentication]
2. Signer document 2FA enabled by default  [Location: Settings > Two-Factor Authentication]
3. Gesture authentication enforced for sensitive documents  [Location: Per-document or template send settings]
4. Default document expiration set to 7 days or less  [Location: Settings > Expiration]
5. Signature type restricted to Draw only  [Location: Settings > Signature]
6. Additional signer info (timestamp + reason) enabled  [Location: Settings > Signature]
7. Private Documents enabled for all users  [Location: Team > Edit each user]
8. Private Templates enabled for all users  [Location: Team > Edit each user]
9. All notification types enabled (Sent, Viewed, Declined, Signed, Completed)  [Location: Settings > Notifications]
10. Filevine integration notifications enabled (if applicable)  [Location: Settings > Notifications]
11. Automatic signer reminders configured (Day 1, Day 2)  [Location: Settings > Reminders]
12. SSO/SAML 2.0 integration configured with agency IdP  [Location: Filevine environment settings]

Document Contact: fedramp@filevine.com
FedRAMP Marketplace Listing: Filevine Application Suite
3PAO: Coalfire