1. Where your records live

Waypoint OS runs on Google Cloud (Firebase). Records and files are encrypted when they are stored and when they travel between your device and our servers. Every page is served over HTTPS only, and browsers are told never to load it over a plain connection.

We do not sell personal information and we do not use third-party advertising or analytics trackers. The Privacy Policy covers what we collect and why.

2. Who can see what

• One brokerage, one set of records. Database rules on our servers, not just the screens, check which brokerage a person belongs to before any record is read or written.
• Roles inside a brokerage. A broker of record, staff and each licensee see what their role allows, and those checks also run on our servers.
• Server-only records. Signing histories, document fingerprints and access codes are kept where no browser can read or change them directly.
• Our pages cannot be framed by other websites, which blocks a common trick for getting people to click something they did not mean to.

3. Waypoint Sign

• Agreement to sign electronically. Before seeing a document, each client reads and agrees to sign electronically, as the federal ESIGN Act requires, and can download the document to print at any time.
• Private links that expire. Each client gets their own link. It stops working at the signing deadline, and repeated wrong links from one place are slowed down.
• Access codes. A realtor can give a client a code by phone or in person. The emailed link alone then opens nothing. We keep only a scrambled (hashed) form of the code, and five wrong tries lock it.
• A history that shows tampering. Every step (sent, opened, agreed, signed, declined) is written to the document's history with the time and network address. Each entry carries a fingerprint of the one before it, so changing, removing or inserting an entry later is detectable.
• Saved once. The signed PDF and its certificate of completion are written once and can never be replaced, and their fingerprints (SHA-256) are printed on the certificate.
• Anyone can check a copy. At waypointos.com/signpost-verify.html, anyone holding a PDF from Waypoint Sign can confirm it is genuine and unchanged. The file is checked on their device and is never uploaded.

4. Keeping records

Once a document is signed, its original, signed PDF and certificate are placed on a hold that stops them from being deleted, and the date they may be released is worked out from the state's record-keeping rule (for example, Utah: three years after the year of closing; New Mexico: we keep seven years, longer than the six the rules require). Brokerages keep their own copies too: every party can download theirs.

5. What we have not done yet

We would rather you hear this from us.

• No outside audit yet. Waypoint OS has not had a SOC 2 audit or a paid outside penetration test. Our checks are our own automated tests, which run before every release.
• No organization seal on signed PDFs yet. Signed PDFs do not carry a digital seal from a certificate authority, so Adobe Reader does not show a seal panel. The fingerprint check above proves a copy is unchanged in the meantime. We chose not to use a self-made seal, because Adobe would show a warning on every copy.

6. Report a security problem

If you think you have found a security problem in Waypoint OS or Waypoint Sign, please write to us. Tell us what you found and how to see it, and give us a reasonable time to fix it before telling anyone else.

• We will reply within five business days.
• We will not take legal action against anyone who reports a problem in good faith and follows this page.
• Please do not look at, change or delete anyone else's records, do not disrupt the service, and do not use automated tools that send large amounts of traffic.
• We cannot pay rewards right now.