QCDS Security and Privacy Practices for Administrators and Senders

QCDS supplies technical safeguards, but administrators and senders still control important operational choices. Treat signer links, private documents, provider credentials, completed packages, and identity evidence as sensitive transaction material and keep them inside the intended QCDS access paths.

Run Signing Workflows over HTTPS

Use a correctly configured HTTPS Joomla site for sender and signer activity. Signer invitations contain a personal bearer secret; anyone who possesses a still-valid invitation can attempt to enter that participant's signer flow. Do not post signer URLs in public tickets, forums, logs, or shared documents.

QCDS stores the invitation secret server-side as a SHA-256 hash rather than retaining the raw invitation token. After exchange, the browser signer session also resolves through a hashed session secret and is constrained to the exact Request/participant context.

Use the Smallest Necessary Joomla/QCDS Permissions

Protected Joomla-user downloads are workspace-authorized, and QCDS applies permission checks to sender/document/request operations. Give users only the workspace role/permissions they need, remove access when responsibilities change, and reserve Global Identity Verification management for trusted Super Users.

Keep Private Files in QCDS Managed Storage

Do not expose source PDFs, completed files, or signer attachments by copying them into public Joomla folders. QCDS Managed Private Storage is designed to remain outside webroot and QCDS streams authorized files through application-controlled delivery.

Run the available storage-health checks when diagnosing storage problems; they can identify missing/unreadable objects, size/hash mismatches, duplicate metadata keys, unsafe links, and orphaned managed files without making the private objects public.

Protect Identity Verification Credentials and Evidence

Didit/Shufti credentials are customer-owned secrets. QCDS encrypts saved provider credentials locally using AES-256-GCM derived from the Joomla site secret. Do not paste API keys, Shufti Secret Keys, Didit webhook signing secrets, or other credentials into public support material.

Didit raw ID/face capture media is not stored by QCDS. Shufti capture media is temporary in the protected identity temp area and is removed after processing/cleanup; QCDS retains minimized verification result/evidence records instead of treating raw capture media as a permanent completed-document attachment.

Handle Completed Packages as Sensitive Records

A Completed Package can contain unobscured original signer attachments even when the Completed PDF uses a privacy-obscured presentation. Store exported packages according to your organization's records/privacy requirements and share them only with authorized recipients.

Use Safe Diagnostics

When requesting support, record the QCDS version, Request number/public ID, visible status, timestamps, and the exact action that failed. Avoid sending raw signer links, provider secrets, private identity media, or unnecessary customer documents. When practical, reproduce a problem with a small test PDF and test Contact rather than production evidence.

Community Discussion

Want to compare workflows, share practical tips, or discuss how you use this QCDS feature? Visit the QC Digital Signature Community. For private support, bug reports, account-specific issues, or feature requests, use the QuantaCade support system.