Trust
Your recipients send you ID documents, payslips, bank details. They trust you, and you trust us. So we take great care to get everything right, down to the details nobody sees. Here is what that means, point by point.
Secure payment
Payment takes place on a Stripe page. Stripe is one of the most widely used payment providers in the world, certified at the highest level of the card industry security standard (PCI DSS Level 1). Your card number never goes through our servers: we neither see it nor store it. Your bank's strong authentication (3-D Secure) applies whenever it asks for it.
Every payment comes with an invoice, available at any time in "My subscription". You cancel in two clicks, free of charge, and keep access until the end of the paid period.
Electronic signature
When a document needs signing, it is signed online with Documenso, a signing software we have installed on our own servers: your documents do not go to a third-party signing company.
The signed document is sealed and timestamped, and comes with a completion certificate that traces every step. It is a simple electronic signature under the European eIDAS regulation, suited to the vast majority of everyday documents: contracts, authorizations, certificates. We also tell you when it is not suitable, for instance for a guarantee given by a private individual.
GDPR and hosting in France
We apply the European General Data Protection Regulation (GDPR): we keep only what the service needs, for a limited time, and anyone can ask at any time to access or erase their data. You can delete your account yourself, along with all your projects and every file received.
The service, its database and every file received are hosted on a server located in France. Emails and text messages are sent through Brevo, a French company. An encrypted copy is made every hour, in a second location also in France.
Files received do not stay forever: they are deleted automatically 90 days after the request deadline (or after the period you choose, from 30 days to one year), and you are notified 7 days before. Upload links stop working at that point.
Encrypted files, sensitive documents deleted
Every file received is encrypted on the server as soon as it arrives, with AES-256-GCM and a key of its own. Those keys are themselves encrypted with a master key kept outside the data folder and outside the backups: a file copied without it cannot be read, and any change or truncation is detected.
The most sensitive documents (ID card, passport, residence permit, bank details, payslips, tax notices, health insurance card, criminal record) are recognised automatically from their name. They are flagged to both the requester and the recipient, and deleted 30 days after they arrive. The requester is warned 3 days before, to download whatever must be kept. The document still counts as received: nobody is reminded for nothing.
An encrypted copy of the database and files is made every hour in a second location in France. A file deleted from the service is also removed from the backups within 30 days.
All of this is automatic and included on every plan, Free included.
No ad trackers
No ads, no data resale, no advertising cookies. We count visits to public pages with an anonymous, cookieless analytics tool that never runs on the pages where your recipients upload their documents.
The only thing we track is what helps you: whether the message sent to your recipient arrived, whether it was opened, or whether the address or number is invalid. So you know where your request stands, nothing more.
And also
- Encrypted connections everywhere, and every file received is checked: a file that does not match the requested format is rejected.
- Your password is never stored in plain text, only as a fingerprint.
- Your recipients have no account to create, and a link in every message lets them stop the reminders.
- On the Unlimited or Business plan, every document received can also be copied automatically to your Google Drive, your Dropbox or your OneDrive, filed by project and by person. Please Send It only sees the files it puts there, and you can disconnect it whenever you like.
- For businesses, the GDPR data processing agreement is included in the Terms of Use.
- In case of disagreement, an independent consumer mediator can be contacted free of charge: see the Mediation page.
- Everything about data, retention periods and providers: Your data page.
A question, a doubt? Write to us at support@pleasesendit.com: a real person will answer.