Security and reuse of uploaded stamp images in Docusign Stamps

Question

Hi,We are considering using Docusign Stamps in a B2B process.Our company would send the envelope, and the customer would upload their own corporate stamp image and apply it to a document within the envelope.From the customer's perspective, we expect a security concern such as:"If we upload our corporate stamp image to Docusign, how is the image protected from unauthorized access or reuse?"We understand that Docusign records the signing/stamping activity as part of the electronic transaction and that the stamp used is recorded in the Certificate of Completion.However, we would like to understand how Docusign views the security and appropriate corporate use of an uploaded stamp image itself.Specifically:How is an uploaded stamp image stored and protected?	Who can access or reuse the uploaded stamp image?	Can the sender of the envelope obtain or reuse the customer's uploaded stamp image?	Is the uploaded stamp image reusable only by the signer who uploaded it, or can it be used in other contexts?	Does Docusign have any official security guidance or documentation that organizations can refer to when asking customers to use Docusign Stamps?Ultimately, we would like to determine whether it is appropriate for our company to ask customers to upload and use their corporate stamp through Docusign Stamps, and what security considerations we should explain to those customers.Any official Docusign documentation or guidance on this point would be greatly appreciated. Best Regards,

Luke.Cervantes · Accepted Answer

Hi ​@MiKi,Welcome to the Docusign Community! Thank you for outlining the security questions around using Docusign Stamps in your B2B workflow.The short answer is that Docusign Stamps can be appropriate for a workflow in which a customer applies a visual corporate mark to a document, provided the customer understands that the stamp is a reusable image asset, not a secret credential or a cryptographic electronic seal.How the uploaded stamp is stored and protectedWhen a recipient uploads a stamp through Manage Profile > Stamps, Docusign treats it as that user’s personal stamp. Docusign’s support guidance distinguishes these personal stamps from account-managed stamps.Docusign’s public security documentation does not describe or promise a particular encryption implementation solely for the uploaded stampimage. Accordingly, we recommend describing the image as protected under Docusign’s eSignature security and access-control model, rather than making a more specific claim about the underlying image-storage implementation.Who can access or reuse a personal stampThe uploaded stamp is associated with the user’s Docusign profile. Docusign support guidance states that an administrator cannot view or manage a stamp uploaded by an end user as that user’s personal stamp. The user can use saved stamps when receiving envelopes that contain a Stamp field, including future envelopes, subject to the account and workflow configuration.This is different from Managed Stamps. A Managed Stamp is created at the account level and can be assigned by an administrator to selected users or groups. That model is intended for controlled sharing of an organizational stamp or signing authority and should be used only when the customer intentionally wants that level of administrative access and reuse.Can the envelope sender obtain or reuse the customer’s uploaded stamp?For a customer’s personal stamp, the sender does not receive access to the customer’s Docusign profile stamp or gain the ability to reuse it as a saved stamp in the sender’s account. The sender can, however, see the visual mark when it is applied to a document and can retain or download the completed document if they are an authorized envelope participant. As with any mark visible in a completed PDF, the image could potentially be copied from that document. A corporate stamp should therefore not be treated as confidential or as a secret authentication factor.The Certificate of Completion and audit trail record the transaction and signing/stamping activity. They do not turn the uploaded image into a private secret or prevent the visual mark from being visible in the completed document.Important distinction: Stamp versus electronic sealDocusign Stamps are intended to represent a signature, approval, or organizational acknowledgment. A Stamp image should not be described as equivalent to an electronic seal. Where the customer requires a cryptographic seal for a legal entity, or evidence of origin and integrity based on a digital certificate, the customer should evaluate Docusign Electronic Seals or another appropriate regulated signing/sealing solution instead.Recommended customer guidanceWe would suggest explaining that customers should:Upload only a stamp image they are authorized to use and comfortable displaying on the completed document.Use their own Docusign user account and protect it with appropriate authentication controls.Treat the image as reusable visual content, not as a password, private key, or other secret.Confirm internally who is authorized to apply the corporate stamp.Use Managed Stamps only when the organization deliberately wants administrator-controlled assignment to users or groups.Obtain legal or compliance approval where the corporate mark has a formal seal, notarization, regulatory, or jurisdiction-specific meaning.Official referencesManage StampsManaged StampsSecurity for Docusign eSignatureProduct SecurityHow Docusign uses transaction data and the Certificate of CompletionSending envelopes with a Stamp fieldThank you, and have a great day ahead!Best Regards,Luke | Docusign Community ModeratorIf you find this helpful, please select “Best Answer ” so other users can see it too!

Drewcifer · Answer

https://support.docusign.com/s/document-item?language=en_US&rsc_301&bundleId=jux1643235969954&topicId=dys1578456666697.html&_LANG=enus

Sign up

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.

Docusign Community

You can login or register as either a Docusign customer or developer. If you don’t already have a Docusign customer or developer account, you can create one for free when registering.