Compliance & Privacy

Signa serves public trademark registry data: mark identity, filing details, owner and attorney information, proceedings, and corporate linkage (SEC, GLEIF), all sourced from official government registries and public corporate-data providers. Signa does not collect or process private communications, attorney-client privileged information, financial records, or scraped social data.

​

Personal data and GDPR

Trademark applicants and registrants are sometimes individuals, so their name, country, and address (as published by the office) can constitute personal data under GDPR. Signa’s processing of this already-public registry data relies on legitimate interest (Article 6(1)(f)), the same basis used by official trademark databases and other trademark intelligence services. If an individual’s data is removed from the source registry, Signa removes it on the next sync. Send erasure or access requests to privacy@signa.so with the relevant trademark ID. Enterprise customers who need a formal Data Processing Agreement can request one from legal@signa.so.

​

Query confidentiality

API request logs, including search queries, are retained for 90 days and scoped strictly to your organization: no other customer or API user can see them. If your queries could reveal sensitive strategy (for example, marks a client intends to file), use API keys that are not tied to a specific matter and check your own organization’s policies on using third-party search tools for that work.

​

Security

• Encryption: TLS in transit; encryption at rest for all stored data.
• Access: Least-privilege access to production systems and data.
• Deployments: Every deployment is audited, with access logging on administrative operations.

Contact security@signa.so for a security questionnaire or current certification status.