Compliance & Privacy

Documentation Index

Fetch the complete documentation index at: https://docs.signa.so/llms.txt

Use this file to discover all available pages before exploring further.

Signa processes publicly available trademark data from government registries. This page covers how Signa handles data privacy, what compliance measures are in place, and what responsibilities fall on you as a user of the API.

​

Public Data Processing

Trademark registrations are public records published by government intellectual property offices. Signa ingests, normalizes, and indexes this data to make it searchable and actionable.

​

What Signa Processes

All of this data is already publicly available through the respective government portals. Signa does not collect, store, or process any non-public personal data.

​

What Signa Does Not Process

• Private communications between applicants and offices
• Attorney-client privileged information
• Financial records or payment details of trademark holders
• Social media or web-scraped data about individuals
• Biometric or sensitive personal data

​

GDPR Compliance

​

Legal Basis

Signa’s processing of public trademark data relies on legitimate interest (Article 6(1)(f) GDPR):

• Purpose: Enabling trademark search, monitoring, and clearance — activities that serve the proper functioning of the trademark system
• Necessity: Trademark data must be aggregated across offices to be useful for cross-jurisdictional clearance and monitoring
• Balancing: The data is already public by design (trademark systems require public notice), and Signa does not enrich it with non-public personal information

​

Data Processing Agreement

Enterprise customers requiring a formal Data Processing Agreement (DPA) can request one by contacting legal@signa.so. The DPA covers:

• Data processing scope and purpose
• Sub-processor list and notification obligations
• Data transfer mechanisms (Standard Contractual Clauses where applicable)
• Incident notification procedures
• Audit rights

​

Right to Erasure

While trademark registry data is public, individuals whose personal data appears in trademark records (e.g., individual trademark owners) may have rights under GDPR. Signa handles such requests as follows:

1. Requests about registry data: Signa reflects what the official registry publishes. If an individual’s data has been removed from the source registry, Signa will remove it during the next sync cycle.
2. Requests about derived data: Entity resolution profiles, statistics, and corporate linkage derived from public data can be suppressed on request.
3. Contact: Send erasure requests to privacy@signa.so with the relevant trademark ID(s) and your relationship to the data.

​

Attorney-Client Privilege

Signa does not access or store attorney-client privileged information. However, as a user of the API, be aware of the following:

​

Search Queries

API search queries are logged for rate limiting, abuse detection, and debugging purposes. These logs are retained for 90 days and then deleted. If your search queries could reveal privileged strategy (e.g., searching for marks your client intends to file), consider:

• Using generic API keys that are not tied to specific matters
• Reviewing your organization’s policies on using third-party search tools for privileged work
• Discussing with counsel whether search patterns constitute privileged work product

​

Query Privacy

API keys and their request logs are scoped to your organization and not visible to other API users. Even so, the existence and pattern of your queries are stored in Signa’s request logs for rate limiting and debugging. For highly sensitive matters, consider whether search patterns themselves reveal privileged strategy and rotate or segment API keys accordingly.

​

Professional Liability

​

Signa’s Role

Signa provides normalized trademark data and computed insights (deadlines, status classifications, entity resolution). These are informational outputs, not legal opinions.

​

Your Responsibility

As an API consumer, you are responsible for:

​

Limitation of Liability

Signa’s terms of service limit liability for data accuracy. Computed fields (deadlines, entity resolution, status classification) are best-effort derivations from public data. Always verify critical data points against the source registry before acting.

​

Audit Trail & Compliance Logging

​

Request Logging

Every API request generates a request_id (e.g., req_abc123) that appears in every response. This ID can be used to:

• Trace a specific request through Signa’s systems
• Reference in support tickets
• Correlate with your own internal audit logs

​

Data Versioning

Trademark records are versioned internally. When a record changes due to a new sync, the previous version is preserved. The updated_at timestamp and data_freshness.source_data_date fields let you determine exactly when data changed and what the source was.

​

Change History

The Trademark History endpoint returns the chronological audit trail of each record — every status change, owner transfer, and classification amendment, with the source office and ingestion timestamp. Use the history to:

• Build an audit trail of what changed and when
• Trigger downstream compliance workflows based on status transitions
• Reconstruct the state of a trademark at any point in time

​

Security

​

Infrastructure

​

API Key Security

• Keys are SHA-256 hashed before storage — Signa never stores plaintext API keys
• Key rotation is supported via POST /v1/organization/api-keys/{id}/rotate with a configurable overlap period
• Keys can be scoped to specific permissions (see Authentication)
• last_used_at tracking lets you identify unused keys for cleanup

​

SOC 2

Signa is working toward SOC 2 Type II certification. Current security controls include:

• Infrastructure-as-code (Terraform) for reproducible, auditable deployments
• Automated vulnerability scanning in CI/CD
• Access logging on all administrative operations
• Incident response procedures documented internally

​

Data Residency

​

Primary Region

Signa’s production infrastructure runs in AWS US East (N. Virginia) (us-east-1). All trademark data, API keys, and customer resources are stored in this region.

​

Data Transfer

Trademark data originates from government registries worldwide and is transferred to Signa’s US-based infrastructure for processing. For EU customers, this transfer is covered by:

• AWS’s participation in the EU-US Data Privacy Framework
• Standard Contractual Clauses (available in the DPA)

​

Enterprise Options

Enterprise customers with specific data residency requirements can discuss options including:

• Dedicated infrastructure in EU regions (eu-west-1, eu-central-1)
• Data processing restrictions by jurisdiction
• Custom data retention policies

Contact sales@signa.so to discuss enterprise residency requirements.

​

Contact