Question 1

What is ReadSignFlow?

Accepted Answer

ReadSignFlow is a B2B compliance platform for workforce policy acknowledgment — a purpose-built way to prove your people received, confirmed, and signed the policies, bulletins, and procedures they're required to. Organizations distribute a document to every employee and contractor over email and the recipient portal (SMS, WhatsApp and Enterprise QR campaigns coming soon), track who has opened, confirmed, and signed the exact version, and export audit-ready evidence in one click. It is operated by Astrolabix LLC and built for compliance, HR, risk, and operations teams — not a generic e-signature tool.

Question 2

What is a read-and-sign (policy-acknowledgment) platform?

Accepted Answer

A read-and-sign (policy-acknowledgment) platform distributes policies, bulletins, and procedures to a workforce, captures a signed acknowledgment from each person behind a read gate, and stores tamper-evident, audit-ready evidence of it. Unlike a document store or a single e-signature envelope, it manages the whole cycle — target, deliver, remind, read-gate, sign, and prove — across office, frontline, and contractor staff. ReadSignFlow does this over email and the recipient portal, with SMS, WhatsApp and Enterprise QR campaigns coming soon.

Question 3

How is ReadSignFlow different from DocuSign or a generic e-signature tool?

Accepted Answer

E-signature tools are built for one-off transactions — a contract, an offer, a form sent to a handful of known signers. ReadSignFlow is built for sending the same policy to your whole workforce: it enforces a read gate before anyone can sign, chases stragglers automatically, reaches frontline workers who have no corporate email, and tracks completion across the full population rather than only the people who opened an envelope. The practical differences are reach, manager escalation with per-person compliance tracking, and a one-click audit pack — see the full comparison at readsignflow.com/compare/esignature.

Question 4

How do I choose the best policy acknowledgment software?

Accepted Answer

For a regulated, frontline-heavy workforce, the best policy acknowledgment software reaches staff who have no corporate email, gates signing behind a read confirmation, escalates anyone still outstanding to their manager, and exports regulator-ready evidence on demand. Generic e-signature tools cover none of the first three. See the comparison at readsignflow.com/compare/esignature.

Question 5

How long does it take to go live?

Accepted Answer

Self-serve, most teams launch their first campaign in an afternoon: upload a policy, import your recipients from a CSV, set a deadline, and send — ReadSignFlow handles delivery, reminders, and evidence from there. There is nothing to install and no infrastructure to stand up. Wiring your HRIS into the joiner/mover/leaver (JML) API is the part that takes days rather than an afternoon.

Question 6

How do we migrate off paper or spreadsheet sign-off?

Accepted Answer

You upload your current policy as a PDF, import your people from a spreadsheet (or have your HRIS post them to the REST API), and launch a campaign — replacing the paper sheet and the manual chase in one step. Historic paper records can sit alongside the new digital trail, so you move to defensible proof without losing what you already have. Our From paper to proof guide walks through the switch from manual policy sign-off to audit-ready digital acknowledgment.

Question 7

Do we need to install anything?

Accepted Answer

No. ReadSignFlow is cloud-based software your team uses in a browser, and recipients sign on their own phone with no app to download. Admins log in to the portal; recipients tap a secure magic-link — nothing to install on either side.

Question 8

Can it reach staff who have no corporate email?

Accepted Answer

Yes — this is the core of it. ReadSignFlow sends each person a secure magic-link by email — a personal address works, no corporate mailbox needed — so frontline, deskless, and contractor staff read and sign on their own phone with no app and no login. The recipient portal also runs on a shared tablet in a break room, where each worker signs in with the email address on their staff record and a one-time code or their password. SMS, WhatsApp and QR campaigns (Enterprise) are coming soon. It closes the biggest gap in workforce compliance: the people who never see a corporate inbox but still have to acknowledge every policy.

Question 9

Which channels can you deliver over — email, SMS, WhatsApp, QR?

Accepted Answer

Email and the recipient portal deliver today, on every plan: each person gets their secure magic-link by email, and anyone without a device of their own can sign in to the portal on a shared tablet on the shop floor or ramp with their portal password. SMS and WhatsApp are built into the product but not sending yet, and QR-poster campaigns (an Enterprise feature) are coming soon — so don't date a rollout around any of them. Every live route leads to the same read gate and feeds the same completion tracking and audit trail.

Question 10

Which languages can recipients sign in?

Accepted Answer

The recipient experience is available in five languages — English, Spanish, French, German, and Portuguese — so deskless staff can read and acknowledge policies in their own language. Documents themselves are shown in the language you upload them in; ReadSignFlow translates the signing experience, not your policy text. Read-gating and evidence capture work identically whatever the language, so a Spanish-language acknowledgment is just as defensible as an English one.

Question 11

How do QR posters and shared devices work?

Accepted Answer

For sites where staff share a device, leave a tablet open on your recipient portal's sign-in page in the break room, at the entrance, or on the ramp. Each worker signs in with the email address on their staff record (it need not be a corporate mailbox) and a one-time code or their own password, reads the policy through the read gate, signs, and signs out for the next person. The acknowledgment is recorded against that person with the same evidence as any other route; on Enterprise you can also require an ID document upload at signing. It is how a plant floor, store, or airside team reaches full acknowledgment without a single corporate inbox. Printable QR-poster campaigns (Enterprise) are coming soon.

Question 12

Does the recipient need an app or a password?

Accepted Answer

No app, and no password for the emailed link. Recipients open the secure, single-use magic-link sent to them, confirm who they are, and sign — the link itself authenticates them. On a shared device, the recipient portal instead asks for the email address on their staff record and a one-time code (or their password). Nothing to download and no account to create.

Question 13

How do I prove employees have read a policy?

Accepted Answer

Send it as a ReadSignFlow Read & Sign campaign. A read gate keeps the sign button locked until the recipient's device confirms they have reached the end of the document, and every acknowledgment records signer identity, intent, and a UTC timestamp in an append-only, tamper-evident event log. What you can put in front of an auditor is precise: this named person, from this device and IP address, confirmed reaching the end of this exact document version and acknowledged it at this moment. Export the campaign audit pack to hand it over: a completion report covering every recipient, a signed receipt for every signature, and the campaign's event trail.

Question 14

How do I track employee policy acknowledgment?

Accepted Answer

From one real-time dashboard: every person moves through sent, delivered, opened, end reached, and signed, with filters by department, site, and role, and a live exception list of exactly who hasn't signed yet. This compliance tracking works for any document — policies, SOPs, safety bulletins, handbooks — and feeds the completion reports your managers quote and your auditors test. Employee policy acknowledgment stops being a spreadsheet you maintain by hand and becomes a status you can see at a glance.

Question 15

Can it automate reminders and escalations?

Accepted Answer

Yes — this is most of the time it saves. Reminders go out automatically as each person's deadline approaches (7 days, 3 days, and 24 hours before it), quiet hours are respected, and anyone still outstanding is escalated to their manager. For SLA-driven notices, such as a safety alert with a short window, the escalation clock follows the SLA — and every reminder and escalation is itself logged as evidence.

Question 16

What happens when a policy is updated to a new version?

Accepted Answer

Every document lives in a versioned library. When a new revision replaces the old one, you choose who must re-acknowledge — everyone, or only the affected roles — and ReadSignFlow launches the re-attestation, retires the superseded version, and ties each signature to the exact revision that person read. That matters because 'which version did they sign?' is usually the first question an auditor asks.

Question 17

Can I see who hasn't signed?

Accepted Answer

Yes — the exception list is a first-class view, not a report you have to build. At any moment you can see exactly who is outstanding, filtered by team, site, manager, or role, and export it or fire a targeted reminder. It is the difference between knowing your completion rate and knowing the names behind it.

Question 18

Does it stop people signing before they have been through the document?

Accepted Answer

Yes. A read gate keeps the sign button locked until the recipient has been through the document and their device confirms they reached the end, so the sign button unlocks only after the recipient's device reports reaching the end of the document — not a bare click. To be precise about what that is: the end-of-document confirmation comes from the recipient's own device, and ReadSignFlow does not claim to measure how long anyone spent reading. What it does record — who signed, when, from what device and IP address, against which document version, in an append-only tamper-evident log — is what makes the acknowledgment hard to challenge, and it is well beyond e-signature tools that capture a signature event alone.

Question 19

What evidence do I get for an audit or inspection?

Accepted Answer

A one-click audit pack: a completion report with every recipient's status — the whole population, no sampling — plus a device-reported engagement timeline wherever one was recorded; a signed PDF receipt for every signature; a signatures CSV; the campaign's audit-trail CSV (campaign actions including reminders an admin sends from the campaign, each signature and decline, closure, and earlier exports); and a SHA-256 manifest so a regulator or auditor can check nothing has changed since export. The audit-trail CSV holds the newest 5,000 events and the manifest says if older ones were left out; a pack exported while the campaign is still open is marked provisional. You can inspect a sample at readsignflow.com/resources/sample-audit-pack.

Question 20

Is the audit log tamper-evident?

Accepted Answer

Yes. The event log is append-only — entries can be added but never edited in place, and a record is removed only when your configured retention window expires (an erasure request anonymizes the person; the record itself stays) — and each audit pack ships with a SHA-256 manifest that lets anyone verify the records haven't been altered since export. If a single byte changes, the hash won't match, so the trail either checks out in full or visibly doesn't.

Question 21

How long are records retained?

Accepted Answer

Retention is a workspace setting rather than a plan tier: records are kept for 7 years by default, and you can set anything from 1 to 30 years to match your policy and regulator. When the window passes, event-log and delivery records are deleted and leavers' personal details are anonymized rather than removed wholesale — signed PDFs and acknowledgment records are kept, so completion evidence survives data minimization. Records under an active legal hold are exempt until the hold is lifted.

Question 22

Can I export signed PDFs in bulk?

Accepted Answer

Yes. You can export every signed PDF for a campaign in one action, alongside the event log and manifest, rather than downloading them one at a time. Whether it's ten people or ten thousand, the audit pack assembles the full set on demand.

Question 23

What's in the one-click audit pack?

Accepted Answer

Five kinds of file: a completion report (PDF) with each recipient's status and, where one was recorded, the device-reported engagement timeline; a signed PDF receipt for each signature; signatures.csv; audit-trail.csv — the campaign's events, newest first, up to 5,000 rows, with the manifest flagging any cut; and manifest.json with a SHA-256 hash for every file, marking the pack final or provisional. Together they answer who signed which version, when, and how, without you assembling anything by hand. Reminders an admin sends from the campaign appear in the audit trail; automatic reminders and escalations are not logged event by event (the acknowledgment export counts reminders per recipient). You can inspect a sample at readsignflow.com/resources/sample-audit-pack.

Question 24

Does it integrate with our HRIS or ATS?

Accepted Answer

Your HRIS or ATS pushes people and joiner/mover/leaver (JML) events to our REST API. Workday, BambooHR, SuccessFactors and others can all do this; there is no native connector to install, and we never hold credentials for your HR system. Policy assignments then follow your staff automatically as they join, change role, or leave — new hires are enrolled in the campaigns their role matches, movers pick up newly matching ones, and leavers' outstanding requests are closed while what they already signed stays on record.

Question 25

What is JML automation?

Accepted Answer

JML stands for joiner–mover–leaver. Your HRIS (or your own middleware) posts those lifecycle events to our REST API, and ReadSignFlow keeps assignments in step automatically: joiners are enrolled in the onboarding campaigns their role matches, movers are added to newly matching campaigns and withdrawn from unsent ones that no longer apply, and leavers' outstanding requests are closed while what they already signed stays on record. It keeps acknowledgment obligations correct without anyone editing a spreadsheet.

Question 26

Is there an API and webhooks?

Accepted Answer

Yes, on Growth and Enterprise plans. A versioned REST API lets you create and update recipients (joiners, movers and leavers) and pull acknowledgment status, analytics and evidence programmatically; campaigns themselves are built and launched in the admin portal. HMAC-signed webhooks push events — signed, escalated, bounced, campaign completed — to your systems in real time. The HMAC signature lets your endpoint verify each event genuinely came from ReadSignFlow.

Question 27

Do you support single sign-on?

Accepted Answer

Not yet. Single sign-on with Google Workspace and Microsoft Entra ID is on our roadmap, but it is not available on any plan today. For now, admins sign in with their work email and a password, and each admin can turn on two-factor authentication with an authenticator app, on every plan.

Question 28

Where is our data hosted, and is it secure?

Accepted Answer

Your data is US-hosted in a single region — an EU data region is planned (in progress) — on SmarterASP.NET, our only hosting provider today, which is named in the sub-processor list in our DPA. It is encrypted in transit (TLS) and at rest (AES-256), and each workspace's data is kept separate from every other customer's. Our controls are being assessed by an independent third-party auditor as we prepare for SOC 2 Type II and ISO 27001 — we do not hold either certification yet — and every acknowledgment is written to an append-only, tamper-evident audit log. See readsignflow.com/security for the current detail.

Question 29

Are you SOC 2 or ISO 27001 certified?

Accepted Answer

Our controls are being assessed by an independent third-party auditor as we prepare for SOC 2 Type II and ISO 27001. We do not hold either certification yet; our current security documentation is available on request from trust@readsignflow.com. Encryption, access control, per-tenant isolation, tamper-evident logging, and monitoring are in place today, and we won't claim a certificate we don't yet hold. An independent penetration test has been carried out; we do not publish its date, the firm, the scope, or a retest cadence.

Question 30

Is an electronic acknowledgment legally defensible?

Accepted Answer

Every acknowledgment captures signer identity, intent, a UTC timestamp, and a tamper-evident audit trail, and ReadSignFlow supports eIDAS (EU/UK) and the US ESIGN Act and UETA, neither of which lets a record be denied legal effect solely because it is electronic. In practice, a challenge then has to contend with who signed, that they intended to, when, and proof the record hasn't changed. This is general information, not legal advice — for your jurisdiction and use case, confirm requirements with your own counsel.

Question 31

Are you GDPR-compliant?

Accepted Answer

ReadSignFlow is designed to be GDPR-aligned and acts as a data processor on behalf of your organization, which remains the data controller. A Data Processing Agreement (DPA) is available, and features such as configurable retention with anonymization, per-tenant isolation, and access controls support your obligations. You decide what personal data enters the platform and for how long.

Question 32

Who can see the data?

Accepted Answer

Each workspace's data is isolated in the application layer on every request, so one organization's data is kept separate from another's. Database row-level security policies are in place on every tenant table, and we are working to enforce them for the application's own connection. Within your tenant, role-based access control (RBAC) limits what each admin can see and do — by role and, where you need it, by department or site. Recipients only ever see the documents assigned to them.

Question 33

Do you have an uptime SLA?

Accepted Answer

We operate the platform to a 99.9% availability target on every plan. That is a target we run to, not a measured figure and not a warranty — we publish no measurement window, exclusions, or service credits against it. A contractual availability commitment with service credits is agreed in an Enterprise agreement. Current service state is on readsignflow.com/status.

Question 34

How much does it cost?

Accepted Answer

ReadSignFlow is free forever for up to 20 employees — no card, no time limit. Paid policy acknowledgment software starts at Starter ($99/month billed annually, or $119 month-to-month, up to 100 employees), scales through Growth ($1.50 per active employee per month, or $1.20 on annual billing, with a $150/month minimum — $120/month on annual), and tops out at Enterprise (custom annual contract for 2,000+ employees, with custom contract terms, a dedicated account manager, 24/7 support, procurement support, and QR campaign mode once it ships — it is coming soon). Paid plans have no trial: every paid plan is charged at checkout, from day one (Growth at the 100-employee minimum), and the Free plan is the way to try the product. Every paid plan carries a 14-day money-back guarantee: cancel within 14 days of your first charge and that charge is refunded in full. Free has nothing to refund. Full plans at readsignflow.com/pricing.

Question 35

Is the Free plan really free?

Accepted Answer

Yes — genuinely free forever for up to 20 employees, with no credit card and no time limit. It's a real working plan for small teams and for trying the full acknowledgment flow before you grow into a paid tier, not a crippled demo.

Question 36

How does Growth pricing work?

Accepted Answer

Growth is $1.50 per active employee per month, dropping to $1.20 on annual billing, with a 100-employee minimum — $150/month, or $120/month on annual. The included comms allowance is per WORKSPACE, not per employee: 25,000 emails and 5,000 SMS a month however many people you have. SMS and WhatsApp delivery is still being integrated and is not sending yet, so those allowances are what the channels will include when they go live; beyond that allowance sending pauses rather than running up a surprise bill — top up instantly with an email, SMS, or WhatsApp capacity add-on and your limit lifts immediately. Like every paid plan, Growth has no trial: you enter your employee count at checkout and your card is charged from day one, for at least the 100-employee minimum.

Question 37

Is there a free trial?

Accepted Answer

No — paid plans have no trial. The Free plan is free forever for up to 20 employees, with no card and no time limit, and it is the way to try the product. Every paid plan is charged at checkout, from day one: Starter for the plan you picked, and Growth — once you enter your employee count — for at least the 100-employee minimum. Every paid plan carries a 14-day money-back guarantee: cancel within 14 days of your first charge and that charge is refunded in full. Free has nothing to refund.

Question 38

Can I get my money back?

Accepted Answer

Yes, within 14 days. Every paid plan carries a 14-day money-back guarantee: cancel within 14 days of your first charge and that charge is refunded in full. Free has nothing to refund. After that, cancellation takes effect at the end of the period you have already paid for and later fees are non-refundable except where the law requires otherwise — the binding wording is in our Terms at readsignflow.com/terms.

Question 39

What counts as an active employee?

Accepted Answer

An active employee is any person you keep active in ReadSignFlow — employees and contractors alike — whether or not they are targeted by a campaign that month. People you have invited but who haven't joined yet, and people you mark as on leave, as leavers, or as deactivated, are not counted. Growth is priced on that count with a 100-employee minimum. Full details at readsignflow.com/pricing.

Question 40

Can I switch plans?

Accepted Answer

Yes — you can move up or down as your team and needs change, and annual billing unlocks the lower Growth rate. Start free, and upgrade when you need more people or higher-tier features like your own branding and the REST API, and talk to us any time about the right tier.

Question 41

My employer sent me a ReadSignFlow link — what is it?

Accepted Answer

It's a secure link your organization uses to share a workplace policy or document with you and record that you confirmed reading it and acknowledged it. You read and sign on your phone — no app to install and no account password to create. See readsignflow.com/for-recipients for exactly what we record and what we'll never ask for.

Question 42

What do you record when I sign?

Accepted Answer

We record that you opened the document and that your device reported reaching the end of it, the version you saw, a timestamp, the channel you signed over, and — as part of the signed receipt — your IP address and your device and browser. That is the evidence your employer needs to show the policy was acknowledged. We don't use it to work out where you are, and we don't track your browsing or anything you do outside the document. The record belongs to your employer, who decides how long it is kept.

Question 43

What will you never ask me for?

Accepted Answer

We will never ask you for a password, a payment or card details, your national ID number, or to download an app. A genuine ReadSignFlow request only ever asks you to confirm your identity to your employer's standard, read the document, and sign. If a message claiming to be us asks for money or a password, treat it as a scam.

Question 44

Is it safe to sign on my phone?

Accepted Answer

Yes. The link is secure and single-use, the connection is encrypted, and you never create a password or install anything. If you're ever unsure a link is genuine, check with the person at your workplace who sent it before you tap — but the process itself is designed to be safe on any phone.

Frequently asked questions

Getting started