Knot is a small app. Anyone with a GitHub account can send after they install the Knot GitHub App. Anyone with a link can sign after they confirm an email.
Hosting
The app runs on Vercel. The database is Neon. Sealed files sit in private Vercel Blob. Traffic is HTTPS.
Who can send
Senders sign in with GitHub. We list repositories the Knot GitHub App can see on accounts they have installed it on. We read the file with an installation token for that repository. Your GitHub token proves you can see the repo. The installation token reads the contents.
Who can sign
The link is the capability. We send a one-time code to the mailbox they enter. That proves they can read that inbox. It does not prove they are a named officer at the customer.
The sealed copy
After someone signs we write a sealed HTML file, store its SHA-256, and email both parties a copy. We do not overwrite an existing sealed file.
Contact
Security issues: hello@knot.legal.