Engineering philosophy
Why NightSign
NightSign is small on purpose. Every decision below trades some convenience for something we can defend in front of a lawyer and a security engineer. Here is the reasoning.
Why don’t we publish the document?
Proving that an agreement was acknowledged usually means handing over the agreement. That couples the proof to the private contents, so proving anything means exposing everything. NightSign records a fingerprint of the exact file instead of the file itself — so a receipt can be checked while the document stays with you.
Why don’t we ask you to trust our servers?
A proof that only holds because we vouch for it is not much of a proof. A NightSign receipt carries the information needed to recompute it, so a reviewer can check it against the evidence it references rather than taking our word. The less you have to trust us, the more the receipt is worth.
Why is acknowledgment kept separate from signature?
A signature is often read as proof of who signed and that a deal is done. NightSign records something narrower and more honest: that a specific person or system acknowledged specific terms, at a recorded time. Keeping acknowledgment distinct from identity and legal effect lets each of those be handled by the system that can actually establish it.
Why make verification portable and independent?
A receipt you can only check inside our product is a receipt you don’t really control. Verification is free, needs no account, and works from the receipt itself — so anyone you hand it to can check it: a client, a colleague, an auditor, or you in six months. Proof that travels is proof that lasts.
Why privacy by default?
Most records systems collect everything they can and ask you to trust the retention policy. We prefer the opposite: in the current flow, the document is fingerprinted in your browser, and the file’s bytes are not sent to NightSign. The receipt carries the fingerprint, not the contents. Data we never take is data we can’t lose.
Why augment instead of replace?
You already have ways to sign and to agree, and they carry weight NightSign does not try to recreate. So NightSign sits on top of what you use rather than competing with it: your agreement or e-signature flow runs exactly as it does today, and NightSign gives it a portable, verifiable receipt. It doesn’t replace how you sign. It adds a privacy-preserving proof layer on top of it.