Security
Permissions
Section titled “Permissions”| Permission | Allows |
|---|---|
permission() of the template (default documents.manage) |
create, hand over and void its documents |
| view permission (and policy) of the owner record | see the documents and download their PDFs |
documents.retention |
change the retention periods |
Signing needs no permission of its own: the signer uses the session of the employee, locked to the signing page.
What is stored
Section titled “What is stored”| Where | What |
|---|---|
anvil_documents |
template and version, title, owner, status, data snapshot (JSON), content hash, PDF file and hash, signer name, times, device, employees |
| files of the owner record | the PDF |
| audit log | events with hashes, template and file; never content or names |
All of it is tenant scoped.
Audit entries
Section titled “Audit entries”| Event | When |
|---|---|
document.created |
a draft is created |
document.handover_started |
the handover mode starts |
document.signed / document.finalised |
completed, with content and PDF hash |
document.voided |
a draft is discarded, with reason |
document.handover_unlock_failed |
a wrong password on the signing device |
document.handover_ended |
the mode ends (unlocked, logout) |
document.purged |
retention ended, content deleted |
The PDF engine
Section titled “The PDF engine”dompdf runs locked down: no remote resources, no PHP, no JavaScript, files
only from the bundled fonts. Images are embedded. The engine sits behind
Anvil\Documents\DocumentRenderer, so it can be replaced (e.g. by a
rendering service) without changing templates.
Tamper evidence
Section titled “Tamper evidence”- A signed document is read only; there is no API to change it.
- The PDF hash is stored with the document and in the hash-chained audit log: a changed or exchanged PDF is detected.
- The content hash binds the signature to the content the signer saw.