Getting started with QuoteCloud

Security for QuoteCloud API integrations

What QuoteCloud protects once a document exists, and what your side of the integration should do with credentials, links and events.

Start free 14-day trial Book a demo

Documents your system creates get the same protection as any QuoteCloud document: hosting on Amazon Web Services, 256-bit encryption, optional one-time passcodes for signers, eIDAS-compliant eSignatures and a certificate with an audit trail. Your side: keep QuoteCloud credentials on your server, use short-lived PDF links at once, and check a secret on your event endpoint.

Last reviewed by the QuoteCloud team

How does QuoteCloud protect the documents?

From QuoteCloud's security page, for every document, however it was created.

  • Hosted on AWS, encrypted

    QuoteCloud runs on Amazon Web Services, with personal information stored on servers in the USA, and documents encrypted with 256-bit encryption.

  • Deleted isn't gone

    Deleted documents go to Trash first, so they can be restored. You can export your document data whenever you need a record of your own.

  • Roles and teams

    Custom roles and teams set who can use what, from Essentials. Content can be locked so a document stays on message.

  • Card details never stored

    Clients pay through the payment gateway inside the document; QuoteCloud never stores the card details.

What protects every signature?

  • A passcode before the pen

    Optional recipient verification emails the signer a one-time passcode before they can sign.

  • Legally binding under eIDAS

    Signers draw, type or upload a signature, with no account to create, and several people can sign one document.

  • A certificate and audit trail

    Every completed document includes a certificate of authenticity, an audit trail and its own document ID.

What should your side of the integration do?

QuoteCloud protects the document. The integration around it is yours: where the credential lives, how long links live, and who can post to your endpoint.

  • Keep the QuoteCloud credential on your server, never in a web page or app.
  • Use PDF links at once: they're short-lived. Page preview URLs last one hour.
  • Check a secret header on every event your endpoint receives, and apply each event once.
  • Disconnect Zapier or Make from QuoteCloud when a project ends.
Authentication and keys
Your endpointTidewell Pavilion Sample code
Illustrative

What your endpoint receives

// What your endpoint receives is up to you: in the Zap, the// Webhooks by Zapier POST step sends the fields you map from// QuoteCloud's trigger. Illustrative values.{  "event": "Document Signing Complete",  "documentNumber": "{DOCUMENT_NUMBER}",  "title": "Hannah & James's wedding reception",  "enquiryId": "ENQ-50418",  "total": 24611.40,  "signedAt": "2026-11-02T19:42:00"}

Your handler

// Illustrative handler on your server (Node-style JavaScript).app.post("/hooks/quotecloud", async (req, res) => {  if (req.get("X-Hook-Secret") !== process.env.HOOK_SECRET) {    return res.sendStatus(401); // a header you set in the Zap  }  const { event, enquiryId, documentNumber } = req.body;  const seen = await bookings.alreadyApplied(event, documentNumber);  if (!seen) {    if (event === "Document Signing Complete") await bookings.confirm(enquiryId);    if (event === "Document Part Paid") await bookings.markDeposit(enquiryId);    if (event === "Document Expired") await bookings.releaseDate(enquiryId);  }  res.sendStatus(200);});

Illustrative. You design this body in the Zap's Webhooks by Zapier step; QuoteCloud's own event payload isn't published.

Rated, secure and in business since 2013

  • eIDAS compliant eSignatures
  • 256-bit encryption
  • Hosted on AWS
  • GDPR compliant

See it on your own documents

Start a free 14-day trial and send a test document with passcode verification switched on.

Start free 14-day trial Book a demo

Security questions

Where does QuoteCloud store documents created through the API?

In the same place as every QuoteCloud document: on Amazon Web Services, with personal information stored on servers in the USA and documents encrypted with 256-bit encryption. Deleted documents go to Trash first, so they can be restored, and you can export your document data.

How long does a QuoteCloud PDF link last?

It's short-lived. Generate or Fetch Document PDF Link returns a secure link for a moment's use, so download the PDF and store it in the same run. A page preview from Get Document Page Preview returns a URL valid for one hour.

How do I know an event really came from my Zap?

Add a secret header in the Zap's Webhooks by Zapier step, and have your endpoint reject any request without it. Keep the secret in your server's settings, apply each event once, and use QuoteCloud's Find Document Status if you want to double-check a document's state.

Are documents created through the API legally binding when signed?

Yes. They're ordinary QuoteCloud documents, signed with eIDAS-compliant eSignatures, with optional one-time passcode verification for each signer. Every completed document includes a certificate of authenticity, an audit trail and its own document ID, however it was created: through the API, Zapier or by hand.

More API questions

More on the QuoteCloud API

What you can build, how to set it up, and the cost.

Secure documents. A careful integration.

Start a free 14-day trial and read QuoteCloud's security page with your security team.

Start free 14-day trial Book a demo

See pricingQuoteCloud on ZapierAll integrations