---
title: "Privacy"
description: "Signer privacy options: masking signers' CPF, collecting geolocation on electronic signatures and document access validation. All of them apply to the whole instance."
canonical: "https://docs.lacunasoftware.com/en-us/articles/signer/concepts/privacy"
locale: "en"
product: "Signer"
last_updated: "2026-10-22"
---

# Privacy

Signer has three options that control which personal data is shown or collected: CPF masking, geolocation and
document access validation.

> **Note: Instance settings**
>
> All three options apply to the whole instance, not to one organization. If you use Signer in the cloud (SaaS), ask
> Lacuna support to change them. If you run your own instance, the
> [Signer settings](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/settings) page describes each option.

## CPF masking

By default, Signer shows the signers' full CPF. The `MaskUserIdentifier` setting of the `General` section hides
part of the number. It exists since version 1.35.0 and is off by default.

With masking on, the CPF `123.456.789-09` shows as `***.456.789-**`. Other identifiers are also partly hidden. For
example, a passport shows only its last three characters. A CNPJ is never masked.

Masking applies in these places:

* The visual representation of the signature in the PDF.
* The printer-friendly version (signature manifest).
* The validation page and the validation API.
* The notification e-mails that list the participants.

Masking applies only to documents generated after it was turned on. A PDF that was already generated keeps the
full CPF.

The `MaskUserEmailAddress` setting does the same for users' e-mail addresses.

## Geolocation

On an electronic signature, Signer asks the browser for the signer's location. The browser asks the signer for
permission.

| Setting (`ElectronicSignature` section) | Default | Effect |
|---|---|---|
| `CollectGeolocation` | On | If you turn it off, Signer never asks for the location. It exists since version 3.0.0. |
| `IsGeolocationRequired` | Off | If you turn it on, the signer can only sign if the browser sends the location. Without it, the sign button stays disabled. |

If the location is not required and the signer does not allow it, they sign as usual. The location appears in the
evidence of the printer-friendly version, with latitude, longitude and accuracy in meters.

## Document access validation

The public validation page shows the signature data of a document. **Access validation** makes whoever opens that
page prove they may see the document. For example, the person enters the CPF of a signer.

The feature exists since version 2.7.0 and is off by default. With it on, whoever creates the document picks the
validation type. The instance can also require validation on every document. See
[*Document Access Validation* settings](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/settings#document-access-validation).