Everything Results AI Sign produces stays on your own hosting.
The database side:
The plugin creates four tables in your WordPress database. One holds documents, with their content, configuration, status, fingerprints and dates. One holds signers, with the name, email, private token, order, status, access code, captured field values, consent, view and signing timestamps, IP address and user agent. One is the append only audit log of events. One holds the templates you have saved yourself.
The file side:
Signature images, uploaded PDFs and finished sealed PDFs are written to a dedicated folder inside your WordPress uploads directory. On creation, the plugin writes an .htaccess file denying direct web access and an index.php file so the folder cannot be browsed. Files are never linked to directly. They are streamed through endpoints that check either an admin capability or the signer's own token, and admin downloads carry a nonce.
Who can read what:
Administrators with the manage options capability reach every document through the admin screens. A signer reaches only the document their token belongs to, can view the original uploaded PDF, and can download the final PDF once the document is completed and not before. Every admin download and every signer download of a completed file is written into the audit trail.
IP addresses:
The plugin records the direct connecting address only. Forwarded headers are deliberately ignored because they can be spoofed and this value is used as evidence.
Signing pages are marked noindex and nofollow and sent with no-cache headers, so a document cannot end up in a search engine.
Retention and erasure requests:
Signer data stays on your server, so you decide retention. Bear in mind that a signed contract is often itself a lawful basis for keeping records for a statutory period, and a right to erasure is not absolute where you have a legal obligation to retain. Talk to your own accountant or lawyer before deleting legal records.
Deleting the plugin does not delete your data. That is deliberate. Uninstalling clears only scheduled tasks and cached update data. The Danger Zone in Settings is the only thing that erases documents, signatures, audit trails and templates.