Code signing policy
Last updated: 10 November 2026
Echo's Windows downloads (Echo-Setup.exe and EchoClip.exe, the program in the installer and in the portable zip) are built from the public source code by GitHub Actions and signed with a Certum Open Source Code Signing certificate (issued to the project's developer, Resister0 on GitHub). Every Windows release since Echo 2.0.0 (10 November 2026) is signed.
The certificate is new, so on some PCs Windows SmartScreen may still show "Windows protected your PC" until it has built up trust. If that happens, click More info, then Run anyway.
You can check a download: right-click the file, choose Properties, open the Digital Signatures tab and check that the signature is valid and the certificate is from Certum.
What gets signed
- Only files built from the public repository github.com/Resister0/echoclip by its GitHub Actions workflow. Every release on GitHub shows the exact commit it was built from.
- Echo's own program files (the installer, its uninstaller and EchoClip.exe). Third-party tools that come with Echo - FFmpeg, rclone - are the unchanged official builds from their own projects and keep their authors' signatures, if they have any.
- Nothing is signed by hand on a personal computer.
Team and roles
| Role | Who |
|---|---|
| Committers and reviewers | Resister0 (@Resister0) |
| Approvers (every signed release is approved by hand) | Resister0 (@Resister0) |
Everyone with access uses two-factor authentication on GitHub, and the signing key is protected by Certum's SimplySign one-time codes. Outside contributions are reviewed before they are merged.
Privacy
Echo does not send any data to other computers unless you ask it to, with one exception: an installed Echo checks echoclip.link every few hours for a newer version. That check contains only Echo's version number and your system type (Windows or Linux); echoclip.link counts how many copies of each version check in per day and from which country, without keeping IP addresses.
Everything else happens only when you choose it: connecting a cloud (Echo Cloud, Google Drive or your own storage), making a share link, sending feedback or sending a log. The full details are in the privacy policy, which the Windows installer also links to.
Reporting a problem
If you think a signed Echo file was tampered with or behaves maliciously, email support@echoclip.link. The signing certificate can be revoked by Certum if this policy is broken.