Privacy and data: the DPA, subprocessors and security

Settings, Privacy and data holds the data processing agreement (sign it to get a copy countersigned by Sovrasign), the subprocessor list with its change notices and how to object, the security overview and your records.

Partly available. The parts marked “Planned” describe features that are not available yet.

Open Settings and choose Privacy and data.

The data processing agreement (DPA)

The DPA is part of our terms on every plan, Free included: when you accepted the terms, you accepted the DPA too, and Sovrasign recorded its version. It applies without a signature.

Signing it is optional. If your records need a copy signed by both of us, an owner or admin can choose Sign a copy (optional). Sovrasign sends the agreement to your own address, like any envelope; open it and sign it with your company name. Once it is signed, Download the signed copy gives a ZIP with:

the PDF with your signature, which verifies on its own;
Sovrasign's countersignature (countersignature.json and its seal, checked with the keys at /v1/evidence/jwks), over the fingerprint of the signed PDF;
the certificate of completion and the activity log.

The signed DPA never counts toward your plan's envelopes.

Planned. Until the DPA is reviewed by counsel and published, Settings says "The data processing agreement can be signed here once its text is published".

Subprocessors

The page lists the companies that process customer data for Sovrasign: what each does, which data, where, and what protects the transfer. When we add one, or one starts processing new data, we tell you at least 30 days before:

an email to every owner, unless the owner turned it off with Email me about subprocessor changes; admins and members can turn it on for themselves;
a notice on this page for owners and admins until the change applies.

To object, an owner or admin chooses Object on the change, says why for reasons relating to data protection, and sends it before the change applies. We confirm by email and answer before the change applies. If we cannot resolve it, you may end the affected service with a refund of prepaid fees for the unused period (clause 8.5 of the DPA). A workspace objects once per change ("Your workspace has already objected to this change"); after the change applies, write to our privacy contact instead ("The time to object to this change has ended").

Security overview

Download the security overview gives a PDF that explains how Sovrasign protects your documents and accounts, with the status of each control.

Planned. The penetration test summary comes after the first test.

Your records

The page lists the terms, beta terms and DPA versions you accepted, and when. To take everything with you, see Export your data.

Error codes

If the app or the page names an error code, it is one of these.

Code	What it means	What to do
`dpa_not_available`	"The data processing agreement can be signed here once its text is published."	Nothing to do now: the DPA already applies without a signature.
`dpa_not_signed`	The data processing agreement is not signed yet, so there is no signed copy to download.	Open it from your email or the envelope's page and sign it.
`security_overview_not_available`	"The security overview can be downloaded here once it is published."	Try again once it is published.
`already_objected`	"Your workspace has already objected to this change. We will answer by email."	Wait for our email.
`objection_closed`	"The time to object to this change has ended": the change already applies.	Write to our privacy contact.
`owners_only`	Only an owner or admin of the workspace can do this (sign the DPA, object, export).	Ask an owner or admin of the workspace.