Subprocessors, version sp-1
Version sp-1, published 2026-11-10, effective 2026-11-10. Each version is fixed once published; a change is a new version. SHA-256 867956879591faed83b2346e170dc6514fc5ca32bcdb33b71e79818222bf3f26. This version's fixed copy.
. The list
Sovrasign Subprocessors. Version sp-1, effective 10 November 2026.
A1. What this list is
A1.1 Subprocessors. A subprocessor is a company we use to provide the service that processes personal data in our customers' content on our behalf: documents, envelopes, recipients' names and addresses, messages and the like. Stripe is on the list too, for the account holders' billing data it processes for us (A2). For that data our customer is the controller and we are the processor, under our data processing agreement (the "DPA"), which is part of our terms on every plan, Free included.
A1.2 What this list shows. For each subprocessor: what it does for us, which customer data it can process, where, and, for data from the EU, EEA, UK and Switzerland, what protects the transfer.
A1.3 Our promises. Each subprocessor is bound by a written contract with data-protection terms at least as protective as the DPA. It may use customer data only to provide its service to us. We check its security before we use it and every year after, and we remain responsible to our customers for what it does.
A1.4 Not on this list. Companies that process only data about our own business and our account holders as customers (for example our accountant) are not subprocessors of customer data; they are listed for transparency in A4. Google, Microsoft and Apple, when a person signs in with them, and Stripe, for its own fraud prevention and legal duties, act as independent controllers; see the privacy policy.
A2. Subprocessors
| Subprocessor | What it does for us | Customer data it can process | Where | Transfer safeguard (EU, EEA, UK, Swiss data) | Status |
|---|---|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosts the whole service: servers, database, document storage, encryption keys, messaging, logs, the network edge (Azure Front Door), malware scanning of uploads (Microsoft Defender for Storage), and sending email (Azure Communication Services Email) until Mailgun replaces it | All customer data. Documents are encrypted with each organization's own key; application logs contain no names, readable email addresses (only coded ones) or document content | United States: East US 2, with backups and copies in Central US. The network edge routes traffic through Microsoft's locations worldwide. Caching is off on API, signing and identity routes; request logs are kept as our privacy policy describes. EU region (Sweden Central, backups in Germany West Central and Sweden South) when it opens | EU–US Data Privacy Framework with its UK Extension and Swiss–US part (active, checked 2026-10-26); standard contractual clauses in Microsoft's data protection addendum as fallback | In use |
| Stripe, LLC | Billing and payments for account holders' plans and packs | Account holders' billing data: name, billing address, tax number, payment details (collected by Stripe; we never see full card numbers) | United States and other countries where Stripe operates | EU–US Data Privacy Framework with its UK Extension and Swiss–US part, as Stripe's Data Privacy Framework policy states (effective 28 April 2026, read 2026-10-27) and its data transfers addendum; standard contractual clauses in Stripe's data processing agreement as fallback | In use from the first payment |
| Timestamp authorities: DigiCert, Inc. during the private beta | Trusted timestamps that prove when a document was signed | Only a fingerprint (hash) of the document, never the document or its contents. A fingerprint can still be personal data when someone can link it to a person (privacy policy A9.4) | United States | Not needed: no personal data | In use. During the private beta it is our only timestamp authority; a contracted primary and failover authority are named here before paid signing |
| Mailgun Technologies, Inc. (Sinch) | Sending email: invitations, reminders, notices, completed copies and account email. Replaces Azure Communication Services Email | Recipients' names and addresses, message content; completed-copy emails carry the signed PDF | United States region for the US region of Sovrasign; EU region for the EU region | EU–US Data Privacy Framework with the UK Extension (active, checked 2026-10-26). No Swiss–US entry: Swiss data relies on the standard contractual clauses in its data processing agreement | Not used during the private beta. From a date we announce at least 30 days ahead (A5.2), before the paid launch |
| Microsoft Corporation (Microsoft Foundry) and Anthropic, PBC | The AI support assistant: Claude models made by Anthropic, accessed through Microsoft Foundry and run on Anthropic's infrastructure. Both process the conversations for us | Support conversations; account details and diagnostics the assistant looks up with read-only tools (plan, limits, envelope ids and status, delivery status, error codes). Not document contents, titles, field values or messages from stored envelopes: its tools cannot retrieve them, and recipient names and titles in tool results are replaced by codes before they reach the model. What users type into the chat does reach it, despite our warning not to paste documents | United States (Microsoft's US Data Zone) for every conversation from an account in the EU, EEA, UK or Switzerland. Other conversations: also the US Data Zone | Microsoft: Data Privacy Framework (as above). Anthropic is not certified under the Framework (checked 2026-10-26): standard contractual clauses and our transfer assessment | Not used during the private beta. From the launch of the support assistant, with 30 days' notice (A5.2) |
Planned emergency providers, not yet retained. We have not retained these providers yet. Before either receives customer data, we name it, complete its contract and transfer safeguards, and follow A5's notice and objection rules:
| Subprocessor | When | Customer data | Where |
|---|---|---|---|
| Incident response firm (not retained yet) | Only during a security incident, to investigate it | The data the investigation needs, for its duration | Named when retained |
| Continuity operator (not contracted yet) | Only if Sovrasign's founder cannot run the service, to keep it running or close it in an orderly way | Operator-level access, under the same controls and logging as our own staff | Named when contracted |
A3. Planned subprocessors (not in use)
So that customers can plan, these are the subprocessors that later features are expected to need. None of them receives customer data today. Each one is added only with the notice of A5.
| Expected subprocessor | For | Customer data | Expected |
|---|---|---|---|
| A link-reputation service | Checking links found in documents and messages against known phishing and malware sites. During the private beta we check links with our own lists only | The links only (web addresses), never the document or the message | Before the public launch |
| A text-message provider (not chosen yet), and Meta Platforms (WhatsApp Business) through it | Phone codes as an extra signer check, when the signer chooses SMS or WhatsApp | Phone numbers, codes | With phone checks (later) |
| Microsoft (Azure OpenAI, Document Intelligence, Content Safety, AI Search) | AI features that work on documents, in the customer's region only, with no training and no model-provider storage | Document text and the questions asked | With document AI (later) |
| An identity-verification provider (Persona, expected) | ID document checks, when a sender requires them | ID images, selfie, results | With ID checks (later) |
| An inbound email service (for example Mailgun inbound routes) | Agreements emailed to an organization's own Sovrasign address | Messages and attachments, passed to the region's service and not kept beyond delivery | With email-in (later) |
| A help desk (Zammad, hosted in the EU, expected) | Email threads for Enterprise support escalations | Contact data and ticket content; never document contents | Only if Enterprise support needs it |
| A status-page service | Incident notices by email | Subscribers' email addresses | Later; today's status page holds no personal data |
Qualified trust service providers (for EU qualified signatures) and remote online notarization partners, when offered, act as independent controllers under their own terms, which the signer accepts in the flow; they are not our subprocessors.
A4. Other service providers (not subprocessors of customer data)
For transparency, these providers process data about Sovrasign's own business, mostly our account holders as customers. The privacy policy covers this processing.
| Provider | For | Data |
|---|---|---|
| Accountant and accounting software (not chosen yet) | Bookkeeping and tax | Billing records: names, addresses, tax numbers, invoices |
| Sanctions screening: none. We screen paying customers ourselves against the official lists | Screening paying customers against sanctions lists | Names, organization names, countries |
| Compliance automation (Vanta, Drata or Secureframe; not chosen yet) | Evidence for security audits | Cloud configuration and staff data; no customer content |
| DMARC report analysis (not chosen yet) | Email authentication reports | Sending servers and domains; no content |
| Bug bounty platform (not chosen yet) | Security researchers' reports | Researchers' details; personal data appears only by accident in a report |
| Lawyers, auditors and insurers | Advice, audits, insurance | What each matter needs, under confidentiality |
Our newsletter and onboarding emails are sent by our own software (Listmonk, run by us) through the email subprocessor of A2.
A5. Changes and how to be told
A5.1 How you are told. We email every account owner when this list changes, unless the owner turns that email off in the account settings, and show the notice in the app to owners and admins. Anyone else can subscribe by writing to privacy@sovrasign.com. This page also shows every change with its date (A6).
A5.2 Notice before a new subprocessor. At least 30 days before a new subprocessor starts processing customer data, we update this page and tell customers and subscribers as A5.1 says: who it is, what it does, the data, where, and the transfer safeguard. The same applies when an existing subprocessor processes a new kind of customer data, for a new purpose, or in a new country.
A5.3 Objecting. Within those 30 days, a customer may object for reasons relating to data protection by writing to privacy@sovrasign.com. We will discuss it in good faith and, where we can, offer a way to avoid the change (for example a setting, or keeping the customer's data away from the new subprocessor). If we cannot resolve the objection, the customer may end the affected service before the change applies to it, with a refund of prepaid fees for the unused period and of unused pack envelopes at the price paid. Clause 8.5 of the DPA sets out the exact terms.
A5.4 Emergencies. If we must replace a subprocessor at short notice to keep the service running or secure (for example when one fails or suffers a breach), we may do so, notify affected customers and subscribers, as A5.1 describes, as soon as possible, and the objection right of A5.3 runs from that notice.
A5.5 Removals. We publish the removal of a subprocessor without a notice period.
A6. Change history
| Date | Version | Change |
|---|---|---|
| 10 November 2026 | sp-1 | First list, for the private beta |