Data processing addendum

1. Roles

You are the controller for the personal data in the documents you send and the recipients you send them to. Signclad Inc. is the processor. Where Signclad determines its own purposes — account administration, billing, security — it is a controller, and the privacy policy governs that.

2. Subject matter and duration

• Subject matter: providing electronic signature and evidence services.
• Duration: the term of your agreement, plus the evidence retention period.
• Nature and purpose: storing and rendering documents, delivering signing requests by email, collecting signatures, field values and attachments, generating and sealing artifacts, and recording the audit trail.
• Categories of data subject: your personnel, your recipients (signers and CC), and anyone named in a document you upload.
• Categories of personal data: names, email addresses, IP addresses, user agents, timestamps, signature images or typed names, and whatever the documents themselves contain.
• Special categories: protected health information is permitted only under an executed business associate agreement. See section 9.

3. Processing instructions

Signclad processes personal data only on your documented instructions, which are these terms, the main agreement, and your use of the product and API. Signclad will tell you if an instruction appears to breach applicable law rather than following it silently.

4. Confidentiality

Everyone with access is under a confidentiality obligation, has completed security training, and holds access on a least-privilege basis reviewed quarterly.

5. Security measures

The technical and organisational measures are the control programme summarised on the security page, including:

• Server-side AES-256 encryption for document object storage and backups; HTTPS for public application and API connections.
• Document-signing keys held in a KMS/HSM that cannot export them.
• Workspace-scoped isolation on every query.
• Centralised tamper-evident logging with defined retention.
• Hash-chained event records and versioned object storage.
• Automated tests and security checks in CI.

6. Sub-processors

You give general authorisation for the sub-processors on the current sub-processor list, which names every third party that touches customer data and where it processes it. Signclad gives 30 days notice of any addition or replacement, and you may object on reasonable data protection grounds within 30 days. Each sub-processor is bound by terms no less protective than these.

7. International transfers

Data is hosted in the United States. Signclad does not currently offer the service to, or monitor individuals in, the EEA, the UK, or Switzerland, so no transfer mechanism is relied on for those regions. Data residency options for Enterprise are agreed in writing.

8. Assistance

• Data subject requests: Signclad routes any request received directly from your recipient to you and assists you in responding, within 10 business days.
• Breach notification: Signclad notifies you without undue delay and in any case within 72 hours of becoming aware, with what is known, what is affected, and what is being done.
• Impact assessments: Signclad provides the information you reasonably need for a DPIA or prior consultation.

9. Health information

Signclad is HIPAA compliant and the HIPAA audit is complete and passed, but Signclad does not sign business associate agreements today and is therefore not a business associate. Protected health information must not be submitted: this addendum does not authorise it, and Signclad does not knowingly accept it. A BAA is planned on Business and Enterprise once the HIPAA programme completes, and when one is executed it will govern PHI wherever it conflicts with this addendum. See the healthcare page for what can be sent today, or ask through the contact form.

10. Deletion and return

On termination, Signclad deletes or returns personal data at your choice within 30 days, except the sealed artifacts and hashes required to keep the evidence chain intact, which are retained for 7 years and then deleted.

11. Audits

Signclad will make available the information needed to demonstrate compliance, and will support audits once a year, on 30 days written notice. Signclad's SOC 2 report is offered under NDA in place of an on-site audit; contact us to request it.

12. Contact

Privacy and security enquiries, and requests for a signed copy of the DPA once it is published, go through the contact page.