Sub-processors
Every third party that touches customer data, what it does, and where. This list is part of the data processing addendum.
Effective March 3, 2024
Current list
Every sub-processor is reviewed under the vendor management policy before it touches customer data. Names in brackets are pending publication here; entries marked "Under review" are in the review step and are not yet processing customer data. This page is the authoritative list.
| Purpose | Sub-processor | Data processed | Location | Status |
|---|---|---|---|---|
| Cloud infrastructure | DigitalOcean | Hosting the application, the database, and the queue | United States (NYC3) | In use |
| Object storage, email, and key custody | Amazon Web Services | S3 for documents, sealed artifacts, and backups; SES for signing invitations, reminders, and completion notices; KMS for the document-signing key | United States (us-east-1) | In use |
| Payments and billing | Stripe | Subscriptions, usage billing, invoices | United States | In use |
| Timestamp authority | freetsa.org | RFC 3161 timestamps on sealed documents | Austria | Not in use — third-party timestamping is disabled, so no document hash is sent |
How changes are notified
- Additions and replacements are announced 30 days in advance by email to account owners who have subscribed, and on this page.
- You may object on reasonable data protection grounds within 30 days of notice.
- Every sub-processor is reviewed before it touches customer data, and reassessed annually, under the vendor management policy.
- No sub-processor receives more data than its purpose requires. The timestamp authority would receive a document hash and never the document, and while third-party timestamping is disabled it receives nothing at all.
What no sub-processor does
None of them receives your documents for any purpose beyond the one named above, and none is permitted to use your data to train models. Signclad does not use customer documents, field values, or signatures to train anything.
Subscribe to changes
To be notified of additions, ask through the contact form.