In short
- Files a customer uploads, including the documents and the completed PDF, are stored in Cloudflare R2 in the European Union.
- Service subprocessors process customer documents and signer data on our instructions.
- Analytics and advertising partners receive data only from visitors who accept cookies.
- We give 15 days’ notice before a new service subprocessor starts processing customer data.
Service subprocessors
These providers process customer content or signer data to run inSigner:
| Provider | Purpose | Data | Main locations | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. (R2) | Storage in Cloudflare R2 of the files a customer uploads, including the documents and the completed PDF | Those files | European Union | The files stay in the European Union |
| Cloudflare, Inc. | Application hosting, database, content delivery, DDoS protection, and bot challenges | Service logs and data those services process | Global network, United States | Data Privacy Framework and Standard Contractual Clauses |
| Amazon Web Services, Inc. | Cloud infrastructure, storage, and message delivery services | Customer content as needed, and phone numbers | United States and other AWS regions | Data Privacy Framework and Standard Contractual Clauses |
| Zoho Corporation (ZeptoMail) | Transactional email, such as signing invitations and account messages | Names, email addresses, and message content | United States | Standard Contractual Clauses |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp one-time codes and document signing on WhatsApp, when turned on | Phone numbers and message content | United States and Meta’s global infrastructure | Data Privacy Framework and Standard Contractual Clauses |
| Didit | Identity verification, when the KYC add-on is turned on | Identity documents, selfies, biometric templates, and registry data | As stated in Didit’s data processing terms | Standard Contractual Clauses where needed |
| Google LLC (Google Workspace) | Business email and support correspondence | Support messages, which may include customer content that you send us | United States | Data Privacy Framework and Standard Contractual Clauses |
Files a customer uploads, including the documents and the completed PDF, are stored in Cloudflare R2, and that storage stays in the European Union. The other Cloudflare services in this table use a global network, with the United States as a main location. ZeptoMail and Google Workspace are listed in the United States. Amazon Web Services is listed in the United States and other AWS regions. Didit stays as stated in its data processing terms. Meta is listed in the United States and on Meta’s global infrastructure. Standard Contractual Clauses and the Data Privacy Framework cover transfers that leave the European Union. Storing those files in the European Union does not replace an establishment or a representative in the European Union. For documents the customer sends, the customer is the controller and Nubesti is the processor. Nubesti is the controller for account, billing, security, support, and marketing.
Business and advertising providers
These providers support our business. They do not process documents. Analytics and advertising providers receive data only from visitors who accept the matching cookies, and some of them act as independent controllers for their own purposes:
| Provider | Purpose | Role |
|---|---|---|
| PayPal | Subscription payments | Independent controller |
| Google (Tag Manager, Analytics, Ads) | Loading tags, website analytics, ad measurement, and remarketing | Processor for analytics, independent controller for some advertising purposes |
| Microsoft (Clarity, Microsoft Advertising) | Heatmaps and session analytics, ad measurement on Bing and partner sites | Processor for Clarity, independent controller for some advertising purposes |
| Meta Platforms (Meta Pixel, Conversions API) | Ad measurement on Facebook and Instagram | Joint controller for collection and transmission, then independent controller |
| TikTok (TikTok Pixel, Events API) | Ad measurement on TikTok | Independent controller for its own purposes |
Mobile apps
No app store company processes document content on this date, because the iOS and Android apps are not yet available. Before an app uses Apple Push Notification service, Firebase Cloud Messaging, or another provider that receives document content or notification tokens, we will add it here.
Changes and notifications
We update this page at least 15 days before a new service subprocessor starts processing customer personal data, except in an emergency. To receive an email when this list changes, write to hi@insigner.co with the subject “Subprocessor updates”. Customers may object as described in the data processing agreement.