This page identifies third-party providers that may process personal data for inSigner or in connection with a feature selected by a customer. Not every provider is used for every customer, document, recipient, or deployment.
1. Scope and terminology
A “subprocessor” is a provider engaged by Nubesti LLC to process personal data on behalf of a customer. Some listed services may instead act as an independent controller for a payment, identity interaction, communications account, or public trust service. The role depends on the service, data, contractual relationship, and applicable law.
Production application compute, PostgreSQL, Redis, and backup operations may run on infrastructure administered by Nubesti LLC or a hosting provider selected for the applicable deployment. Enterprise private-cloud and on-premise deployments can use a different provider set. Customers may request current deployment details during security or DPA review.
2. Core service providers
| Provider | Purpose | Data involved | Use |
|---|---|---|---|
| Cloudflare | Website delivery, edge security, object storage through R2, and operational key-value storage | Request metadata, IP address, PDFs, attachments, reports, certificates, backups, and operational records | Core where configured |
| PayPal | Subscription checkout, recurring billing, payment status, and fraud prevention | Account email, plan, amount, subscription reference, payment and transaction data | Paid self-service plans |
| Zoho ZeptoMail | Transactional email delivery | Sender and recipient email, name, subject, message, signing links, status, and delivery metadata | Core communications |
Database and application hosting information is deployment-specific and is made available to Enterprise customers and DPA counterparties. Nubesti LLC remains responsible for selecting and administering those services under applicable contractual obligations.
3. Optional identity and communications providers
| Provider | Feature | Data involved | Triggered when |
|---|---|---|---|
| OAuth account authentication | Google account identifier, name, email, profile information, and authentication metadata | A user chooses Google sign-in and it is enabled | |
| Didit | KYC, document, identity, and liveness verification | Identity documents, images, biometric or liveness signals, session data, and verification result | A sender requires KYC for a recipient |
| Kapso | WhatsApp API orchestration | Phone number, recipient and sender names, message template values, links, codes, and delivery status | WhatsApp notification or OTP is enabled |
| Meta / WhatsApp | WhatsApp message delivery | Phone number, message content, template parameters, account and delivery metadata | A WhatsApp message is sent |
| Infobip | SMS and optional WhatsApp delivery or fallback | Phone number, message or verification code, sender information, and delivery status | The configured communication route uses Infobip |
Customers choose whether to require KYC, phone-based authentication, or WhatsApp notifications. The provider may apply its own privacy notice directly to the recipient interaction.
4. Timestamp and document trust services
Depending on customer settings and certificate configuration, inSigner can contact an external timestamp authority or public timestamp calendar. These services generally receive a cryptographic hash or RFC 3161 request rather than the readable document.
| Provider | Service | Typical data | Status |
|---|---|---|---|
| DigiCert | RFC 3161 timestamp authority | Document digest, timestamp request, IP and technical metadata | Optional or certificate-dependent |
| Sectigo | RFC 3161 timestamp authority | Document digest, timestamp request, IP and technical metadata | Customer-selectable |
| FreeTSA | Community RFC 3161 timestamp service | Document digest, timestamp request, IP and technical metadata | Customer-selectable |
| OpenTimestamps calendar servers | Bitcoin-anchored timestamp proof | Cryptographic digest and network metadata | Customer-selectable |
Timestamp and public calendar operators may act independently rather than as subprocessors. Their receipt or verification of a cryptographic digest does not give them the original PDF.
5. Customer-selected integrations
A Developer or Enterprise customer may connect its own webhook endpoints, applications, storage, CRM, automation, or other systems. Those providers are selected and controlled by the customer and are not inSigner subprocessors merely because data is sent through an API or webhook at the customer’s direction.
Customers are responsible for securing API keys and webhook secrets, validating destinations, limiting payloads, and ensuring that each connected system has an appropriate lawful basis and data-processing arrangement.
6. Changes to this list
We may add, replace, or remove providers as the service evolves. We will update this page before or after a material change as required by an applicable Data Processing Addendum. Contractual notice and objection procedures, if any, are governed by that DPA.
7. Contact
To request current hosting-region details, a DPA, or provider information for a security review, contact sales@insigner.co. General privacy questions may be sent to hi@insigner.co.