In short
- Service subprocessors process customer documents and signer data on our instructions.
- Analytics and advertising partners receive data only from visitors who accept cookies.
- We give 15 days’ notice before a new service subprocessor starts processing customer data.
Service subprocessors
These providers process customer content or signer data to run inSigner:
| Provider | Purpose | Data | Main locations | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Application hosting, database, file storage, content delivery, DDoS protection, and bot challenges | All customer content and service logs | Global network, United States | Data Privacy Framework and Standard Contractual Clauses |
| Amazon Web Services, Inc. | Cloud infrastructure, storage, and message delivery services | Customer content as needed, and phone numbers | United States and other AWS regions | Data Privacy Framework and Standard Contractual Clauses |
| Zoho Corporation (ZeptoMail) | Transactional email, such as signing invitations and account messages | Names, email addresses, and message content | United States | Standard Contractual Clauses |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp one-time codes and document signing on WhatsApp, when turned on | Phone numbers and message content | United States and Meta’s global infrastructure | Data Privacy Framework and Standard Contractual Clauses |
| Didit | Identity verification, when the KYC add-on is turned on | Identity documents, selfies, biometric templates, and registry data | As stated in Didit’s data processing terms | Standard Contractual Clauses where needed |
| Google LLC (Google Workspace) | Business email and support correspondence | Support messages, which may include customer content that you send us | United States | Data Privacy Framework and Standard Contractual Clauses |
Business and advertising providers
These providers support our business. They do not process documents. Analytics and advertising providers receive data only from visitors who accept the matching cookies, and some of them act as independent controllers for their own purposes:
| Provider | Purpose | Role |
|---|---|---|
| PayPal | Subscription payments | Independent controller |
| Google (Tag Manager, Analytics, Ads) | Loading tags, website analytics, ad measurement, and remarketing | Processor for analytics, independent controller for some advertising purposes |
| Microsoft (Clarity, Microsoft Advertising) | Heatmaps and session analytics, ad measurement on Bing and partner sites | Processor for Clarity, independent controller for some advertising purposes |
| Meta Platforms (Meta Pixel, Conversions API) | Ad measurement on Facebook and Instagram | Joint controller for collection and transmission, then independent controller |
| TikTok (TikTok Pixel, Events API) | Ad measurement on TikTok | Independent controller for its own purposes |
Mobile apps
No app store company processes document content on this date, because the iOS and Android apps are not yet available. Before an app uses Apple Push Notification service, Firebase Cloud Messaging, or another provider that receives document content or notification tokens, we will add it here.
Changes and notifications
We update this page at least 15 days before a new service subprocessor starts processing customer personal data, except in an emergency. To receive an email when this list changes, write to [email protected] with the subject “Subprocessor updates”. Customers may object as described in the data processing agreement.