What is a sub-processor?
When SignFile processes customer data on your behalf, some of that processing happens inside third-party services we use — payment processors, error reporters, email senders, the underlying database host. Under GDPR these third parties are “sub-processors”. This page lists everyone we share data with.
Current sub-processors
All sub-processors below have signed a Data Processing Addendum (DPA) with us that mirrors our own customer DPAs and commits them to GDPR-equivalent data handling.
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
Appwrite Cloud Since 2026-01-01 · Active | Primary hosting — database, file storage, authentication, and the web app runtime (Cloud Sites). | All customer data: account profiles, workspaces, documents, audit events, signer metadata. | EU (Frankfurt, fra region) |
Cloudflare Since 2026-01-01 · Active | DNS and CDN for signfile.io. Terminates TLS at the edge; proxy is currently disabled for the apex domain so SPF/DKIM/DMARC email routing works. | TLS metadata, request IP, request headers (no request bodies cached). | Global edge network |
Google SMTP (Gmail relay) Since 2026-01-01 · Active | Outbound transactional and (with consent) marketing email. Sender envelope is noreply@signfile.dev; the From header is noreply@signfile.io. | Recipient email, sender name, document title (in subject), message body (HTML + plain text). No document content. | US (Google's SMTP relay) |
Dodo Payments Since 2026-06-26 · Active | Payment processor for paid plans (Starter / Pro / Team). Acts as Merchant of Record — issues the legal tax invoice. | Customer email, billing name, payment method last-4, plan + interval, transaction history. | US / EU (per Dodo's customer routing) |
Sentry Since 2026-06-24 · Active | Server-side error reporting. Captures uncaught exceptions + slow-query signals. PII (request bodies, signature data URLs, uploaded PDF metadata) is explicitly suppressed via sendDefaultPii: false. | Stack traces, request URL, response status, server IP. No request bodies, no signature data, no document content. | EU (ingest.de.sentry.io) |
cron-job.org Since 2026-07-04 · Active | External HTTP cron scheduler. Sends requests to our /api/cron/* routes on a schedule (document expiry, sign reminders, dunning cadence, stale-lock cleanup). It is an HTTP caller, not a data processor for document content. | The request URL we configure (which contains only the route path, never a document id or payload), the Authorization: Bearer header (one of our CRON_SECRET / SETUP_SECRET tokens), and the user-agent string. No request bodies, no document content, no signer metadata. | EU (api.cron-job.org — German provider) |
How to subscribe to changes
We will give customers at least 30 days’ notice before adding a new sub-processor or replacing an existing one, via:
- An email to the workspace owner (the address on file)
- An in-app banner on every dashboard page that links back to this page
- An update to the Privacy Policy with the new “Who we share with” list
If a new sub-processor materially changes what data we share or where it’s stored, you can object by emailing support@signfile.io. We’ll work with you on a transition plan or, if that’s not possible, close your account and delete your data per our retention policy.
Data Processing Agreement
Customers on paid plans can request a signed DPA by emailing support@signfile.io. A self-service DPA acceptance flow on /settings/billing is on the roadmap.