DSV (DocSignVault) — Sub-processor List
Last updated: [DATE] (draft prepared 2026-10-08). Operated by [COMPANY LEGAL NAME], [COMPANY ADDRESS]. Privacy contact: [DPO/PRIVACY CONTACT], [CONTACT EMAIL].
1. What this list is
DSV uses the third-party providers below to run the service. Where a provider handles personal data of Signers on behalf of a Sender, it is a "sub-processor" under the Data Processing Agreement (DATA_PROCESSING_AGREEMENT.md). Providers that receive no personal data are listed anyway, so you can see everything the service talks to.
Items marked "[selected at deployment]" are not final. This list will be completed before the service is offered to customers.
2. Active sub-processors
| Provider | Purpose | Data involved | Location | Link |
|---|---|---|---|---|
| Stripe, Inc. (and affiliates) | Subscription billing for Sender accounts: card payment, invoices, receipts | Sender name, email, billing address, card details (entered directly with Stripe, never seen by DSV), subscription status. No Signer data. | United States and other Stripe locations [counsel to confirm] | https://stripe.com/privacy |
| Twilio SendGrid | Sending email: signing links, one-time codes, notifications, completed-document notices | Recipient email address and name, message content (document title, sender business name), delivery events | United States [confirm] | https://www.twilio.com/legal/privacy |
| Twilio | Sending SMS one-time codes and signing-link messages when the Sender chooses SMS | Recipient mobile number, message text (code or link), delivery status | United States and carrier networks [confirm] | https://www.twilio.com/legal/privacy |
| Object storage: Amazon Web Services (S3) or Cloudflare R2 | Storage of encrypted ID photos and face-with-ID photos (separate private bucket), completed PDFs, templates, logos | Encrypted photo files (already encrypted in the application with AES-256-GCM before upload), PDFs, which contain all signing data and the audit trail | [selected at deployment] region [REGION] | AWS: https://aws.amazon.com/privacy/ — Cloudflare: https://www.cloudflare.com/privacypolicy/ |
| Hosting provider: [Hetzner or selected host] | Servers for the web application, background worker, database (PostgreSQL) and queue (Redis); backups | All data processed by the application, including encrypted photos and field values in encrypted form, session data, audit logs | [selected at deployment] [Hetzner: Germany/Finland, or as selected] | Hetzner: https://www.hetzner.com/legal/privacy-policy/ |
| Key management service (cloud provider's KMS, [selected at deployment], e.g. AWS KMS) | Holds the master key that wraps account data keys | Cryptographic keys only; no document content or personal data | [REGION] | [Provider link] |
3. Optional sub-processor
| Provider | Purpose | Data involved | Location | Link |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error monitoring for the application, if enabled | Technical error reports: stack traces, request path, browser type, and IP address of the user at the time of an error. Logs are redacted before sending and photo content is never sent. We configure it not to capture form values or request bodies. [Counsel: confirm configuration and whether enabled at launch.] | United States (or EU region if selected) [confirm] | https://sentry.io/privacy/ |
4. Providers that receive no personal data
| Provider | Purpose | Data involved | Location | Link |
|---|---|---|---|---|
| DigiCert public timestamp authority (RFC 3161) | Adds a trusted timestamp to each sealed PDF | Only a cryptographic hash of the signature value. No names, no document content, no personal data. | United States and other DigiCert locations | https://www.digicert.com/legal-repository |
| Google favicon service | Shows the small logo of a website next to its name on the signing page (for example in the website acknowledgment list) | Only website domain names chosen by the Sender. No personal data about Signers. The signer's browser may contact the service directly, in which case Google may see the browser's IP address. [Counsel: confirm, and consider proxying or caching favicons on DSV servers.] | United States and other Google locations | https://policies.google.com/privacy |
5. Planned, not active
| Provider | Purpose | Status | Data it would receive |
|---|---|---|---|
| DeepL SE or Google Translate | Automatic translation of document text so a Signer can read a convenience translation next to the original | Phase 2, not yet active. No translation provider receives any data today. Before activation DSV will update this list and give the 30-day notice below. | The text of the document being viewed, which may include personal data typed into it. Photos and ID numbers would not be sent. [Counsel: confirm; consider whether a Sender-level opt-in is needed.] |
DeepL: https://www.deepl.com/privacy — Google Cloud Translation: https://cloud.google.com/terms/data-processing-addendum
6. What DSV does not use
For clarity: DSV does not use any identity-verification, OCR, face-recognition or liveness-detection provider. It does not use advertising or cross-site analytics providers. It does not send ID photos to any translation, email or SMS provider.
7. How sub-processors are held to account
DSV has, or will have before launch, a written agreement with each sub-processor that handles personal data, requiring data protection terms no less protective than the DPA, confidentiality, security measures and assistance with breach notification and data subject requests. [Counsel: confirm that signed DPAs are in place with Stripe, Twilio/SendGrid, the storage provider, the host and Sentry.]
Photos are encrypted in the application before they reach object storage, so the storage provider holds only encrypted files and does not hold the keys. Keys are wrapped under a master key in a key management service.
8. Change notification promise
- DSV will give at least 30 days' notice before adding a new sub-processor or replacing one that handles personal data, or before moving data to a new country.
- Notice goes by email to each account owner and is reflected in this document with a new "Last updated" date.
- A Sender may object on reasonable data protection grounds within the 30 days. The process and remedies are in section 6 of the DPA.
- Urgent replacements (for example a provider failing suddenly) may be made on shorter notice to keep the service secure or available. We will notify as soon as possible and the objection right still applies.
- We keep a change log below.
9. Change log
| Date | Change |
|---|---|
| 2026-10-08 | Initial draft list prepared. Not in force. |
10. Subscribe to updates
To receive sub-processor change notices at an address other than your account email, write to [CONTACT EMAIL] with the subject "Sub-processor updates". [Counsel/owner: confirm whether a separate subscription mechanism will be built.]