On this page6 sections
Suresign uses a small number of infrastructure vendors to run the service. Each is a subprocessor under Article 28 of the GDPR and a Data Processor under the Digital Personal Data Protection Act, 2023, each is bound by a written contract that limits them to our documented instructions and imposes confidentiality and security obligations at least as protective as our own, and each is listed here.
1.Current subprocessors
Provider
Vercel Inc. (United States)
What it does for us
Application hosting, serverless compute, content delivery and scheduled jobs. Everything you do in the product passes through it.
Personal data it may process
All data in transit, request logs including IP address, the approximate place it resolves each request's address to, and anything held in memory during a request.
Location
United States, with edge delivery from regions worldwide.
Transfer safeguard
Standard Contractual Clauses. Provider publishes a SOC 2 Type II report.
Provider
Neon Inc. (United States)
What it does for us
Managed PostgreSQL database.
Personal data it may process
Account and profile data, workspace and membership records, document metadata, recipient names and email addresses, field values, and the audit trail.
Location
The cloud region configured for the deployment.
Transfer safeguard
Standard Contractual Clauses. Provider publishes a SOC 2 Type II report.
Provider
Cloudflare, Inc. (United States)
What it does for us
Object storage (R2) for uploaded and completed document files.
Personal data it may process
Document files only. Each is kept encrypted by us with AES-256-GCM, so the provider holds ciphertext rather than readable documents. The exception is a newly uploaded file, which waits unencrypted in a private holding area only until our server encrypts it and deletes the holding copy.
Location
The provider's storage regions, chosen automatically.
Transfer safeguard
Standard Contractual Clauses, plus encryption where we hold the key.
Provider
Vercel Blob (Vercel Inc., United States)
What it does for us
Object storage for files uploaded before we moved to Cloudflare R2. A nightly job is moving them across.
Personal data it may process
Document files only, each encrypted by us with AES-256-GCM before it was written.
Location
United States and the provider's storage regions.
Transfer safeguard
Standard Contractual Clauses, plus encryption where we hold the key.
Provider
Resend, Inc. (United States)
What it does for us
Transactional email delivery: signing invitations, reminders, completion notices, password resets and verification emails.
Personal data it may process
Recipient and sender names and email addresses, document titles, signing links, and email delivery metadata.
Location
United States.
Transfer safeguard
Standard Contractual Clauses. Provider publishes a SOC 2 Type II report.
Provider
Anthropic, PBC (United States)
What it does for us
The AI models behind the agent: answering questions, drafting and revising documents, placing fields, naming chats and the editor's assistant. Called only when someone in your workspace uses the agent or an automation runs.
Personal data it may process
What a request needs and nothing more: the conversation, and the parts of your workspace the agent reads to answer. That can include the pages of a document as they appear, with any signatures on a completed one, titles, recipients' names, email addresses and settings, contacts, templates and the workspace's house style. Never passwords, access codes, payment details or the encrypted files themselves.
Location
United States.
Transfer safeguard
Standard Contractual Clauses. Under its commercial terms Anthropic may not train its models on this content, and it keeps it only for a limited period, for safety and legal reasons, before deleting it.
Provider
Inngest, Inc. (United States)
What it does for us
Background job orchestration for reminders, expiry sweeps, automations and other scheduled work, where configured for the deployment.
Personal data it may process
Document and job identifiers, and event metadata. Not document contents.
Location
United States.
Transfer safeguard
Standard Contractual Clauses.
| Provider | What it does for us | Personal data it may process | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. (United States) | Application hosting, serverless compute, content delivery and scheduled jobs. Everything you do in the product passes through it. | All data in transit, request logs including IP address, the approximate place it resolves each request's address to, and anything held in memory during a request. | United States, with edge delivery from regions worldwide. | Standard Contractual Clauses. Provider publishes a SOC 2 Type II report. |
| Neon Inc. (United States) | Managed PostgreSQL database. | Account and profile data, workspace and membership records, document metadata, recipient names and email addresses, field values, and the audit trail. | The cloud region configured for the deployment. | Standard Contractual Clauses. Provider publishes a SOC 2 Type II report. |
| Cloudflare, Inc. (United States) | Object storage (R2) for uploaded and completed document files. | Document files only. Each is kept encrypted by us with AES-256-GCM, so the provider holds ciphertext rather than readable documents. The exception is a newly uploaded file, which waits unencrypted in a private holding area only until our server encrypts it and deletes the holding copy. | The provider's storage regions, chosen automatically. | Standard Contractual Clauses, plus encryption where we hold the key. |
| Vercel Blob (Vercel Inc., United States) | Object storage for files uploaded before we moved to Cloudflare R2. A nightly job is moving them across. | Document files only, each encrypted by us with AES-256-GCM before it was written. | United States and the provider's storage regions. | Standard Contractual Clauses, plus encryption where we hold the key. |
| Resend, Inc. (United States) | Transactional email delivery: signing invitations, reminders, completion notices, password resets and verification emails. | Recipient and sender names and email addresses, document titles, signing links, and email delivery metadata. | United States. | Standard Contractual Clauses. Provider publishes a SOC 2 Type II report. |
| Anthropic, PBC (United States) | The AI models behind the agent: answering questions, drafting and revising documents, placing fields, naming chats and the editor's assistant. Called only when someone in your workspace uses the agent or an automation runs. | What a request needs and nothing more: the conversation, and the parts of your workspace the agent reads to answer. That can include the pages of a document as they appear, with any signatures on a completed one, titles, recipients' names, email addresses and settings, contacts, templates and the workspace's house style. Never passwords, access codes, payment details or the encrypted files themselves. | United States. | Standard Contractual Clauses. Under its commercial terms Anthropic may not train its models on this content, and it keeps it only for a limited period, for safety and legal reasons, before deleting it. |
| Inngest, Inc. (United States) | Background job orchestration for reminders, expiry sweeps, automations and other scheduled work, where configured for the deployment. | Document and job identifiers, and event metadata. Not document contents. | United States. | Standard Contractual Clauses. |
2.Used only if you turn them on
These are not used unless you choose a feature that requires them, so most accounts never touch them.
Provider
Google LLC, GitHub, Inc., Microsoft Corporation
When it is used
Only if you sign in with Google, GitHub or Microsoft single sign-on.
Data involved
The account identifier, email address and display name that the provider returns to us when you authorise sign-in. We send them nothing about your documents.
Provider
Polar (polar.sh), or the payment provider named at checkout
When it is used
Only on a paid plan, once checkout opens. Until then nothing is charged and no payment data is collected.
Data involved
Billing contact details and payment credentials, which go to the provider directly and are never stored on our systems. The provider is named at checkout, on your invoice and in the refund and cancellation policy.
Provider
Endpoints you configure
When it is used
Only if your workspace adds a webhook or uses an API key.
Data involved
The signing events you subscribe to, with document identifiers, titles and the names and email addresses involved, sent to the URL you choose. These are your own systems or your chosen vendors, not ours, so they are not our subprocessors, and what happens there is your responsibility.
| Provider | When it is used | Data involved |
|---|---|---|
| Google LLC, GitHub, Inc., Microsoft Corporation | Only if you sign in with Google, GitHub or Microsoft single sign-on. | The account identifier, email address and display name that the provider returns to us when you authorise sign-in. We send them nothing about your documents. |
| Polar (polar.sh), or the payment provider named at checkout | Only on a paid plan, once checkout opens. Until then nothing is charged and no payment data is collected. | Billing contact details and payment credentials, which go to the provider directly and are never stored on our systems. The provider is named at checkout, on your invoice and in the refund and cancellation policy. |
| Endpoints you configure | Only if your workspace adds a webhook or uses an API key. | The signing events you subscribe to, with document identifiers, titles and the names and email addresses involved, sent to the URL you choose. These are your own systems or your chosen vendors, not ours, so they are not our subprocessors, and what happens there is your responsibility. |
3.Where an approximate place comes from
To show an approximate place beside a network address on evidence, such as "signed in Pune, India", and in the email we send when an account signs in from somewhere new, we use the place our hosting provider, Vercel, reports with each request it delivers to us. Vercel already handles every request, so no other service receives an IP address to look up. A place is recorded only with the request it came with: an address recorded without one is shown on its own, and is never sent anywhere later to be placed. The IP address itself remains the evidence; the place is only a label.
4.Our own people
Genflix Commerce Private Limited personnel in India may access personal data where necessary to operate the service, respond to a support request or investigate an incident. Access is limited to those who need it, is subject to confidentiality obligations that survive the end of their engagement, and is not a substitute for the customer's own controls.
5.How we change this list
Our data processing addendum gives us a general authorisation to appoint subprocessors, subject to the following, which is the protection that makes a general authorisation acceptable:
- We give at least 30 days' notice before a new subprocessor starts processing personal data, by email to workspace owners and by updating this page.
- You may object on reasonable data protection grounds within those 30 days by writing to privacy@suresign.si.
- If we cannot resolve your objection, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees for the unused period, and you will not be charged a termination fee.
- We impose data protection obligations on every subprocessor that are no less protective than those in our own addendum, and we remain fully liable to you for their performance.
To receive notice of changes, email privacy@suresign.si with the subject "subprocessor notifications" and we will add you to the list.
6.International transfers
We operate from India and our providers are established in the United States, so personal data crosses borders. For data originating in the EEA we rely on the Standard Contractual Clauses in Commission Decision (EU) 2021/914, for the UK on the International Data Transfer Addendum, and for Switzerland on the SCCs as amended for Swiss law. Section 16 of the DPDP Act permits transfer out of India except to countries the Central Government restricts by notification.
Because document files are encrypted with a key we hold, storage providers hold ciphertext rather than readable content, apart from the moment a newly uploaded file waits to be encrypted. That is a supplementary measure for the purposes of a transfer impact assessment, and it is described in clause 1 of the security page.
This document describes how Suresign works and what we and you have agreed. It is written to track the law it cites, but it is not legal advice and it is not a substitute for advice about your own situation. Statutes change. If you are relying on this for something that matters, have your own counsel review it, and any document you send, before you rely on it.