Subprocessors
Language: This text is available in German and English. The German version is legally binding. The English version is a translation for your convenience.
Last updated: 18.10.2026
We use these service providers to run signround. Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR).
| Provider | Purpose | Data | Location | Transfer safeguards |
|---|---|---|---|---|
| Supabase, Inc., USA | Database, login, file storage | Account, document, signer and audit data | EU region eu-central-1, Frankfurt, Germany | DPA with EU Standard Contractual Clauses |
| Plus Five Five, Inc. ("Resend"), San Francisco, USA | Sending emails: login, confirmation and password emails, signing emails and, with consent, the newsletter (Audiences, Broadcasts) | Names, email addresses, email content, attached PDFs; for the newsletter: subscriber list and consent proof | EU region eu-west-1, Ireland (company in the USA) | DPA, EU-US Data Privacy Framework, Standard Contractual Clauses |
| Netlify, Inc., USA (with Amazon Web Services) | Website hosting, delivery network and server functions (Netlify Functions on AWS Lambda) | IP address, request data; during upload, signing and completion also documents, signature images, names and email addresses (processed briefly, not stored) | Server functions: USA (us-east-2, Ohio); delivery network worldwide | DPA, EU-US Data Privacy Framework (Standard Contractual Clauses as fallback) |
| STRATO GmbH, Berlin, Germany | Email inbox for info@signround.com | Messages you send us (name, email address, content) | Germany | DPA; processing in the EU |
Each provider uses its own subprocessors, listed on its website.
Time stamps (no personal data): DigiCert, Inc., USA, receives only a fingerprint (hash) of the completed PDF to issue a time stamp (RFC 3161). It receives no names, email addresses or document content and is therefore not a processor.
Payments (paid plans only): Stripe Payments Europe, Ltd., Dublin, Ireland, processes billing and payment data. For card and fraud checks Stripe acts partly as its own controller (stripe.com/privacy). Transfers to Stripe, Inc., USA: EU-US Data Privacy Framework and Standard Contractual Clauses.
We will announce new subprocessors on this page at least 30 days in advance. Business customers can object under our Data Processing Agreement.