Data Processing Agreement (DPA)
Effective Date: November 2, 2026
1. Scope and Roles of the Parties
This Data Processing Agreement (“DPA”) supplements the SignExact Terms of Service and applies to the processing of personal data in connection with the electronic signature platform.
Customer as Data Controller
Customer acts as the Data Controller (or “Business” under CCPA/CPRA) for all document content, signer recipient lists, and contracts uploaded to the platform.
SignExact as Data Processor
SignExact acts as the Data Processor (or “Service Provider” under CCPA/CPRA), processing personal data solely to execute documents, maintain the audit ledger, and provide the service.
2. Customer Instructions
SignExact shall process personal data only in accordance with documented instructions from the Customer, including with respect to transfers of personal data outside the European Economic Area, unless required to do so by applicable law.
3. Technical & Organizational Security Measures
SignExact implements state-of-the-art security measures pursuant to Article 32 of the GDPR, including:
- TLS 1.3 cryptographic protocols for data in transit.
- Filesystem encryption at rest with strict multi-tenant authorization boundaries.
- Cryptographic SHA-256 hash chaining to ensure tamper-evident audit records.
- Ephemeral 256-bit guest signing tokens stored in hashed format.
4. Subprocessor Authorization
Customer grants general written authorization to SignExact to engage subprocessors to support platform infrastructure. The official list of authorized subprocessors is publicly maintained at SignExact Subprocessors.
5. Data Subject Rights & Deletion
SignExact shall provide reasonable assistance to Customer to fulfill requests by data subjects exercising their rights (access, rectification, erasure, or portability). Upon document deletion by the customer, SignExact permanently unlinks and deletes all associated PDF files and audit records.