Sub-processors

Third parties that may process customer data on our behalf. We keep this list public, current, and short. Any addition is announced via email to customers in advance.

Sub-processorPurposeRegionData accessed
VM hosting provider (single US-region instance) Production compute and storage United States Encrypted-at-rest application data
Cloudflare (tunnel) Public TLS termination and ingress Global anycast TLS-encrypted request metadata in transit
Gmail SMTP (via Himalaya) Transactional email delivery (invitations, completion notices) Google global Recipient name + email, envelope subject, signed PDF attachment
Twilio Verify (optional, per-envelope) SMS one-time codes for assurance level "advanced_sms" United States Recipient phone number, OTP delivery metadata
freeTSA.org (RFC 3161 timestamping) Timestamping signed PDFs for eIDAS Advanced European Union SHA-256 hash of the signed PDF (no content)
Customer-controlled storage destinations (Dropbox, Google Drive, OneDrive, S3-compatible). These are NOT our sub-processors. They are the customer's own storage. ZingZee Sign delivers the signed PDF to whatever destination the customer authenticated to.

To request a DPA covering these sub-processors or to receive notifications of changes, email [email protected].

Last updated: 2026-06-17.