Subprocessor list

Last updated: April 15, 2024

Note: Capitalized terms used in this section are as defined or referenced in the Binding Corporate Rules (BCRs) and other applicable privacy terms in effect between Docusign and its customers. 

Docusign uses certain infrastructure subprocessors, platform subprocessors, and customer success subprocessors to provide services to its customers. It should be noted the applicability of these subprocessors is dependent upon one or more of the following: data center location, the services purchased, and optional service-specific features as further described below:

• Data Center Locations 

  • Example: Customer accounts provisioned in the EU will use all EU infrastructure subprocessors (for example, Azure and Equinix) 

• The services purchased 

  • Example: The SMS authentication feature, which is included in the Business Pro plan, requires the use of platform subprocessors

• Service-specific features 

  • Example: Customer use cases that utilize SMS authentication will necessitate the use of third-party platform subprocessors (TeleSign, Vonage, Prove) 

Trust Service Provider and Identity Verification Services:

• As defined under Regulation (EU) No 910/2014 (eIDAS), a Trust Services Provider is: “a natural or a legal person who provides one or more trust services either as a qualified or as a non-qualified trust service provider."

DocuSign France SAS operates as a Qualified Trust Service Provider for the EU, under the supervision of the French supervisory body ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information) and adheres to a strict set of standards and requirements that ensure the validity and security of the certificates, keys, and signatures that are the foundation of these services.

Docusign also engages additional subprocessors to provide identification and authentication mechanisms in order to support services offering Advanced Electronic Signature (AES) and Qualified Electronic Signature (QES). 

• In addition, DocuSign engages several additional subprocessors to provide identity verification for our services (such as Docusign Notary) and optional features (such as ID Verification).  

Identity verification enables a customer's ID documents to be authenticated digitally and in real-time, whether the user is in person or remotely. 

The Service Platform Subprocessors and Trust Service Provider sections describe a full list of our Trust Service Provider and Identity Verification subprocessors. 

Docusign Group Members

Where Docusign or a member of the Docusign Group, bound by the BCRs or other transfer safeguards, such as the EU Standard Contractual Clauses or other privacy framework, subcontracts any processing or obligations under a service agreement (with the authorization of the customer), we do so under a written agreement that ensures adequate data protection is provided as set out in the BCRs or other applicable transfer safeguard and Master Services Agreement between Docusign and its customer.  In addition, Docusign requires all subprocessors to implement appropriate safeguards (including applicable standard data protection clauses) and sufficient contractual guarantees to implement appropriate technical and organizational security measures in such a manner that processing will meet the legal requirements of Docusign’s BCRs or other transfer safeguard obligations.

Docusign Group Members that may offer account management and /or technical support for the applicable Docusign Services are also bound by Docusign’s Binding Corporate Rules.

Note: Even though not all Docusign products are sold in all geographic regions, an authorized employee from any Docusign Group Member in any region could access some limited Personal Information for support purposes. Docusign uses a ‘follow the sun’ model to provide customer and technical support and, therefore, it is possible that should a customer require technical support, depending on the time of day, such support may be provided by an authorized employee from any of the Docusign Group Member entities. Personal Information accessible by such employees does not include the contents of the actual eDocuments. Customer eDocuments are always encrypted as to Docusign and stored in the data center region of the account that sent the eDocuments through the Docusign Service. For more information, please see our Data management and privacy practices for Docusign eSignature and  Data Residency pages. 

Subscribe to updates to the Docusign subprocessor list

Docusign will make updates to the subprocessor lists via this website. Below are two options for subscribing to updates to the subprocessor lists at https://www.docusign.com/trust/alerts/feed:

• Add an RSS reader extension to your browser (Chrome, Firefox)

• Enable via Outlook on a PC

Objecting to a subprocessor

You may object to a subprocessor by emailing your objection to privacy@docusign.com with the subject line “Subprocessor Objection,” along with your name, your company’s name, the name of the Docusign Service, the name of the subprocessor, and grounds for objection (see the Processor Policy for objectively justifiable grounds) unless otherwise provided for in your service agreement with Docusign, which terms control.

List of Subprocessors

To access Docusign’s Subprocessor List, please click here.