Sub-processors
sign.yt (VARSOFIA) engages the third parties below to process personal data on behalf of our customers. We notify customers at least 30 days before adding or replacing a sub-processor, as described in the DPA. Providers marked “when enabled” receive data only if the feature is switched on.
Hetzner Online GmbH — hosting
Purpose: servers, database, encrypted file storage and backups. Data: all Service data (documents encrypted at rest). Location: Germany and Finland (EU).
Resend (Plus Five Five, Inc.) — email delivery
Purpose: transactional email (signing invitations, codes, notifications) for organizations using managed email. Data: recipient name and email address, message content. Location: United States / EU. Safeguards: Standard Contractual Clauses.
BulkGate (TOPefekt s.r.o.) — SMS
Purpose: SMS one-time codes for signer and login verification (when enabled). Data: phone number, message text. Location: Czech Republic (EU).
Cloudflare, Inc. — Turnstile anti-bot check
Purpose: blocking automated abuse on sign-in, registration and public signing forms. Data: IP address, technical browser signals. Location: United States / global network. Safeguards: Standard Contractual Clauses, EU-US Data Privacy Framework.
Payment provider — subscriptions
Purpose: processing subscription payments (when paid plans are active). Data: billing contact, payment details entered on the provider's checkout page. The provider's name and location are listed here before it is activated.
Functional Software, Inc. (Sentry) — error monitoring (when enabled)
Purpose: diagnosing application errors. Data: technical error reports, which may include an IP address, user ID or request metadata. PII sending is off; authentication headers, cookies, request bodies and tokens in URLs are removed before sending. Location: EU data region (Germany) / United States. Safeguards: Standard Contractual Clauses, data minimisation.
Anthropic PBC — optional AI features (when enabled)
Purpose: AI field detection and document analysis, only if the customer enables them. Data: document content submitted to the feature. Location: United States. Safeguards: Standard Contractual Clauses; inputs are not used to train models under Anthropic's commercial terms.
Authologic sp. z o.o. — identity verification (when enabled)
Purpose: optional identity verification of signers, only if the customer enables it. Data: signer identity data returned by the verification flow. Location: Poland (EU). Safeguards: Article 28 DPA; intra-EU.
login.gov.pl (Węzeł Krajowy / mObywatel) — national eID (when enabled)
Purpose: optional identity verification via the Polish national eID, operated by the Minister of Digital Affairs. Data: identity attributes returned by the national node after the signer authenticates. Location: Poland (EU). A public authority acting as an independent controller for authentication; intra-EU.
Didit Identity Spain, S.L. — identity verification (when enabled)
Purpose: optional identity verification of signers (ID document and selfie check), only if the customer enables it. Data: identity document data and the selfie check result returned by the verification flow. Location: Spain (EU). Safeguards: Article 28 DPA; intra-EU.
Integrations configured by the customer
If an organization connects its own SMTP server, Microsoft 365, Resend, AWS SES or Mailgun account, SSO provider or webhooks, data flows to that service under the customer's own agreement with it. These services are chosen by the customer and are not sign.yt sub-processors.
Public registries and timestamping (not sub-processors)
Company autofill queries public registries — GUS (REGON), the Ministry of Finance VAT whitelist and EU VIES — with a tax ID only. RFC 3161 timestamp authorities and OpenTimestamps calendars receive cryptographic hashes only, never document content or personal data. These are independent public services, not processors.
Changes and objections
Customers can object to a new sub-processor on reasonable grounds within the notice period described in the DPA by contacting support@sign.yt.