Back to Home
Compliance
Subprocessors
The core infrastructure providers used to operate the VollSign platform. Additional services a law firm chooses to connect itself (e.g. their own email or calendar account) are governed by that provider's own privacy terms and are not listed here.
Last updated: March 1, 2026
Change Notice
We notify customers of any additions or replacements to this list at least 30 days in advance via email. You may object to a new sub-processor within that window.
Infrastructure & Hosting
| Service | Purpose | Data Location | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting, database servers | Germany (Nuremberg / Falkenstein) | Signed |
| Cloudflare Inc. | CDN, DDoS protection, DNS | EU nodes (Frankfurt primary) | Signed |
Payments
| Service | Purpose | Data Location | DPA |
|---|---|---|---|
| Stripe Inc. | Payment processing | Ireland (EU) | Signed |
Communications (SMS & Email)
| Service | Purpose | Data Location | DPA |
|---|---|---|---|
| Twilio Inc. | SMS delivery (phone verification, notifications) | USA (SCCs applied) | Being confirmed |
Transactional email is sent via an SMTP provider that is configured per deployment environment. A fixed third-party name is not yet confirmed for this list; it will be updated once that is finalized.
Other Core Services (automatic, cannot be opted out of)
| Service | Purpose | Data Location | DPA |
|---|---|---|---|
| freetsa.org | Cryptographic timestamp at signing time (RFC 3161), receives only a hash value, not document content | unknown (public TSA service) | No DPA — public service, no contractual relationship |
| OpenStreetMap Foundation (Nominatim) | Address geocoding for law firm addresses | unknown (public service) | No DPA — public service, no contractual relationship |
Questions?
For questions about our subprocessors or data processing practices, contact our compliance team.
[email protected]