Subprocessors
The other companies that handle personal data on Signitri’s behalf, what each one does with it, and where it sits.
Working draft, and the list below is incomplete.
This inventory identifies services in the current implementation. It is not a contract-verified subprocessor register. Legal entity names, agreements, processing locations, retention and transfer arrangements still need confirmation before launch. Please do not treat implementation names as confirmation that the required agreements are in place. Contact hello@signitri.com.
A subprocessor is a company Signitri uses to help run the service, which as a result handles personal data belonging to you or to the people you ask to sign. The intended contractual arrangements are described in the draft data processing addendum.
Services identified in the implementation
| Subprocessor | What it does | Data it receives | Location |
|---|---|---|---|
| Google Cloud / Firebase | Application hosting, authentication, database, object storage and operational logs. | Accounts, documents, recipients, verification outcomes, consent/audit records and diagnostic metadata. | Application deployment: us-central1. Storage, backup and provider-wide processing locations require confirmation. |
| RiskPilot — DocScan | Government ID extraction and integrity checks. | ID front/back images, extracted identity fields and request reference. The service also stores image and audit evidence. | Provider processing, storage locations and retention require confirmation. |
| RiskPilot — LivePulse | Liveness and reference/challenge comparison. | Facial reference/challenge images, session identifiers, consent and verification results. | Provider processing, storage locations and retention require confirmation. |
| ThisIsMe | Face comparison between an ID photograph and a selfie. | ID photograph, selfie, request reference and face-match result. | Provider processing, storage locations and retention require confirmation. |
| Stripe | Payments and subscription management. | Billing/customer details, payment information, subscription and transaction records. | Contracting entity and processing locations require confirmation. |
| Resend | Transactional email delivery. | Names, email addresses, document titles, message content and delivery links. | Contracting entity, processing locations and retention require confirmation. |
| Anthropic | Configured AI document analysis; also used by RiskPilot services. | Document content or images submitted for analysis. Exact downstream provider arrangements require confirmation. | Processing locations, retention and contractual data-use terms require confirmation. |
| DigiCert timestamp service | Default RFC 3161 timestamp destination; an operator may configure a different authority. | Timestamp requests containing a message imprint, plus network metadata; no full document is sent by this route. | Actual deployed authority and contracting/processing arrangements require confirmation. |
RiskPilot and ThisIsMe perform different parts of identity verification. An objection to a provider requires discussion with the sender; this implementation does not offer an automatic alternative verification provider.
[TO BE CONFIRMED: each provider’s legal entity name, its registered country, the processing location, and the transfer mechanism between Signitri and each provider.]
Still to be confirmed
These entries need a configuration inventory and contract review before a provider can be named or ruled out.
| Role | What it does | Provider and location |
|---|---|---|
| WhatsApp delivery | Confirm whether this is a sender-opened share link or a contracted messaging API | Not established from the reviewed integration |
| Product analytics and support | Confirm any services configured outside this repository | Not established from the reviewed integration |
| Provider subprocessors | Confirm RiskPilot and other providers’ downstream AI, storage and logging services | Agreements and current provider registers required |
How you hear about a change
[TO BE CONFIRMED: the notification channel for a new or replaced subprocessor — a mailing list, an in-product notice, or a dated changelog on this page; the notice period before the change takes effect; and the window in which a customer may object.]
Objecting to a subprocessor
[TO BE CONFIRMED: what happens when a customer objects — whether Signitri must offer an alternative, whether the customer may terminate without penalty, and how that is reconciled with subprocessors the service cannot run without.]
Not subprocessors
The people you ask to sign are not subprocessors, and neither are the recipients of a completed document. They are data subjects, and where a sender forwards an evidence pack onward, that is the sender’s disclosure rather than Signitri’s.