GDPR and e-signature, HR and accounting tools: 38 checked

DPA on request.

Yes, on request. Billomat concludes an AVV (data processing agreement) with users on request; the template is downloadable and can be returned signed by email.

“Auf Wunsch schließen wir mit unseren Nutzern einen AVV ab.”

Source: billomat.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, aifinyo AG, Berlin)

“aifinyo AG Friedrichstraße 94, 10117 Berlin”

Source: billomat.com · Checked on 19 October 2026

Invoice documents are kept at most 6 months from creation during the contract and then deleted. After the contract ends a full export is possible for 6 months for a fee, then data is deleted.

“Billomat hält die elektronischen Unterlagen des Kunden während der Vertragslaufzeit jeweils längstens sechs Monate ab dem Datum ihrer Erstellung für die Datensicherung und Speicherung des Kunden bereit.”

Source: billomat.com · Checked on 19 October 2026

From €119 / mo.

From €119 per month, or from €99 per month with annual billing, excluding VAT. Includes 5 users; each extra user costs €10 per month.

“Enterprise Ideal für wachsende Unternehmen und Mittelstand ab 119€*/mo ab 99€*/mo”

Source: billomat.com · Checked on 19 October 2026

Says it doesn't train on your data.

No, according to Deel's AI page: conversations and organisation data are never shared with learning models. This is a marketing-page statement; the binding AI Terms of Service could not be read.

“Deel AI ensures that your conversations and organization data are never shared with any learning models”

Source: deel.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do, according to Deel's AI page: it says conversations and organisation data are never shared with learning models. No opt-out setting is described; binding AI Terms not read.

“Deel AI ensures that your conversations and organization data are never shared with any learning models”

Source: deel.com · Checked on 19 October 2026

Ireland (primary) with a disaster-recovery site in France, on AWS.

“We leverage a fully AWS-hosted infrastructure, with primary operations in Ireland and a disaster recovery site in France”

Source: deel.com · Checked on 19 October 2026

DPA in the terms.

Yes: Deel's legal hub lists a Data Processing Addendum and DPA FAQs among its privacy documents. The text of the DPA could not be read, so how it is concluded is not captured.

“Data Processing Addendum Deel Trust Center Privacy FAQ DPA FAQs”

Source: deel.com · Checked on 19 October 2026

On the list, under review.

Active (Deel, Inc.; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)

Source: dataprivacyframework.gov · Checked on 19 October 2026

SOC 1, SOC 2, SOC 3 and ISO 27001 (4 named); GDPR compliance and AES-256 encryption also listed.

“An ISO 27001 certification means Deel has put in place systems to manage risks related to the security of data”

Source: deel.com · Checked on 19 October 2026

United States and other locations worldwide; no specific region or hosting provider is named.

“we may store, process, and transmit data in the United States and locations around the world”

Source: sign.dropbox.com · Checked on 19 October 2026

DPA on request.

Yes. A Data Processing Agreement applies to Dropbox Sign when customer data is subject to EU data protection law; it is part of the Terms, with no separate signing.

“To the extent Customer Data is subject to EU Data Protection Laws and is processed by Dropbox on Customer's behalf, Customer and Dropbox agree to the Data Processing Agreement.”

Source: sign.dropbox.com · Checked on 19 October 2026

On the list.

Active (Dropbox, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Personal data is kept as long as needed for its purposes. Customers can delete their files in the account; at the end of the contract Dropbox deletes customer data in a commercially reasonable period after the customer asks. No fixed number of days is stated.

“Dropbox will delete Customer Data in Customer’s account in a commercially reasonable period of time following receipt of Customer’sr equest to do so prior to such termination.”

Source: assets.dropbox.com · Checked on 19 October 2026

4 named for Dropbox Sign: SOC 2, SOC 3, ISO/IEC 27001, ISO 27018. Dropbox-wide trust centre also lists ISO 27701, EU Cloud Code of Conduct and EU-US DPF.

“Dropbox Sign SOC 2 Dropbox Sign SOC 3”

Source: trust.dropbox.com · Checked on 19 October 2026

Germany. The homepage and pricing page state that all data is stored on servers in Germany. The privacy policy and terms name no hosting provider.

“Alle Daten werden sicher auf Servern in Deutschland gespeichert.”

Source: fastbill.com · Checked on 19 October 2026

EU hosting not documented.

Data is stated to be stored on servers in Germany by default (marketing pages only). No region setting or choice is described.

“Alle Daten werden sicher auf Servern in Deutschland gespeichert.”

Source: fastbill.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, FastBill GmbH, Frankfurt am Main)

“FastBill GmbH Brüsseler Str. 1-3 60327 Frankfurt am Main”

Source: fastbill.com · Checked on 19 October 2026

Invoice-relevant documents are kept up to 10 years under tax law (up to 30 years for enforceable claims). After contract end, customer content is deleted three months later, with export possible in that window.

“löscht der Anbieter vom Kunden eingepflegte Inhalte drei Monate nach Beendigung des Vertragsverhältnisses”

Source: fastbill.com · Checked on 19 October 2026

€30 / mo.

€30 per month, or €27 per month with annual billing, excluding VAT. Includes 3 users. Premium is quoted from €59 but is sold through a demo.

“Pro Zusätzliche Automatisierungen und eine reibungslose Zusammenarbeit im Team 30 € mtl. 27 € mtl.”

Source: fastbill.com · Checked on 19 October 2026

Trains on your data in part.

Yes, in part: the MSA lets HireVue keep and use usage data derived from the customer's use, which can include aggregated customer data, for internal research and development 'including training and product improvement'. The clause does not name AI models. No opt-out is stated.

“Hirevue may collect, use and retain data derived from Customer’s use of the Services (“Usage Data”) for purposes of its internal research and development, including training and product improvement.”

Source: legal.hirevue.com · Checked on 19 October 2026

DPA on request.

Yes. A DPA is published and forms part of the written agreement; HireVue is processor and standard contractual clauses are included.

“This Data Processing Addendum (“DPA”) forms part of and is supplemental to the written agreement (“Agreement”) between HireVue, Inc.”

Source: legal.hirevue.com · Checked on 19 October 2026

Published.

Yes, public at https://legal.hirevue.com/legal-center/subprocessors (version 5.0, 24 Aug 2026): 28 entries. AI-related: Anthropic (via AWS Bedrock), Amazon Bedrock, OpenAI (AI Interviewer), ElevenLabs (voice), Google Cloud (speech-to-text), Brainfish AI.

“OpenAI Embedding and large language model services used to support AI Interviewer functionality.”

Source: legal.hirevue.com · Checked on 19 October 2026

On the list.

Active (HireVue, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Customer data is stored for two years from first storage, after which HireVue may delete it; retention periods are customer-configurable. HireVue deletes all customer data promptly on written request. At contract end it deletes or returns personal data, except backups.

“Customer hereby directs Hirevue to store Customer Data and Materials during the applicable Subscription Term for two (2) years from the date of initial storage”

Source: legal.hirevue.com · Checked on 19 October 2026

4 named: ISO/IEC 27001:2022, ISO/IEC 27701:2019, SOC 2 Type 2 (annual), FedRAMP authorization.

“Hirevue is certified to ISO/IEC 27001:2022 for Information Security Management and ISO/IEC 27701:2019 for Privacy Information Management.”

Source: hirevue.com · Checked on 19 October 2026

Doesn't train on your data.

No. The security FAQ says Humata does not use user data to train its AI models. The terms give Humata a broad licence for "service provision, promotion, and other purposes" but do not mention training.

“We do not use any of the data provided by our users to train our AI models.”

Source: humata.ai · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: the security FAQ states Humata does not use user data to train its models. No opt-out setting is described.

“We do not use any of the data provided by our users to train our AI models.”

Source: humata.ai · Checked on 19 October 2026

Not listed.

No listing found for search term 'Humata', 'Tilda'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Document data used for the model is not retained beyond 30 days; dashboard data is kept until you ask otherwise, and clients can delete their data permanently at any time. Period after cancellation not stated.

“document data used for our model is not retained beyond 30 days.”

Source: humata.ai · Checked on 19 October 2026

SOC 2 Type II (1 certification named). The privacy policy states Humata is SOC 2 Type II compliant without limiting it to a plan; ISO 27001 is named only as a standard that informs the programme.

“Humata is SOC 2 Type II compliant, demonstrating our commitment to secure and reliable systems.”

Source: humata.ai · Checked on 20 October 2026

Switzerland, the EU or the EEA. Hosting and storage run on Google Cloud in Belgium (europe-west1); email, scheduling and error tools are in Germany. Some tools (analytics, messaging, interview transcription) are in the US.

“Unless otherwise agreed between the parties, the processing and use of the data by JOIN takes place in Switzerland, the European Union or in another treaty state of the Agreement on the European Economic Area.”

Source: join.com · Checked on 19 October 2026

No EU hosting.

No separate option described; EU/EEA/Swiss processing is the default under the DPA, but several US sub-processors (Amplitude, Customer.io, Segment, Recall.ai) process data in the US.

“Unless otherwise agreed between the parties, the processing and use of the data by JOIN takes place in Switzerland, the European Union or in another treaty state of the Agreement on the European Economic Area.”

Source: join.com · Checked on 19 October 2026

DPA in the terms.

Yes. A DPA (version 3.0) is part of the terms and takes priority over them; JOIN acts as processor for the company's candidate data. No signature step is described.

“The duties of the parties regarding data protection are further defined in the data processing agreement (DPA) accessible here https://join.com/dpa, which provisions prevails on these GTC.”

Source: join.com · Checked on 19 October 2026

Published.

Yes, published inside the DPA (Appendix 2): 12 entries (12 companies). AI-related: Recall.ai (interview recording and transcription). No LLM provider is named.

“Meeting-bot service used in the Interview Mode feature to record and transcribe interviews”

Source: join.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (Swiss-based vendor, JOIN Solutions AG, Pfäffikon SZ)

“These Services are operated by JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ”

Source: join.com · Checked on 19 October 2026

No fixed period: personal data is kept while the account exists, then deleted or anonymised. Company content is deleted with the account (requested by email). After the contract ends JOIN must delete the data and certify it. The customer sets candidate deletion deadlines.

“After the termination of the service agreement, JOIN is obliged to delete all personal data processed on behalf of the Company and certify to the Company that it has done so”

Source: join.com · Checked on 19 October 2026

ISO 27001:2022 (1 certification named).

“JOIN is certified according to ISO 27001:2022.”

Source: join.com · Checked on 19 October 2026

€17 / mo.

EUR 17 per job per month, billed annually (2 months free), excluding VAT. Unlimited users; up to 15 active jobs. Advanced is EUR 34 per job/month.

“One job ad, posted everywhere at once. €17per job/month billed annually2 months free”

Source: join.com · Checked on 19 October 2026

DPA in the terms.

Yes. A data processing agreement is attached to the general terms as Annex 1 and becomes part of the contract; Kenjo is processor. The Annex text itself is not published on the website.

“The Parties agree that the data processing agreement attached as Annex 1 shall become an integral part of the contract”

Source: kenjo.io · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Kenjo GmbH, Berlin)

“Controller pursuant to the GDPR is Kenjo GmbH”

Source: kenjo.io · Checked on 19 October 2026

After the contract ends the customer gets a 30-day transition period to export data; Kenjo then deletes all remaining data unless the law requires longer. Backups run every 6 hours and are kept 2 days.

“Kenjo shall not delete the Customer's data before the expiration of the Transition Period.”

Source: kenjo.io · Checked on 19 October 2026

Generally the EU/EEA and UK for customers using Moss there; transfers to other countries only under an adequacy decision or standard contractual clauses. The DPA lists Google Ireland (Cloud Platform, BigQuery); US-based Cloudinary, Intercom and Twilio are also listed.

“The processing of personal data generally takes place within the member states of the EU/EEA and UK when Moss Platform Services are used there.”

Source: getmoss.com · Checked on 19 October 2026

DPA on request.

Yes. A data processing agreement is concluded automatically when the Moss Platform agreement starts; the standard DPA v3.0 is published as a PDF.

“a data processing agreement is automatically concluded between the”

Source: getmoss.com · Checked on 19 October 2026

Published.

Yes. DPA Annex 4 lists 6 companies: Cloudinary, Gini (receipt OCR), Google Ireland (Cloud Platform, BigQuery), Intercom, Klippa (receipt OCR) and Twilio.

“Gini GmbH, Ridlerstraße 57, 80339 Munich, Germany (OCR of receipts)”

Source: getmoss.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Nufin GmbH, Berlin)

“Nufin GmbH Saarbrücker Str. 37A 10405 Berlin Germany”

Source: getmoss.com · Checked on 19 October 2026

Kept while needed for the service. German tax and commercial law require 2 to 10 years, and up to 30 years for legal claims. On termination the DPA requires deletion or return.

“Upon termination of the DPA, all data must be deleted or returned at the choice of the controller”

Source: getmoss.com · Checked on 19 October 2026

ISO/IEC 27001:2022 certified. The security page also states BaFin regulation and DORA compliance; ISO 27001 is the only security certification named.

“BaFin-regulated, ISO/IEC 27001:2022 certified platform, and advanced security features keep your financial operations protected, every step of the way.”

Source: getmoss.com · Checked on 19 October 2026

Trains on your data, with no documented way to stop it.

Yes, as a stated purpose. Intuit says it may train its AI and machine-learning models on information it collects, including content customers send through its platform. Data processed on a customer's behalf is outside this statement; QuickBooks terms were not readable.

“by training our artificial intelligence models and other machine learning models”

Source: intuit.com · Checked on 19 October 2026

Not fixed. Intuit reserves the right to store and process personal information in the United States and any other country where Intuit or its providers operate facilities.

“Intuit reserves the right to store and process your personal information in the United States and in any other country where Intuit or its affiliates, subsidiaries, or service providers operate facilities”

Source: intuit.com · Checked on 19 October 2026

On the list.

Active (Intuit; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept as long as needed to provide the service and meet Intuit's retention requirements and legal duties; after a deletion request some records remain for legal, regulatory or fraud reasons.

“we retain your personal information as long as it is necessary to comply with our data retention requirements and provide you with services”

Source: intuit.com · Checked on 19 October 2026

Doesn't train on your data.

No. Remote says it does not use personal data to train large language models and contractually requires its AI suppliers not to; the statement covers personal data in its AI Services.

“We do not use Personal Data to train large language models, and we contractually require our suppliers not to use Personal Data to train their AI models.”

Source: remote.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do: Remote states it does not train on personal data and requires its AI suppliers not to. Many AI services are also optional.

“Many of our AI Services are also optional, and we identify which ones process personal data”

Source: remote.com · Checked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Addendum is incorporated into the Terms of Service as one of the 'Additional Terms'.

“the Data Processing Addendum, and Privacy Policy (together, Additional Terms), all of which are incorporated herein by reference”

Source: remote.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based contracting entity for customers outside the US: Remote Europe Holding B.V., Amsterdam). The US entities Remote Technology, Inc. and Remote Technology Services, Inc. also state DPF certification.

“if Your address is outside the United States, Remote Europe Holding B.V.”

Source: remote.com · Checked on 19 October 2026

No fixed period published: personal data is kept no longer than needed, with periods depending on national law. AI inputs, outputs and requests are logged, with the 'lowest data retention periods possible'; application logs are kept 30 days. No self-serve delete setting described.

“When you use our AI features, we log inputs, outputs and requests made to the AI Services.”

Source: remote.com · Checked on 19 October 2026

ISO 27001 and SOC 2 (2 named); GDPR compliance also stated.

“ISO27001 Certified & SOC 2 Compliant”

Source: remote.com · Checked on 19 October 2026

Says it doesn't train on your data.

No, according to Rippling's AI marketing FAQ: 'Your usage data will not be used to train AI models.' The binding AI Services Terms could not be read, so this is a vendor statement and it says 'usage data', not explicitly customer content.

“Your usage data will not be used to train AI models.”

Source: rippling.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do, according to Rippling's AI FAQ (usage data is not used to train AI models); admins can also disable AI features. Binding AI Services Terms not read.

“Your usage data will not be used to train AI models.”

Source: rippling.com · Checked on 19 October 2026

DPA in the terms.

Yes. Rippling publishes a Data Processing Addendum under the core terms that apply to all Rippling products and services; its clauses could not be read.

“Rippling’s Data Processing Addendum outlines how we collect and process users’ personal information on behalf of our customers in Rippling’s capacity as a data processor.”

Source: rippling.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Rippling'

Source: dataprivacyframework.gov · Checked on 19 October 2026

SOC 1 Type 2, SOC 2 Type 2, SOC 3, CSA STAR Level 2, ISO 27001, ISO 27018 and ISO 42001 (7 named).

“Rippling’s ISO 42001 certification demonstrates our commitment to secured and governed AI management.”

Source: rippling.com · Checked on 19 October 2026

Yes, per Rippling's AI FAQ: admins can enable or disable AI features, manage AI admin permissions and configure data permissions at platform level.

“Admins can enable or disable AI features, manage Rippling AI admin permissions, and configure data permissions at the platform level.”

Source: rippling.com · Checked on 19 October 2026

Germany: data is hosted only in Germany (AWS Germany branch); support access from third countries is possible

Source: cdn.prod.website-files.com · Checked on 18 October 2026

EU hosting available.

Yes, for all customers: hosting is in Germany

Source: cdn.prod.website-files.com · Checked on 18 October 2026

DPA in the terms.

Yes. sevdesk publishes its Auftragsverarbeitungsvertrag (Art. 28 GDPR) as a PDF on its privacy page

Source: cdn.prod.website-files.com · Checked on 18 October 2026

10 listed.

Public but dated 10 Apr 2024: 4 entries (AWS hosting in Germany, EMAILBRIEF postal invoices, Termitel phone support, Twilio SendGrid email); no AI provider is listed

Source: cdn.prod.website-files.com · Checked on 18 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, sevDesk GmbH, Offenburg)

Source: sevdesk.de · Checked on 18 October 2026

After the contract ends, personal data is kept for three months so the customer can export it, then deleted; immediate deletion on request

Source: cdn.prod.website-files.com · Checked on 18 October 2026

€25.90 / mo.

EUR 25.90 per month excl. VAT on a 24-month term (60% off for the first 12 months: EUR 10.36)

Source: sevdesk.de · Checked on 18 October 2026

Your choice of two data centres at setup: Switzerland (CH) or Germany (DE). The security page describes the Swiss hosting on two Tier IV sites; hosting providers are cloudscale.ch and VSHN (Swiss entity) and IONOS (German entity).

“Skribble operates two independent data centers (CH and DE). Upon initial setup, the Customer must select one data center for the use of the Skribble Services, including API access.”

Source: skribble.com · Checked on 19 October 2026

EU hosting available.

Yes: at initial setup the customer selects the German (DE) data centre instead of the Swiss (CH) one. The choice is fixed for the whole contract and cannot be changed or migrated later.

“The Customer Account is assigned to the selected data center and remains there for the entire duration of the Customer Contract.”

Source: skribble.com · Checked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Agreement under Swiss FADP and EU GDPR supplements the Customer Contract and applies to either contracting entity.

“With the Customer Contract, the Parties entered into a data processing relationship pursuant to the Swiss Federal Act on Data Protection”

Source: skribble.com · Checked on 19 October 2026

Published.

Yes, in Annex 2 of the DPA (https://www.skribble.com/en-eu/dpa/, version 31.10.2025): 13 sub-processors for the Swiss entity and 12 for the German entity. No AI or model provider listed (Featurebase offers a support chatbot).

“This Annex 2 to the Data Processing Agreement under FADP and EU-GDPR lists the Sub-Processors used by Skribble.”

Source: skribble.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (Swiss-based vendor, Skribble AG, Zurich)

“We, Skribble AG, Talacker 21, 8001 Zurich, Switzerland”

Source: skribble.com · Checked on 19 October 2026

Audit logs are kept 10 years. Team has no company-wide document deletion period (setting listed for Pro and Scale only). On termination Skribble deletes the account and its documents; for EU/EEA customers exportable data stays available 30 days, then is erased (GTC 15.1, 16.6). Legal-retention data excepted.

“Skribble retains audit logs for 10 years for evidence purposes.”

Source: skribble.com · Checked on 19 October 2026

ISO 27001 and ISO 9001 (2 certifications), plus GDPR and Swiss data protection compliance claimed.

“We have been certified according to ISO 9001 and 27001.”

Source: skribble.com · Checked on 19 October 2026

€23 / user / mo.

EUR 23 per user/month excluding VAT, billed yearly (EUR 276 per user per year); EUR 348 per year is shown as the monthly-billing figure.

“Enable your team with all e-signature standards (SES, AES, QES) for enhanced security. € 23 per user/month excl. VAT”

Source: skribble.com · Checked on 19 October 2026

Not fixed. Xero transfers data to Australia, New Zealand and the United States, citing the location of its teams and data hosting locations, and replicates data between data centres.

“Australia, New Zealand and the United States—due to the location of our teams and data hosting locations”

Source: xero.com · Checked on 19 October 2026

DPA in the terms.

Yes. Xero's terms incorporate data processing terms that apply to personal data processed on the customer's behalf.

“Our data processing terms apply to the personal data that we process on your behalf”

Source: xero.com · Checked on 19 October 2026

Published.

Yes. https://www.xero.com/legal/xero-subprocessors/ lists 21 third-party subprocessors and 11 Xero group entities (32 entries). AI providers: Anthropic and OpenAI (conversational AI); cloud hosts include AWS, Microsoft Azure and Google Cloud.

“Anthropic, Conversational artificial intelligence services, United States”

Source: xero.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Xero'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept while the customer relationship lasts and afterwards while there is a business or legal need, for example tax and accounting rules; then deleted or anonymised.

“We'll retain your personal data for as long as we've a relationship with you and for a period of time afterwards where we have an ongoing business or legal need to keep it.”

Source: xero.com · Checked on 19 October 2026

ISO/IEC 27001:2022 certified and SOC 2 reports from independent audits (two audited items). The page also states PCI DSS v4.0 SAQ A compliance, a merchant self-assessment.

“Xero is certified as compliant with ISO/IEC ISO27001:2022”

Source: xero.com · Checked on 19 October 2026

Partly. Xero says JAX only runs when opened and that you can restrict particular people from using JAX chat by adjusting their Xero roles and permissions. No single organisation-wide AI switch is described.

“If you don’t want certain people in your organisation using JAX chat, you can adjust their Xero roles and permissions.”

Source: xero.com · Checked on 19 October 2026

France. The solutions are hosted only in France; signed documents and audit trails are archived at Arkhineo (France).

“Youtrust solutions are exclusively hosted in France. The evidence files we create for each electronic signature are legally archived at Arkhinéo”

Source: yousign.com · Checked on 19 October 2026

EU hosting available.

Yes, by default: hosting is only in France, so no setting is needed to keep data in the EU.

“Youtrust solutions are exclusively hosted in France.”

Source: yousign.com · Checked on 19 October 2026

DPA on request.

Yes. The Data Processing Agreement is an integral part of the Contract and takes effect when the Contract is signed; no separate signing step.

“This Agreement comes into effect from the date of signature of the Contract to which it is attached”

Source: yousign.com · Checked on 19 October 2026

Published.

Yes, public list at https://yousign.com/subprocessors, dated 2 July 2026: 38 entries. AI provider shown: Dust (AI assistants, hosted in Ireland); no OpenAI, Anthropic or Mistral.

“Solution that allows the creation of virtual assistants powered by AI”

Source: yousign.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Youtrust SAS, Caen, France)

“Youtrust SAS, Rue de Suède Avenue Pierre Berthelot, 14000 Caen, France.”

Source: yousign.com · Checked on 19 October 2026

Documents stay in the account for the subscription period; Youtrust can add size or period limits after one month notice; no deletion period after cancellation stated. Personal data erased when purposes end, subject to legal retention.

“is kept, within the authorised usage limit, in the Corporate Account and/or the User Account used to instigate the signature process during the Subscription period.”

Source: yousign.com · Checked on 19 October 2026

eIDAS trust-service certifications (e-signature, e-seal, time stamping); ISO/IEC 27001 named on the AI connector page; GDPR compliance claimed. 2 certifications.

“Youtrust is a trusted third party and has eIDAS certifications for electronic signature, electronic seal and time stamping.”

Source: yousign.com · Checked on 19 October 2026

€23 / user / mo.

EUR 23 per user/month, excluding VAT, on yearly billing (EUR 276 per user per year); the page also shows EUR 360 per year as the monthly-billing figure.

“Plus Advanced features with unlimited eSignatures. 23 € Excl. VAT per user/month 360 € 276 € per year”

Source: yousign.com · Checked on 19 October 2026