Legal
Sub-processor List
The third parties that process personal data on behalf of CecurSign customers, and how we tell you when the list changes.
Version 1.1Last updated 21 August 2026
This is the maintained list of sub-processors engaged by Cecur Limited to process personal data on behalf of customers of CecurSign, referred to by Annex 1 of the CecurSign Data Processing Agreement.
How we notify changes
We will update this page and email the account owner of each customer at least 14 days before adding or replacing a sub-processor. Objection rights are set out in clause 6 of the Data Processing Agreement.
Internal services (not sub-processors)
The following are operated by Cecur Limited itself and are not third parties: the Cecur Home portal (identity and billing), the Cecur notification service (message dispatch), DocVault (document storage) and the PDF rendering worker.
Sub-processors
| Sub-processor | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Auth0 (Okta, Inc.) | Identity and authentication for customers' authorised users | Names, email addresses, credentials, authentication events | ||
| Resend (Resend, Inc.) | Transactional email delivery (signing invitations, reminders, completion notices) | Recipient names and email addresses; email content including document names and signing links | United States | |
| OVHcloud | Managed PostgreSQL database hosting | All personal data held in the CecurSign database | European Union | Not applicable; the data stays in the EU |
| Cloudflare, Inc. | Content delivery of the PDF viewer library used to display documents for signing | Signer's IP address, browser user agent and referring page. No document content and no form data are sent | United States | EU-US Data Privacy Framework (Cloudflare is certified); standard contractual clauses in the alternative |
| Our hosting provider | Hosting of application servers and document object storage | All personal data including document files | European Union | Not applicable; the data stays in the EU |
One detail is outstanding: we have not yet named the company that hosts our application servers and document storage. Its location is stated above, and the name will be added here, and in the privacy notice and Annex 1 of the DPA, as soon as it is confirmed. Every other sub-processor on this page is named.
Conditional sub-processors
| Sub-processor | Purpose | Engaged when |
|---|---|---|
| Twilio Inc. | SMS delivery for signer verification | Only if SMS verification is enabled; currently disabled platform-wide |
Listed for transparency, not sub-processors
- Stripe Payments Europe, Ltd / Stripe, Inc.: payment processing via the Cecur Home portal, where Cecur acts as controller for billing.
- Timestamp authorities (Sigstore, DigiCert, GitHub): receive only a cryptographic hash; no personal data, document content or names are sent to them.
The rest of our legal documents
- Privacy NoticeWhat CecurSign records about account holders, signers and visitors, why, who it is shared with, and how to exercise your rights.
- Terms of ServiceThe terms that govern business use of CecurSign, including what the signatures are, what we warrant, and what we do not.
- Data Processing AgreementThe Article 28 processing terms between Cecur Limited and customers of CecurSign, with the sub-processor list and the security measures actually in place.
- Cookie NoticeEvery cookie CecurSign sets is strictly necessary to sign in and stay signed in. There is no analytics, advertising or tracking cookie anywhere on the site.