These are the vendors Signater engages to operate the Platform — what each one does, what personal data is involved, and where processing takes place.
Last updated on October 11, 2026
This page lists the subprocessors and other vendors engaged by Signater — Signater LLC and Signater Tecnologia Ltda ("Signater", "we", "us") — that may process personal data in the operation of the Signater platform (the "Platform"). It supplements the Privacy Policy and is incorporated by reference into the Data Processing Agreement (DPA).
Capitalized terms not defined on this page — such as Customer, User, Signer, Envelope and Document — have the meanings given in the Terms of Service.
1.1. To operate the Platform, Signater engages specialized vendors — from cloud infrastructure to messaging and identity verification. Where Signater processes personal data on behalf of the Customer — in particular Signer data and the content of Documents — the vendors that process such data on Signater's behalf are its subprocessors within the meaning of Brazil's Lei nº 13.709/2018 (LGPD) and, where applicable, Regulation (EU) 2016/679 (GDPR).
1.2. For transparency, the table in Section 4 brings together in one place both subprocessors and vendors that process personal data for which Signater itself is the controller — for example, Customer billing data, product analytics and customer support. For the latter, Signater acts as a controller rather than as the Customer's processor. The role of each party is described in the Privacy Policy.
1.3. Several vendors only process data when the corresponding feature is actually used. For example: identity-verification providers only receive images when the sender of an Envelope requires that step; artificial-intelligence providers only receive content when an AI feature is triggered; identity validation through PIX (a Brazilian instant-payment method) only occurs when that authentication method is used; webhook delivery only occurs when the Customer configures webhooks through the API; and coordinates are only converted into an address when the Signer shares their device location.
2.1. Signater engages its vendors under written agreements that include confidentiality, information-security and data-protection obligations. Subprocessors that process data under the Customer's control are bound by data-protection obligations substantially equivalent to those Signater undertakes towards the Customer in the DPA.
2.2. Vendors are authorized to process personal data only to the extent necessary to provide the services Signater has engaged them for, and not for their own purposes, except as described in the Privacy Policy and the Cookie Policy — for example, advertising campaign measurement. Signater does not sell personal data and does not use Signers' data for advertising.
2.3. Signater remains responsible to the Customer, within the limits set out in the Terms of Service and the DPA, for the processing carried out by the subprocessors it engages.
2.4. The retention periods applicable to data processed on the Platform, including through these vendors, are described in the Data Retention Policy.
3.1. Some of the vendors listed process data outside Brazil, in particular in the United States and the European Union. These international transfers are carried out with the safeguards provided for in article 33 of the LGPD, in particular through contractual clauses ensuring an adequate level of data protection.
3.2. Where the GDPR applies, transfers of personal data originating from the European Economic Area or the United Kingdom to countries without an adequacy decision are covered by Standard Contractual Clauses or another recognized transfer mechanism.
4.1. The table below shows each vendor, the function it performs, the personal data involved and where processing takes place. The locations shown reflect the vendor's headquarters or the main known processing region; many vendors operate globally distributed infrastructure.
| Vendor | Function | Data involved | Processing location |
|---|---|---|---|
| Cloudflare | Content delivery network (CDN), page hosting, file storage, attack protection, bot verification (captcha) and DNS | Files stored on the Platform (Documents, signed versions, signature and identity-verification images, signature certificates); network traffic and IP addresses | United States / global network |
| Hetzner | Hosting of the Platform's application and database; storage of backup copies in a geographically separate region | Data processed on the Platform, to the extent necessary for hosting; backup copies of Documents, of the database, and of Platform services | United States (Ashburn, Virginia) — hosting; Germany (Falkenstein) — backups |
| Stripe | Payment processing, subscription billing and invoicing | Name, email, account identifiers and language preference; full payment details (such as card numbers) are collected directly by Stripe, in Stripe's own environment, and do not pass through Signater's systems | United States and Brazil |
| Pagar.me | Signer identity validation through PIX instant payment, when required by the sender of the Envelope | Signer name, email, Brazilian taxpayer number (CPF/CNPJ) and phone number | Brazil |
| Focus NFe | Issuance of Brazilian service invoices (NFS-e) for Customers billed in Brazil | Customer tax data: taxpayer number (CPF/CNPJ), legal name, email and address | Brazil |
| Amazon Web Services | Liveness detection and face comparison in Signer identity verification, when required by the sender; delivery of Platform e-mails as the primary provider (signing invitations, notifications, and newsletters) | Selfie video and images, liveness audit frames, and the identity-document image used for comparison; recipient names and e-mail addresses, e-mail content, and attachments, including signed Documents when attached | United States |
| Microsoft Azure | Text extraction and image reading from Documents for AI and search features; the Platform's internal messaging | Images of Document pages, when AI features are used; data in transit through internal messaging (names, emails, phone numbers and notification content) | United States / global |
| Sign-in with Google; advertising campaign measurement; computer-vision models used in automated identity-document verification | For sign-in: Google profile identifier, name, email and picture. For measurement: email in irreversible (hashed) form and campaign identifiers. For verification: images of the Signer's identity document | United States | |
| OpenAI | Generation of vector representations (embeddings) and language models for AI features | Text excerpts from Documents and messages sent to the AI chat | United States |
| OpenRouter | Routing of requests to AI model providers | Content of AI requests: text excerpts from Documents, chat questions and identity-document images | United States |
| Brevo | Delivery of Platform emails as the secondary provider, when the primary one does not accept a message (signing invitations, notifications and communications) | Recipient name and email, email content and attachments, including signed Documents when attached | European Union |
| Twilio | SMS delivery (authentication codes and signing invitations) | Phone number and message content | United States |
| ClickSend | SMS delivery (authentication codes and signing invitations) | Phone number and message content | Australia |
| Meta Platforms | WhatsApp message delivery; advertising campaign measurement | For WhatsApp: phone number and message variables (names, Envelope name, authentication codes). For measurement: email in irreversible (hashed) form, IP address and browser data | United States |
| PostHog | Product analytics | Usage events, User identifiers, device and browsing data; session recording, as described in the Cookie Policy | United States |
| Microsoft Clarity | Usage analytics (heatmaps and session replay) | Browsing interactions and device data | United States |
| Sentry | Error monitoring for the website and the Platform | Technical error data, device and browser data, and IP address | United States |
| Grafana Labs | Technical logs, metrics and performance tracing for the Platform | Application logs, which may contain internal identifiers of accounts, Envelopes and Signers | United States |
| Atlassian (Opsgenie) | Operational alerts for Signater's team | Technical alert messages, which may contain internal identifiers | United States |
| Better Stack (Better Uptime) | System availability monitoring and the public status page at status.signater.com | Operational availability and incident data; receives no personal data of Platform users | United States / European Union |
| Hookdeck | Delivery of API webhooks to the Customer's systems | Envelope and Signer events (identifiers and statuses) in transit to the endpoints configured by the Customer | Canada |
| Geoapify | Conversion of geographic coordinates into an approximate address, when the Signer shares their device location | Latitude and longitude reported by the device | European Union |
| Gleap | Customer support and support chat | Contact details, messages exchanged with support, and device data | European Union |
4.2. On the website, analytics and campaign-measurement vendors operate according to your cookie preferences, as set out in the Cookie Policy. Those preferences do not apply to the application (Cookie Policy, section 6) or to the conversion events that Signater's servers send to Google and Meta.
5.1. Signater may, at any time, engage new vendors, or replace or discontinue the vendors listed. This page will be updated to reflect such changes, and the current version will always be available at signater.com/subprocessors.
5.2. Material changes affecting the processing of personal data under the Customer's control — such as adding a new subprocessor with access to Document content or Signer data — will be communicated to Customers with reasonable advance notice, by email or through a notice on the Platform. Continued use of the Platform after such communication constitutes acceptance of the change.
5.3. The conditions governing the engagement of subprocessors — including the general authorization granted by the Customer — are set out in the DPA.
6.1. Questions about this page, the vendors listed or international transfers may be directed to Signater's Data Protection Officer (Encarregado) at [email protected].