Data processing addendum
This addendum forms part of the Terms of service, or the master agreement, between the customer and eSora Labs. It applies when we process personal information on the customer's behalf. Enterprise customers can ask for a signed copy.
On this page · 8 sections
1. Roles
The customer is the controller (or business) and eSora Labs is the processor (or service provider) for customer personal information.
2. Our commitments
- Process customer personal information only on the customer's documented instructions, which include the terms and the customer's use of the Service.
- Make sure everyone with access is bound by confidentiality.
- Apply the security measures in Annex 2 (our Security page).
- Use sub-processors only under a written contract with equal protection; we keep a public list and give 30 days' notice of a new one, so the customer can object.
- Help the customer answer people's rights requests and carry out impact assessments.
- Tell the customer without undue delay, and within 48 hours, after we become aware of a personal data breach affecting their information.
- At the end of the service, delete or return customer personal information as the customer chooses.
- Make available the information needed to show compliance, including our security reports, and allow audits once a year with reasonable notice.
- Not process customer personal information for our own purposes, except aggregated, de-identified usage information to run and improve the Service.
2a. Deletion at the end of the service
When a workspace is closed, its content stays available to the customer for 1 year and is then deleted, except records under legal hold. Backups expire within 35 days after that. On request we confirm deletion in writing.
2b. Government requests
If an authority asks us for customer personal information, we follow our Government and law enforcement requests policy and tell the customer first unless the law forbids it.
3. International transfers
Where personal information moves out of the EU, UK, Switzerland or Canada, the EU Standard Contractual Clauses (Module 2 or 3), the UK Addendum and Swiss amendments are incorporated by reference.
4. US state laws
We will not sell or share customer personal information, retain, use or disclose it outside the direct business relationship, or combine it with other information except as the law allows.
Annex 1. Details of processing
| Item | Details |
|---|---|
| Subject matter | Providing electronic signature, document and PDF services |
| Duration | The term of the agreement, plus deletion periods |
| People | Customer members, signers, recipients and people named in documents |
| Types of information | Contact details, signatures, identity check results, device and network data, and anything in documents |
| Special categories | Only if the customer puts them in documents |
| Operations | Storage, transmission, display, sealing, verification, deletion |
| Retention | As set out in the Privacy notice, section 7, and the customer's retention rules |
Annex 2. Security measures
- Encryption in transit (TLS 1.2 or later) and at rest (AES-256); access tokens for cloud imports encrypted separately.
- Every document sealed with a digital signature and a hash-chained, append-only event log.
- Strict separation of workspaces, checked by automated tests on every route.
- Virus scanning of every uploaded file; uploads refused when the scanner is unavailable.
- Staff access by role with multi-factor authentication, logged.
- Nightly database backups kept 35 days, versioned object storage, and tested restores.
- Rate limits and lockouts on sign-in codes and signing links.