DocuSign: where do your PDFs go?
Sovereignty score
43/100
High exposureDocuSign is published by DocuSign, Inc. (United States). The vendor falls under the US CLOUD Act: US authorities can request your files, whatever the hosting country.
Score calculated for this tool alone, without document-type weighting.
Checkpoints
- CLOUD Act
- Exposed DocuSign, Inc. is a US company: its data remains legally reachable under the US CLOUD Act and FISA, even when stored in Europe.
- Jurisdiction
- Non-EU United States — US law — subject to the US CLOUD Act
- Servers
- Non-EU Primary US infrastructure; EU regions (Germany, Ireland) on dedicated options/accounts
- Retention
- Persistent Envelopes and audit trails kept indefinitely according to the customer account policy
- AI
- No DocuSign offers opt-out clauses for enterprise customers; some AI features analyse contract metadata.
Quick answers
Is DocuSign subject to the CLOUD Act?
Yes. DocuSign, Inc. is a US company: its data remains legally reachable under the US CLOUD Act and FISA, even when stored in Europe.
Where are files uploaded to DocuSign hosted?
Primary US infrastructure; EU regions (Germany, Ireland) on dedicated options/accounts.
How long does DocuSign keep your documents?
Envelopes and audit trails kept indefinitely according to the customer account policy.
Does DocuSign use your files to train AI?
DocuSign offers opt-out clauses for enterprise customers; some AI features analyse contract metadata.
Which certifications does DocuSign claim?
ISO/IEC 27001 · ISO/IEC 27017 · SOC 2 Type II · eIDAS (via DocuSign France SAS)
Our analysis
E-signature market leader, but a US parent company subject to the CLOUD Act with long-term storage of signed contracts.
Source: DocuSign Privacy Policy & Trust Center ·
Alternatives for “Signature”
Tools with the same use, ranked by sovereignty score.
What about all your tools?
Get the sovereignty score of every PDF tool your teams use in 2 minutes. Free, no email, 100% local.