Subprocessors

Version 1.0, approved 2026-09-21. This list is compared by an automated test against the providers the code actually contains; a provider added to the code without being added here fails the build. The hosting rows describe the production deployment.

How to read this list

• Always — used by eScryber to run the service for every organisation.
• When configured — one of several interchangeable providers; a deployment uses exactly one, named in its environment.
• Opt-in — used only when an organisation connects it from its own settings, and only for that organisation's data.

Infrastructure

Provider	Role	What it holds	Region	Basis
Contabo (Contabo Inc.)	Runs the application, Postgres and the object store on one virtual server	Everything in the engineering data map (an internal inventory, available on request)	United States — Contabo US-East, New York	Always
Object storage: MinIO, on the same server	Stores document files, signatures, attachments, exports	File bytes	Same as hosting	Always
Backblaze (Backblaze, Inc.) — B2 object storage	Holds the nightly backup bundle, away from the host	Everything above, encrypted before upload with a key Backblaze never holds	United States — Backblaze US-East	Always

The database, queue and object store are part of the deployment rather than separate services: the code talks to Postgres and to an S3-compatible endpoint, both of which the operator provides. If either is moved to a managed service, that service is added here before the move.

Service providers

Provider	Role	What it receives	Basis
Stripe (Stripe, Inc.)	Subscription billing, payment methods, invoices, tax calculation	Organisation name, billing email and address, plan and subscription state, tax details. Card details are entered on Stripe's pages and never reach eScryber	Always, for paid plans
Transactional email — Mailgun (Mailgun Technologies, Inc.) in production. The code also supports Resend and Postmark; a deployment uses exactly one, named by EMAIL_DRIVER	Sending signing requests, reminders, completion notices, sign-in links and alerts	Recipient email address and name, sender's name and organisation, document title, the signing link, and the email body. Delivery, bounce and complaint events come back	When configured
Ollama (ollama.com cloud API)	Mobile-layout placement for the responsive signing view, only when REFLOW_PROVIDER=ollama-cloud	Paragraph bounding boxes and eight-word anchor phrases from the document, so that fields can be placed. The document body is never sent; this is enforced in code, not by policy. Off by default	When configured

Integrations an organisation connects (opt-in)

Provider	Role	What it receives	Basis
Microsoft (OneDrive / SharePoint via Microsoft Graph)	Auto-archiving completed documents into the organisation's own storage	The completed PDF and certificate, and the file name the organisation's path template produces (which may include recipient name or email). Sent only to the folder the organisation picked	Opt-in per organisation
DocuSign	Importing the organisation's own completed envelopes and templates into eScryber	eScryber reads from DocuSign: envelope PDFs, certificates, recipients, template definitions. Nothing is written to DocuSign	Opt-in per organisation
Webhook endpoints the organisation configures	Event notifications to the organisation's own systems	Event type and document metadata, signed with the organisation's shared secret. Where they go is the organisation's choice	Opt-in per organisation

Not subprocessors

• MaxMind GeoLite/GeoIP — a database file on the server, read locally when configured. No lookup is sent anywhere.
• Ghostscript, pdf-lib, pdfjs — libraries running on the server.
• Mailpit / console mail driver — development-only mail sinks that deliver nowhere.

Cross-border transfers

eScryber sells to United States organisations (decision D13) and hosts and backs up in the United States, as the rows above say. Stripe, Mailgun and Microsoft may process data in other countries under their own published terms. eScryber does not at this time offer standard contractual clauses or any other transfer mechanism for data that non-US data-protection law applies to (decision D25); the data processing addendum says what that means for an organisation that needs one.

Changes

A new subprocessor is added to this page, with a new version and date, before it receives any customer data, and organisation owners are emailed 30 days in advance. Removing one is recorded the same way.