Data and regions
Where a document lives, who can reach it, how long it stays, and how you take it with you. The short version; every line links to the policy that binds us to it.
Regions
Every workspace has a data region: the European Union, in Frankfurt, or the United States, in Northern Virginia. A workspace created from an EU or EEA country, the United Kingdom or Switzerland starts in the EU; everyone else starts in the US. The region can be changed in workspace settings until the workspace holds its first document or template, and is fixed from then on. Documents, signatures, signed PDFs and exports stay in that region. The workspace’s region is shown in its settings.
Who can reach what
| A document | Members of the workspace, by role, and the people it was sent to. Nobody else, including us, except for support you ask for. |
|---|---|
| Files | Never public. Every download uses a link that expires within 15 minutes and is issued only to a party entitled to that file at that moment. The signed PDF linked from the completion email is the one exception: that link works for seven days, so a signer can come back to it. |
| Signing links | Unique to one recipient, rotated when a link is sent again, dead once the document is complete, voided, declined or expired. |
| In transit and at rest | TLS on every connection; every database and file store encrypted at rest. |
How long things are kept
| Documents | Until you delete them, or the workspace. A signer's records live with the document. |
|---|---|
| Deleted documents | Restorable for 30 days from the deleted list; then the rows are removed and the files purged. Deleting a sent document voids it first, so every live signing link stops cleanly. |
| A deleted workspace | Billing is cancelled, every row is removed and a purge of its files is queued. Personal data is gone within 30 days unless the law requires otherwise, as the data processing agreement says. |
| Billing records | As long as tax law requires. |
| Backups | Point-in-time recovery on the database; restore is tested. |
Filing signed PDFs in your own Dropbox
On Pro and Business, an owner or admin can connect a Dropbox from Settings, Filing. From then on, when the last person signs, the signed PDF with its certificate is filed in Apps, ShareSign in that Dropbox, named after the document and the day it was signed, such as
Lease (signed 2026-09-18).pdf. A second document with the same name is numbered; nothing is ever overwritten. A document that completed before you connected can be filed from its own page.
| What we can see | Only that one folder. ShareSign cannot read, list or change anything else in your Dropbox, and Dropbox says so on the screen where you allow it. |
|---|---|
| Your region | Filing copies the signed PDF out of ShareSign to your Dropbox, wherever Dropbox stores it. A workspace that keeps its documents in the EU is told this and asked before it connects. The copy in ShareSign stays in the region you chose. |
| If it stops working | If access is taken away at the Dropbox end, or the Dropbox is full, the owners are emailed once, the document's page says it was not filed, and File again sends it across once that is sorted out. Nothing is lost: the signed document is in ShareSign as before. |
| Disconnecting | Removes our access at both ends and leaves the files where they are. |
| Not filed | Test documents. |
Taking your data with you
From Settings, Data, an owner or admin can export the whole workspace as a machine-readable archive. It is built in the background; you are emailed when it is ready, and the link works for seven days. There is nothing to ask us for and no notice period.
The same page downloads the audit trail of every document between two days as one CSV file, for an accountant or an auditor who wants a spreadsheet rather than an archive. What is in it.
Signers who are not users
Someone who signs never creates an account. We process their name, email, the document, their signature, and the time, network address and device of their signing, solely to deliver, record and prove it, and we keep those with the document. The sender is responsible for the lawful basis for sharing their details with us. The privacy policy says this in full, and is linked from the consent every signer reads.
The paperwork
The data processing agreement can be signed from inside the app; the sub-processor list names every company that touches data and where; the security page lists what is true today and what is planned. The trust page puts them on one screen.
Last changed 19 September 2026. Something wrong here? Say so on the support page.