Data processing

This page describes how Armorstack, LLC ("Armorstack", "we", "us") processes personal information when it provides ArmorSign (the "Service"). It restates the Privacy Policy and the Terms of Service, both effective June 5, 2026. It is not a separately signed contract. The Terms, the Privacy Policy, and the Refund Policy remain the documents that govern the Service.

Armorstack publishes its data processing addendum at armorstack.ai/privacy-dpa. That page is the Armorstack-level DPA reference. This ArmorSign page does not replace it, and the link does not by itself make that addendum a signed ArmorSign contract.

pending review. A countersigned data-processing addendum, an order of precedence if that addendum conflicted with the Terms, and any term that is not already in the Privacy Policy or the Terms are not in effect. Text on this page that is not a restatement of those documents is marked pending review.

1. Who decides, and who processes

The Privacy Policy, Section 1, distinguishes two roles. For Customer account, billing, and Service usage data, Armorstack decides the purposes and means and acts as controller (a "business" under U.S. state law). For Customer Content and for Signer data processed to complete a signing transaction, Armorstack acts as processor / service provider on the Customer's behalf and on the Customer's instructions. The Customer is the controller of that data.

"Customer", "Customer Content", "Signer", and "Account" have the meanings in Section 2 of the Terms.

2. What is processed

The Privacy Policy, Section 2, describes the information the Service handles:

• Account and registration information: name, email, a one-way hash of the password, organization name, and subscription status and plan. Passwords are not stored in plain text.
• Customer Content: documents, fields, and values a Customer uploads or builds.
• Signer information: name, email, the applied signature, consent to electronic records and signatures, IP address, browser user-agent, and event timestamps, recorded in the audit trail.
• Payment information: Stripe collects card and billing details. Armorstack stores a Stripe customer identifier, a subscription identifier, and subscription status. Armorstack does not receive or store the full card number.
• Usage and log data, and essential first-party browser storage such as the authentication token. The Service does not use advertising cookies or third-party tracking cookies.

3. Instructions and purposes

Under Section 5 of the Terms, the Customer grants Armorstack a limited license to host, store, copy, process, transmit, and display Customer Content solely as necessary to provide, maintain, secure, and support the Service. The Privacy Policy, Section 3, states the purposes: provide the Service; create the Certificate of Completion and maintain the audit trail; process subscriptions and prevent fraud; secure, support, and improve the Service; communicate; and comply with law.

For individuals in the EEA or the UK, the legal bases in Section 4 of the Privacy Policy are performance of a contract, legitimate interests, consent, and legal obligation, mapped to those purposes.

4. Subprocessors

Section 5.1 of the Privacy Policy names the service providers engaged to deliver the Service. Each is described there as bound by contractual confidentiality and data-protection obligations and as permitted to use the information only to perform services for Armorstack:

• Stripe — payment processing and subscription billing.
• Mailgun — delivery of transactional email, including signing links and notifications.
• Cloudflare R2 — storage of completed signed records, accompanied by a SHA-256 hash and a Certificate of Completion.
• Fly.io — application hosting and managed database services.
• Vercel — hosting and delivery of the web front-end.

Section 5 of the Privacy Policy also describes sharing with the parties to a signing transaction, disclosures required by law, and transfers in a merger or sale of assets. It states that Armorstack does not sell personal information and does not share it for cross-context behavioral advertising.

pending review. A notice period, and a way for a Customer to object, before Armorstack adds or replaces a subprocessor are not in the Privacy Policy. No such period is in effect from this page.

5. Security

Section 8 of the Privacy Policy describes the safeguards in use:

• encryption of data in transit using industry-standard TLS;
• one-way hashing of account passwords;
• per-account data isolation;
• SHA-256 hashing to verify document integrity;
• append-only audit and consent ledgers;
• access controls, monitoring, and incident-detection processes.

The same section states that if Armorstack becomes aware of a security incident affecting personal information, it will investigate and provide notification to affected parties and authorities as and where required by applicable law, and that no method of transmission or storage is perfectly secure.

pending review. A customer audit right, and a specific clock for notifying the Customer of a security incident beyond the notice "as and where required by applicable law" in Privacy Policy Section 8, are not in effect.

6. Retention

Section 7 of the Privacy Policy states that completed signed records are kept with a SHA-256 hash and a Certificate of Completion, that the consent ledger and the audit log are append-only, and that the policy is to retain completed signed records for up to seven (7) years. After that period they are deleted or de-identified in the ordinary course. Other account and operational data is retained while the account is active and deleted within a reasonable period after account closure, except where retention is required to comply with law, resolve disputes, or enforce agreements.

pending review. A deletion certificate, and a return-of-data procedure beyond the deletion or de-identification described in Privacy Policy Section 7, are not in effect.

7. International transfers

Section 9 of the Privacy Policy states that Armorstack is based in the United States and that subprocessors store and process data in the United States. Access from outside the United States transfers personal information to the United States. For personal information of individuals in the EEA or the UK, that section states that Armorstack relies on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses and the UK Addendum / International Data Transfer Agreement, where applicable.

pending review. Attaching those clauses as an exhibit to this page is not done here. The reliance described in Privacy Policy Section 9 is unchanged.

8. Requests from people

Sections 10, 11, 12, and 15 of the Privacy Policy describe access, correction, deletion, and related rights, and how to submit them. Email [email protected]. Where Armorstack is a processor, the request is directed to the Customer who controls the data. The Policy states that Armorstack responds within the time the applicable law requires, generally within 45 days under U.S. state privacy laws (extendable where permitted) and within one month under the GDPR / UK GDPR (extendable by up to two further months for complex requests, with notice).

9. Contact

Armorstack, LLC, Waukesha, Wisconsin, USA. Email [email protected]. Questions about a document a Customer sent should also go to that Customer, who decides why the Signer's information was collected.