Trust
Subprocessors
The outside services that process data on XOsign's behalf — what each one does, and exactly what data it can see.
XOsign runs on a small, deliberate set of service providers. This page lists all of them. When the list changes, this page changes with it — last updated 2026-09-03.
Services that process customer data
| Service | What it does | What it can see |
|---|---|---|
| Supabase | Database, file storage, and sign-in | Everything you store in XOsign — documents, signatures, account data |
| Vercel | Runs the website and its server functions | All traffic to and from XOsign |
| Anthropic | Converting documents, reading photos and scans, finding signature fields, drafting, and full contract review | The content of documents you run AI features on, per request |
| OpenAI | Summaries, clause explanations, translation, risk and gap analysis, suggested edits, document building, and Help Center answers | The content of documents you run AI features on, per request |
| Stripe | Payments and subscriptions | Billing name and email. Card numbers never touch XOsign's systems |
| Resend | Sends email (signing invitations, completed copies, receipts) | Recipient names, email addresses, and document links or attachments |
| Telnyx | Sends text messages (signer verification codes) | Phone numbers and the message text |
| Google Cloud (Document AI) | Reads scanned pages (OCR) | Page images, when you convert a scanned document |
| Fly.io | Renders documents to PDF | Document content during rendering |
Services that receive only minimal data
| Service | What it does | What it can see |
|---|---|---|
| FreeTSA | Independent trusted timestamps on completed documents | A document's SHA-256 fingerprint only — never its content |
| Esri (ArcGIS) | Property lookup | The address you type into the lookup |
| USPS | Certified-mail tracking | Tracking numbers only |
Built but switched off: some integrations exist in the product and are currently disabled — certified mail, online notarization, and cloud-storage import. Before any of them starts handling customer data, it is turned on deliberately and added to the list above.
Questions? Write to security@xosign.ai.