one2sign Service Terms (E-Signature Terms)

Name change. Senots Sign is now named one2sign, provided at one2sign.com and related one2sign subdomains. References to "Senots Sign" in Orders, invoices, emails, Evidence Records, Certificates of Signature and other records made before this change mean one2sign. The provider (DDR Solutions Inc.), the Services and the rest of this document are otherwise unchanged. Certificates issued before October 30, 2026 are titled “Certificate of Completion”; they are the same record this document calls the Certificate of Signature.

These one2sign Service Terms (the "E-Signature Terms") form part of the agreement between DDR Solutions Inc. ("DDR", "we", "us") and the Customer under the Terms of Service (the "Terms"). They apply whenever Customer uses one2sign (formerly Senots Sign), DDR's electronic-signature service, including the Sign app in the Senots Suite, or any other electronic-signature or electronic-acceptance feature of the Services, such as a Recipient accepting a quote online.

Capitalized terms not defined here have the meanings given in the Terms. If these E-Signature Terms conflict with the Terms, these E-Signature Terms prevail for one2sign and electronic-signature features. The Data Processing Agreement prevails for the processing of Customer Personal Data.

Signer-facing text, including the Electronic Records and Signature Disclosure, is in a separate document: Electronic Records and Signature Disclosure (for Recipients) (the "Disclosure").

1. Additional definitions

• "Sender" means the Customer, acting through the Authorized User who prepares or sends a Document.
• "Signer" means a Recipient who is asked to sign or approve a Document, including an in-person signer. "Viewer" means a Recipient who receives a copy only.
• "Certificate of Signature" means the pages that one2sign adds to a completed Document, summarizing the parties, their identity checks and the events of the signing.
• "Audit Trail" means the time-stamped record of events for a Document kept in the Services (for example created, sent, viewed, access code entered, signed, declined, handed on, corrected, canceled, expired and completed).
• "Verification Code" means the short code printed at the foot of the pages of a completed Document. The "Verify Page" is the public page where anyone can check a Document against its Verification Code or fingerprint.
• "Electronic Signature" means the signature, initials, typed name, drawn or uploaded image, or click to sign or approve that a Signer applies through one2sign.

2. Customer decides to use electronic signatures

2.1 Customer's decision. Customer alone decides whether a Document may be, and should be, signed electronically, which Recipients must sign it, in what order, and what identity checks to require. DDR provides the technology to create, send, sign and keep electronic records. DDR is not a party to any Document, does not review Documents, and does not decide whether they are valid, enforceable or admissible.

2.2 Legal effect. Laws in Canada, the United States, Colombia and Mexico generally give electronic signatures and records the same legal effect as handwritten signatures and paper records, when the parties agree to transact electronically and the law's conditions are met. Those laws include the provincial and territorial electronic commerce acts, Part 2 of the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act to establish a legal framework for information technology (CQLR c C-1.1) together with article 2827 of the Civil Code of Québec, the US Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001 et seq., "ESIGN"), the Uniform Electronic Transactions Act as adopted by US states ("UETA"), Colombia's Ley 527 de 1999 and Decreto 2364 de 2012 (electronic signatures), and Title II, Book Second (articles 89 to 114) of Mexico's Código de Comercio. Those laws also contain exceptions and conditions (Section 3). Customer is responsible for meeting them. For Colombia, one2sign is built to support the conditions that Ley 527 de 1999 and Decreto 2364 de 2012 set for a reliable and appropriate electronic signature (for example, that the signature can be attributed to the Signer and that later changes to the signed Document can be detected, as the Evidence Record shows), but whether they are met for a particular Document depends on how Customer uses it.

2.3 Type of signature. one2sign produces a simple electronic signature supported by the Evidence Record. It does not produce:

• a "secure electronic signature" under the federal Secure Electronic Signature Regulations (Canada);
• a signature backed by a qualified certificate or a public-key infrastructure (PKI) digital-signature seal on the PDF;
• a firma digital under Colombia's Ley 527 de 1999, which relies on a certificate issued by a certification authority (entidad de certificación);
• a firma electrónica avanzada (including the SAT e.firma) under Mexican law, or a constancia de conservación under NOM-151-SCFI-2016; or
• a notarized, commissioned, sworn or witnessed signature.

Where a law or a counterparty requires any of these, Customer must not rely on one2sign alone.

3. Documents that should not be signed through one2sign

3.1 General rule. Customer will not use one2sign for any Document that, under the law that applies to it, cannot be validly signed or delivered electronically, or must meet a formality the Services do not provide (such as a wet-ink original, a witness, a notary, a commissioner for oaths, a seal or registration in a particular form).

3.2 Common exclusions. The list below is a guide, not legal advice, and is not complete. Laws change and vary by province, territory and state.

Canada (common-law provinces and territories). The provincial electronic commerce and electronic transactions acts (for example Ontario's Electronic Commerce Act, 2000, British Columbia's Electronic Transactions Act and Alberta's Electronic Transactions Act) exclude or restrict, among others:

• wills and codicils, and trusts created by wills or codicils (some provinces, such as British Columbia, now allow electronic wills, but only under specific succession-law formalities that one2sign does not provide);
• powers of attorney for property or financial affairs, and powers of attorney or directives for personal care;
• documents that create or transfer interests in land and must be registered to be effective against third parties (land-registry systems use their own electronic channels);
• negotiable instruments, such as bills of exchange, cheques and promissory notes under the Bills of Exchange Act; and
• documents that the law requires to be witnessed, sworn, affirmed, notarized, commissioned or sealed, which can include domestic contracts and separation agreements under provincial family law, affidavits and statutory declarations.

Quebec. The Act to establish a legal framework for information technology is technology-neutral, but it does not remove formal requirements set by other laws. Do not use one2sign alone for acts that must be made in notarial form (for example certain marriage or civil union contracts, immovable hypothecs and gifts that require a notarial act), wills in any of the forms required by the Civil Code of Québec, mandates in anticipation of incapacity, or documents that must be sworn or witnessed. For consumer contracts, the formal requirements of Quebec's Consumer Protection Act (for example mandatory clauses, French text and delivery of a copy) continue to apply.

United States. ESIGN (15 U.S.C. § 7003) and UETA (§ 3) do not apply to, among others:

• wills, codicils and testamentary trusts;
• adoption, divorce and other matters of family law;
• the Uniform Commercial Code, other than sections 1-107 and 1-206 and Articles 2 and 2A (so negotiable instruments under Article 3 and many secured-transactions documents are outside them);
• court orders, notices and official court documents, including briefs and pleadings;
• notices of cancellation or termination of utility services;
• notices of default, acceleration, repossession, foreclosure, eviction or the right to cure under a credit agreement secured by, or a rental agreement for, a primary residence;
• notices of cancellation or termination of health or life insurance benefits (other than annuities);
• product-recall notices and notices of material failure that risk health or safety; and
• documents required to accompany the transportation or handling of hazardous materials, pesticides or other toxic or dangerous materials.

Notarization, real-estate recording and some state-specific notices are governed by separate state laws.

Colombia. Ley 527 de 1999 recognizes data messages and electronic signatures, and Decreto 2364 de 2012 sets the conditions for electronic signatures. They do not by themselves replace a requirement under other laws that an act be granted by public deed before a notary (escritura pública), such as many real-estate transfers, or other formalities that other laws set. Where a law or a counterparty requires a firma digital backed by a certificate from a certification authority, one2sign does not provide it (Section 2.3).

Mexico. The Código de Comercio recognizes electronic signatures and data messages in commercial matters. It does not replace a requirement that an act be granted before a fedatario público (notary or corredor público), such as many real-estate transfers, company incorporations and certain powers of attorney. It also does not by itself satisfy laws that require a firma electrónica avanzada, specific formalities for títulos de crédito (such as pagarés), or wills and family-law acts under civil codes. Where evidentiary weight matters, Customer should consider a NOM-151 conservation certificate from an accredited provider, which one2sign does not provide.

Elsewhere. If Customer sends Documents to Recipients outside Canada, the United States, Colombia or Mexico, Customer is responsible for checking the local law.

3.3 Regulated sectors. Some sectors have their own rules for electronic records and signatures, for example US FDA 21 CFR Part 11, financial-services and insurance regulations, healthcare and government procurement. one2sign is not validated or certified for any regulated-sector standard.

4. Consent of Recipients and the Disclosure

4.1 one2sign asks for consent. Before a Signer can sign, one2sign shows the Signer the consent statement and a link to the full Disclosure, and records the Signer's agreement, the time, the consent version, the Signer's IP address and the approximate location derived from it. The current in-app consent wording is reproduced in Part B of the Disclosure.

4.2 Customer is the party giving the Disclosure. The Disclosure is given on behalf of the Sender, which is the party asking the Recipient to transact electronically. Customer is responsible for (a) deciding whether the Disclosure meets the laws that apply to its Documents and Recipients, including the consumer-disclosure rules in 15 U.S.C. § 7001(c) where a Recipient is a consumer and a law requires information to be given in writing; (b) giving any additional disclosures required by law or by its own policies; and (c) honouring a Recipient's request for a paper copy or withdrawal of consent, as the Disclosure describes.

4.3 Paper copies and withdrawal. Customer will provide a paper copy of a Document to a Recipient who asks for one, free of charge, within a reasonable time. If a Recipient declines to sign electronically, or withdraws consent before signing, Customer will offer another way to complete the transaction where the law requires.

4.4 Recipient's own agreement. Recipients do not accept the Terms. Recipients' use of the signing page is subject only to the Disclosure, the short signer notice in Part C of the Disclosure, and the Privacy Policy.

5. Identity of Signers

5.1 What one2sign checks. one2sign can link a signature to a person only through the checks the Sender chooses:

• Email link (always). Each Signer receives a personal signing link. The link proves only that the person who opened it had access to that link, which normally means access to the email account it was sent to. If the Sender shares a link outside one2sign, it proves only that the person had the link.
• Access code (optional). The Sender sets a code and gives it to the Signer by another channel. one2sign stores only a keyed hash of the code and locks the link after five wrong attempts, until the Sender unlocks it.
• SMS code (if and when made available). A one-time code sent by text message to a phone number the Sender enters, verified through DDR's SMS provider.
• In person. The Signer signs on a device on which an Authorized User is signed in. That Authorized User, on Customer's behalf, is responsible for checking the Signer's identity. The Evidence Record names the Authorized User whose device was used.

5.2 No identity verification. one2sign does not verify government identity documents, perform knowledge-based authentication, check biometric data, or confirm that an email address or phone number belongs to a particular person. Files a Signer attaches, such as a photo of an identity document, are stored for the Sender to review. DDR does not check them.

5.3 Customer's responsibility. Customer is responsible for choosing identity checks that are appropriate for the risk of each Document, for entering correct contact details, and for any loss resulting from a signature applied by someone other than the intended Signer, except to the extent caused by DDR's breach of the Agreement.

6. Files Recipients attach

6.1 A Sender can ask a Signer to attach files (PDF, PNG or JPEG, up to 10 MB each), for example an identity document, a void cheque or a certificate.

6.2 Customer will request only the files it needs for the purpose of the Document, will tell Recipients why it needs them (the request label shown to the Signer should say so), and will limit access, retention and deletion accordingly. Identity documents and banking details are sensitive Personal Information. Customer should not ask for them unless it has a clear legal or business need, and should delete them when that need ends (Section 9).

6.3 Attached files are Customer Data. They are stored in private storage and are available to the Sender and Authorized Users with access to the Document. They are not added to the signed PDF or sent to other Recipients.

7. Evidence Record

7.1 What is recorded. For each Document, one2sign records:

• the Document's SHA-256 fingerprint when sent, and the fingerprint of the signed copy;
• each Recipient's name and email address, role, signing order and, where used, the access-code or in-person check;
• each Signer's consent time, consent version and the language the consent was shown in;
• whether one2sign emailed each Signer their signing link and when (when DDR's email provider accepted the email; delivery to the inbox is not confirmed); otherwise the link reached the Signer another way;
• the time of each event, in UTC, and the Signer's local time from the time zone their browser reports;
• the Signer's IP address, the approximate location (city, region and country) that DDR's hosting provider, Cloudflare, derives from that IP address, and the browser and device description (user agent); for viewing and other events, a keyed fingerprint (hash) of the IP address rather than the address itself;
• the Signer's Electronic Signature and initials as images, and the values entered in fields; and
• the events in the Audit Trail.

7.2 Certificate of Signature. When every Signer has signed, one2sign builds the signed PDF with a Certificate of Signature. The Certificate shows each Recipient's name and email address, signature and initials, the identity check used, IP address and approximate location, the timeline of their events, and their device description, together with the SHA-256 fingerprint of the Document as sent and its history. The Certificate also shows the Document's Verification Code and a QR code that opens the Verify Page for that Document. The Certificate also shows the Sender's display name and account email address, as recorded when the Document was sent (or, for a Document already out for signature when one2sign began showing the Sender's email address, as recorded the first time after that when the Document is emailed, viewed or certified); they do not change afterwards. The account email address is the email address of the Sender's account login, which one2sign checked the Sender controlled when they signed in. The Certificate labels it as verified by one2sign only where one2sign holds a record of that sign-in. The display name is set by the Sender or its company: where the Sender's login is linked to an employee record, it is the name in Customer's HR records (as entered by Customer's HR staff or admins); otherwise it is the name the Sender set on their account. Where there is no display name, or one2sign refuses it (for example, because it looks like an email address or a website, or presents the Sender as one2sign or Senots, or as verified), the Sender is shown by email address alone. DDR verifies only that the Sender controls that email address. It does not verify the Sender's identity or name. DDR support staff cannot send Documents. A Document that a visitor starts from a public shared link (Section 8.3) shows Customer's company name instead, and its Certificate shows no Sender. Every Recipient of the completed Document receives the Certificate, so each Recipient can see these details about the others. Customer must take this into account when choosing Recipients, and must tell its Recipients about it where the law requires. The Disclosure tells Signers before they agree.

7.3 Verify Page. Anyone holding a completed Document can check it on the public Verify Page, either by entering its Verification Code or by selecting the PDF. The PDF is fingerprinted in the person's own browser and is not uploaded. The answer says whether the file matches a Document signed through one2sign. It does not show the names of the parties.

7.4 No PKI seal. The signed PDF does not carry a certificate-based digital signature (PAdES) or a trusted timestamp. Integrity is shown by the fingerprints and the Verify Page, which depend on DDR's records being available. PDF readers such as Adobe Acrobat will not show the Document as digitally signed. If DDR adds a certificate-based seal in the future, it will apply only to Documents completed after it is introduced.

7.5 Limits of evidence. DDR maintains the Evidence Record with reasonable care and will, on Customer's request and at Customer's reasonable cost, provide a statement or reasonable testimony about how the Services create and keep Evidence Records. DDR does not guarantee that any court, tribunal or authority will accept the Evidence Record or reach any particular conclusion about who signed a Document.

8. Sending, emails and links

8.1 Messages. one2sign sends invitations (including to a person a Document is reassigned to), reminders, expiry warnings, cancellation notices, decline notices and completion emails with the signed copy from a DDR sending address on a one2sign.com or senots.com domain, shown in each email, with the Sender's company name, through DDR's email provider. Each of these emails, and the signing page, show the Sender's display name and account email address ("Sent by …"), recorded and kept as Section 7.2 describes. The reply-to address is the email address of the Authorized User who sent the Document, the same account email address the email shows, so a Recipient who replies writes to that person and can see that address. Documents started from a public shared link show only Customer's company name, with no Sender name or email address and no reply-to address.

8.2 Anti-spam laws. Customer is the sender of these messages for the purposes of Canada's anti-spam legislation (CASL) and the US CAN-SPAM Act. Customer will send Documents only to Recipients with whom it has a genuine business or legal reason to transact, and will not use one2sign to send commercial electronic messages, marketing or unsolicited bulk requests. The Acceptable Use Policy applies.

8.3 Links. Signing links and public template links are secret. Anyone who has a link can open what it gives access to, subject to any access code. Customer is responsible for links it shares outside one2sign, including public "shared links" from which each visitor signs their own copy.

8.4 Sending limits. one2sign applies daily and hourly limits to Documents and invitations (Terms, Section 16.3). Invitations above the daily limit wait and are sent on the following day.

8.5 Completed copies. When a Document is completed, each Recipient receives a completion email. The signed PDF is attached when it is 10 MB or smaller; otherwise the Recipient can download it through their signing link while the Document exists in the Services. Copies that Recipients have received are outside DDR's control and are not affected by later deletion in the Services.

9. Retention and deletion

9.1 Customer controls retention. Documents and their Evidence Records are kept until Customer deletes them, unless Customer chooses a retention setting. The Sender or an e-sign Admin can delete a Document that is completed, canceled, declined or expired. A Document still out for signature must be canceled first.

9.2 Retention setting. An e-sign Admin can set the Account to delete closed Documents automatically a set number of years after they closed (currently 1, 2, 3, 5, 7 or 10 years), or to keep them until deleted (the default). Automatic deletion starts no sooner than 7 days after the setting is turned on or shortened, and other e-sign Admins are notified. Deletion runs in batches and may take some time to complete for large Accounts. Customer is responsible for choosing a retention period that meets its legal and record-keeping obligations, including tax and employment record rules, limitation periods and litigation holds. DDR cannot recover a deleted Document, except to the limited extent it can still be restored from the database's point-in-time recovery (currently up to 30 days); Document files are not kept in backups.

9.3 What remains after deletion. When a Document is deleted, DDR keeps: (a) in the Account's audit log, who deleted it and when, the Document's name, and the numbers of Recipients, attachments and files; and (b) a minimal record of the Verification Code, the SHA-256 fingerprint of the signed copy and the date the Document was started, so that the Verify Page can still confirm that a copy was signed through one2sign and so that monthly Legacy Free Plan counts stay correct. The minimal record contains no Document content and no Recipient details. Customer should avoid putting sensitive Personal Information in Document names.

9.4 Account closure. On closure of the Account, Section 11 of the Terms applies.

10. Payments in Documents (if and when made available)

10.1 If and when DDR makes payment fields available in one2sign, a Sender will be able to ask a Signer to pay an amount by card when signing, using Stripe Connect.

10.2 Payments will be made to Customer's own Stripe account. Customer, not DDR, is the merchant and the seller of whatever the payment is for. Customer must open and keep its own Stripe account, accept Stripe's terms, and is solely responsible for the transaction, pricing, taxes, receipts, refunds, chargebacks, disputes, fraud losses and compliance with payment-card rules and consumer-protection laws. DDR does not receive, hold or transmit the funds. Any platform fee DDR charges will be disclosed in the Services before Customer turns the feature on.

10.3 Card details are entered into Stripe's payment form and are not received or stored by DDR. DDR records the payment status and amount in the Audit Trail.

11. Plan features

The features available in each Plan are shown in the Services and the Billing and Refund Policy. For example, on the Legacy Free Plan the signing pages, emails and signed copies show the one2sign mark and Customer's company name, but not Customer's logo or colour. If Customer moves to a Plan that does not include a feature, or the Account becomes read-only (Terms, Section 4.9), Documents already sent continue to their conclusion, but new use of the feature stops.

12. No legal advice

DDR does not give legal advice. Templates, field rules, examples and help content are provided for convenience. Customer should obtain its own legal advice on its Documents and on how electronic signatures apply to them.

13. Customer warranties for one2sign

Customer represents and warrants that, for each Document it sends: (a) it has the right to send the Document and its content to the Recipients; (b) it has a lawful basis to process the Recipients' Personal Information, including the information in the Evidence Record and on the Certificate of Signature; (c) the Document may lawfully be signed electronically, or Customer has decided to accept that risk; and (d) it will comply with Sections 4, 6 and 8 of these E-Signature Terms.

14. Contact

Questions about these E-Signature Terms: hello@one2sign.com.