This list forms part of the Data Processing Agreement (the "DPA"). It names the third parties that DDR Solutions Inc. ("DDR") uses to process Customer Personal Data in providing Senots and one2sign (the "Services"). Capitalized terms have the meanings given in the DPA and the Terms of Service.
1. Subprocessors
| Subprocessor | What it does for the Services | Customer Personal Data it processes | Location of processing | Transfer safeguards |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), database (D1), file storage (R2), content delivery, network security, DDoS protection, bot protection for sign-up forms (Turnstile), operator access control (Access), and IP-based approximate location for signing evidence | All Customer Data, including Documents, files, HR and payroll records and Recipient information | Stored data: eastern North America requested (a placement request, not a guarantee; Canada or United States); the senots.com waitlist database is in western North America (Canada or United States; not a guarantee). Requests: Cloudflare's global network, at the data centre nearest the person connecting | Cloudflare data processing addendum (with SCCs and UK Addendum); EU-U.S. Data Privacy Framework where certified |
| Resend (Plus Five Five, Inc.) | Sending email from DDR's one2sign.com and senots.com sending domains: sign-in codes; signing invitations, reminders, expiry, reassignment, decline, cancellation and completion emails (completion emails with the signed PDF); saved-plan follow-up emails to members; and operator alert emails to DDR's own address (counts and usage figures only, with no Customer Personal Data) | Recipients' and Authorized Users' names and email addresses, email subject and content, document names, signed PDFs attached to completion emails, and the sender's name and email address in the email content and as reply-to; for saved-plan follow-ups, the member's email address, company name and plan | United States | Resend data processing addendum (with SCCs and UK Addendum) |
| Stripe, Inc. and its affiliates (including Stripe Payments Canada, Ltd.) | Subscription billing for one2sign and Senots plans; card payment pages for invoices; if and when made available, payment fields in Documents through Stripe Connect | Billing contact name, email and address; card details entered directly into Stripe; invoice number, amount and currency; payment status | United States and other countries where Stripe operates | Stripe data processing agreement (with SCCs and UK Addendum); EU-U.S. Data Privacy Framework where certified |
| Twilio Inc. (Twilio Verify), if and when SMS codes are made available | Sending and checking one-time SMS access codes to Recipients | Recipient mobile phone number; code delivery and check status | United States | Twilio data protection addendum (with SCCs and UK Addendum); EU-U.S. Data Privacy Framework where certified |
The data placement request for Cloudflare D1 and R2 is Cloudflare's "eastern North America" (ENAM) location hint. The senots.com waitlist database (D1) is in Cloudflare's western North America (WNAM) location. Cloudflare does not offer a Canada-only residency guarantee for these products.
2. Third parties that are not Subprocessors
These services are used by the Services but do not process Customer Personal Data on DDR's behalf, or act as independent controllers at the user's choice. They are listed for transparency.
| Service | Purpose | What it receives | Location |
|---|---|---|---|
| Google LLC (Google sign-in) | Optional sign-in for Authorized Users who choose it | The sign-in request; Google returns name, email and an account identifier. Google is an independent controller of the user's Google account | United States and global |
| Microsoft Corporation (Microsoft Entra ID sign-in) | Optional sign-in for Authorized Users who choose it | As for Google; Microsoft is an independent controller | United States and global |
| Norwegian Meteorological Institute (MET Norway) | Weather in the top bar, if an Authorized User turns it on | A location rounded to about 10 km, from DDR's server; no IP address or account information | Norway |
| OpenStreetMap Foundation (Nominatim) | Place names and place search for the weather feature | A location rounded to about 10 km, or the place name typed; from DDR's server; no IP address or account information | Europe (United Kingdom-based foundation) |
| Bank of Canada (Valet API) | Daily foreign-exchange reference rates for multi-currency documents | Nothing about Customers or individuals. DDR downloads public rates | Canada |
| Customer's own Stripe account (Stripe Connect, if and when made available) | Payments that Customer collects from its own customers | Payment details, under Customer's own agreement with Stripe | As Stripe determines |
3. Changes to this list
3.1 Notice. DDR will give at least 30 days' notice before a new Subprocessor begins processing Customer Personal Data. DDR will (a) update this page with the new version and effective date, and (b) email the Owners of each Account, or show a notice in the Services. A Customer that wants notices sent to an additional address can ask at hello@one2sign.com.
3.2 Emergencies. If DDR must replace a Subprocessor urgently to keep the Services running or secure, it may give shorter notice and will explain why.
3.3 Objections. Customers may object as described in Section 6.4 of the DPA.
3.4 Features made available later. A Subprocessor marked "if and when made available" does not process Customer Personal Data until DDR turns the feature on. DDR will give the notice in Section 3.1 before doing so.
4. Version history
| Version | Effective date | Change |
|---|---|---|
| 1.0 | October 26, 2026 | First published list |