DBX Sign is operated by DBX Enterprises, 602 S 8th Ave, Safford, AZ 85546. For questions about this notice or your information, write to [email protected].
When you use DBX Sign to send documents, you decide what is collected and from whom. You are the controller of that information and we process it on your instructions. When we handle your own account — your login, your billing, your use of the service — we are the controller.
| Category | Why |
|---|---|
| Your account: name, email address, password (stored only as a bcrypt hash), organisation, role, and any real-estate licence number you choose to record | To let you sign in, to show the right things to the right people, and to put the acting person on the audit trail |
| Documents you upload, and the fields placed on them | To render them, route them and seal them. They are yours |
| Signers: name, email address, any phone number you supply, and any access code — held only as a bcrypt hash, never in readable form | To deliver the document and to evidence who signed |
| The signing record: IP address, timestamps, the consent disclosure version each signer saw (by hash), the signature they adopted and its style | This is the evidence the service exists to produce. It is written into a hash-chained audit trail and printed on the Certificate of Completion |
| Email delivery events — sent, delivered, bounced | So you can see whether an invitation arrived |
| Server logs, including IP addresses | Security and fault diagnosis |
We do not ask for, and ask you not to upload, government identity numbers, payment card numbers, or health information. DBX Sign is not built for protected health information and we do not offer a HIPAA Business Associate Agreement.
Two, and both are strictly necessary:
That is the complete list. No analytics, no advertising, no third-party trackers, and no
cookie banner, because there is nothing to ask you about. The application's content
security policy is default-src 'self', so the pages load nothing from anybody
else. The one exception is the developer API documentation page at /docs, which
loads its interface from a public CDN; nothing you sign passes through it.
Three companies sit in the path, and each is named with what it does and where it holds data on our sub-processor page. Beyond them, a document is shared only with the people on its own envelope. We do not sell personal information, and we do not share it for advertising. We will disclose information if we are legally required to, and will tell you unless we are prohibited from doing so.
Executed documents, their certificates and their audit trails are retained so that every party can obtain an accurate copy, which is what the ESIGN Act contemplates and what makes the evidence worth anything. Drafts can be deleted by their owner at any time. If you close your account we will delete or return your data on request, except where a completed envelope must remain intact because another party relies on it — in which case we will tell you which ones and why. Backups roll off on their own schedule.
Depending on where you live you may have the right to ask for a copy of your information, to correct it, to delete it, to limit how it is used, or to object. Write to [email protected] and we will respond within 30 days. If you are a signer rather than an account holder, the sender of your envelope decides what happens to that document — ask them first, and tell us if you cannot reach them.
We will never charge you, or treat you differently, for exercising a privacy right.
On a single private server in the United States. We do not replicate it to other regions. If you need data residency elsewhere, we cannot offer it today — tell us and we will say so plainly rather than work around it.
DBX Sign is for business use and is not directed to children. Do not use it to collect information from anyone under 13.
If we change this notice in a way that materially affects you, we will say so on this page and date the change. The review date below is always current.