Data Processing Agreement

GDPR, covered.

How we handle the personal data in the documents you send, for businesses in the EU, the EEA, the UK and Switzerland, and anyone else who needs it in writing. It's part of our Terms, so there's nothing to sign.

Last updated 14 October 2026.

How this agreement works

This is the Common Paper Data Processing Agreement, a standard agreement written by a committee of lawyers. It's made up of this Cover Page and the Common Paper DPA Standard Terms Version 1.1, which are part of it as if they were written out here. Words with capitals that aren't defined here mean what the Standard Terms say.

It applies automatically whenever the EU's GDPR, the UK's GDPR or Switzerland's data protection law applies to personal data you send through asSigned, as our Terms say. Agreeing to the Terms is agreeing to it. If you'd like a copy signed by both of us, write to support@as-signed.com.

Key terms

Provider
Work As Intended LLC, which makes asSigned.
Customer
The business that holds the asSigned account.
Agreement
asSigned's Terms of Service, between Provider and Customer.
Approved Subprocessors

The companies below, and any added later under the Standard Terms. The trust center keeps the list up to date.

  • Amazon Web Services, Inc. Runs asSigned: its servers, database, file storage and email. United States (Oregon, with backup copies in Northern Virginia).
  • Cloudflare, Inc. The network in front of asSigned. Worldwide.
  • Notion Labs, Inc. Holds Provider's support requests: who asked, about which account and document, and what asSigned found, never a document's text. United States.
Provider Security Contact
support@as-signed.com
Security Policy
The technical and organisational measures in Annex II below, and on the trust center.
Service Provider Relationship
Where the California Consumer Privacy Act applies, Provider is Customer's service provider.
Restricted Transfers
Governing Member State for EEA transfers: Ireland. For UK transfers: England and Wales. For Swiss transfers, the EEA clauses apply as adapted for Switzerland, with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.
Changes to the Agreement
None. The Agreement's limits of liability apply.

Annex I: the parties and the processing

A. The parties

Data exporter
Customer, with the name and contact details on its asSigned account. Role: controller, or processor for its own clients.
Data importer
Work As Intended LLC, 2060 Lukins Way, South Lake Tahoe, CA 96150, USA. Contact: support@as-signed.com. Role: processor.

B. The processing

Service
asSigned: sending documents from Notion for electronic signature and putting the signed PDF back in Notion.
Categories of Data Subjects
The people Customer sends documents to and anyone named in those documents, and Customer's own people who use asSigned.
Categories of Personal Data
Names and email addresses; the IP address and browser a signer signs from; each signer's agreement to sign electronically; drawn or typed signatures and initials; the answers and files signers add; and whatever personal data Customer puts in its documents.
Special Category Data
None is needed. If Customer's documents contain any, the same safeguards apply: the per-account encryption below, deletion once a document is signed, cancelled or expired, and access limited to what's described in Annex II.
Frequency of Transfer
Continuous, for as long as Customer uses asSigned.
Nature and Purpose of Processing
To send Customer's documents for signature, collect signatures, make the signed PDF and its certificate, put it on Customer's Notion page, send signers their copies, and keep a record that proves a signed copy genuine.
Retention
A document and its signers' details are deleted once everyone has signed and the signed PDF is in Customer's Notion, or at once if it's cancelled or expires. The record of a signed document (its title, sender, signers' names, signing times and the PDF's fingerprint) is kept while Customer's account exists. Backups are kept 7 days and logs 30 days. The trust center has the full table.

Annex II: security measures

  • Encryption with a key per account. Provider's copy of Customer's documents is encrypted with AES-256 using a key that belongs to Customer's account alone, itself locked with a master key held in AWS Secrets Manager. Deleting an account deletes its key.
  • Encryption at rest and in transit. AWS also encrypts the database and file storage. Every connection uses HTTPS, with HSTS and TLS 1.2 or later.
  • Keeping less. Documents are deleted once signed, cancelled or expired. Backups last 7 days and logs 30 days.
  • Access. asSigned runs in its own AWS account. Only one person, a co-founder, has access, with multi-factor authentication, and every administrative action is logged in AWS CloudTrail and watched by Amazon GuardDuty.
  • Signing links and keys. Signing links are long random codes, stored only as fingerprints, expiring after 14 days unless Customer chooses otherwise, and good for one signature. API keys are stored only as fingerprints.
  • Notion access. asSigned sees only the Notion pages Customer shares with it, and stores its access to Notion encrypted.
  • Payments. Card details go straight to Stripe and never reach Provider.
  • Looking after the code. Dependencies are checked for known vulnerabilities automatically, and security problems can be reported to the Provider Security Contact.

Signatures

For Provider: Work As Intended LLC, by Toby Boardman, Co-Founder, 13 October 2026.

For Customer: accepted by agreeing to asSigned's Terms of Service.

Common Paper Data Processing Agreement (Version 1.1), free to use under CC BY 4.0.