Data Processing Agreement
Last Updated: July 24, 2026
This Data Processing Agreement ("DPA") supplements the kysigned Terms of Service and governs Kychee, Inc.'s ("Processor") processing of personal data on behalf of the sender ("Controller") when using the kysigned service.
1. Definitions
- Personal Data: Any information relating to an identified or identifiable natural person, as processed through the kysigned service.
- Processing: Any operation performed on personal data, including collection, storage, transmission, assembly into a signing record, delivery, and deletion.
- Controller: The sender who sends a document for signing and determines the purposes of processing (the signer names, emails, and document content).
- Processor: Kychee, Inc., which processes personal data on the Controller's behalf to provide the kysigned service.
2. Scope of Processing
The Processor processes the following personal data on behalf of the Controller:
| Data Category | Data Elements | Purpose |
|---|---|---|
| Signer identity | Name, email address | Deliver signing requests, record signatures |
| Signing metadata | Email headers, timestamp | Audit trail and evidence |
| Document content | PDF document, SHA-256 hash | Signing record assembly, verification |
| Signing record | Signed emails, timestamp proofs, public keys | Permanent signature proof delivered to the parties |
3. Controller Obligations
The Controller is responsible for:
- Ensuring they have a lawful basis to submit signers' personal data to the service
- Informing signers that their data will be processed by kysigned, including that the completed signing record (which contains each signer's email address and name) is delivered to every party to the signing and is thereafter outside the Processor's control
- Obtaining any required consent from signers
- Confirming that electronic signing is legally permitted for their document type and jurisdiction
4. Processor Obligations
The Processor shall:
- Process personal data only as necessary to provide the kysigned service
- Implement appropriate technical and organizational security measures
- Not sell, share, or use personal data for purposes other than providing the service
- Assist the Controller in responding to data subject access requests (to the extent technically feasible — see Section 7)
- Notify the Controller without undue delay (and within 72 hours) upon becoming aware of a personal data breach. "Becoming aware" means having reasonable certainty that a personal data breach occurred and what data was affected. The Processor maintains documented monitoring, an incident response runbook, and an audit trail of detection and triage events to ensure "reasonable diligence" in identifying breaches (per the GDPR Article 33 standard).
- Delete all personal data the Processor holds when the Controller requests deletion of their account, except for signing records already delivered to recipients (see Section 7)
4.1 Breach Blast Radius — Ephemeral PDF Retention
The Processor's document storage is ephemeral by design. The working copy of a document is retained only as long as operationally required:
- During the active signing period
- Until the signing record is confirmed delivered to all parties
- Maximum 7 days additional retention if some completion emails bounced
- Hard maximum: 30 days from completion, regardless of delivery state
In practice, documents typically exist in storage for hours, not days. After the signing record is delivered, only metadata (document name, hashes, signer status, signing timestamps) persists. This ephemeral retention pattern is a deliberate security measure that significantly limits the exposure window for any data breach affecting document content.
5. Sub-Processors
The Processor engages the following sub-processors:
| Sub-Processor | Purpose | Data Processed |
|---|---|---|
| run402 | Compute, database, email delivery, and object storage | All service data |
| Stripe | Card payment processing for credit purchases | Email and purchase amount (card details are entered on Stripe's pages and are never received by the Processor) |
| Public timestamp authorities (RFC 3161 / OpenTimestamps) | Independent signing-time anchoring | The cryptographic hash of a signed email only — no contents, no identities |
The Processor will notify the Controller of changes to sub-processors with 30 days' notice.
6. Data Transfers
Personal data may be transferred to and processed in the United States. For transfers from the EU/EEA, the Processor relies on Standard Contractual Clauses (SCCs) as the transfer mechanism.
7. Delivered Signing Records — Limitation
Critical disclosure: the completed signing record is delivered, as an email attachment, to every party to the signing. It contains each signer's name, email address, and signed email. Once delivered, a signing record is in each recipient's own mailbox and is therefore beyond the Processor's recall — exactly as with any email a person sends. The Processor cannot retrieve, modify, or delete a signing record that has already been delivered.
The Controller acknowledges this limitation before using the service. The Processor can delete all personal data it itself holds (account records, signing metadata, and any working copy of a document) upon request.
8. Data Subject Rights
The Processor will assist the Controller in fulfilling data subject requests:
- Access: The Processor can provide all data it holds associated with a signer's email.
- Rectification: The Processor can correct the records it holds.
- Erasure: The Processor can delete all records it holds. Signing records already delivered to recipients are beyond the Processor's recall (see Section 7).
- Portability: The Processor can export data in JSON format.
9. Security Measures
The Processor implements:
- Encryption in transit (TLS 1.2+)
- Encryption at rest for stored documents and database
- Access controls and authentication
- No custody of signing keys of any kind (for users or for sealing) — there is no signing key to compromise
- Incident response procedures
10. Audit Rights
The Controller may request evidence of the Processor's compliance with this DPA. The Processor will provide relevant documentation, certifications, or audit reports upon reasonable request.
11. Term and Deletion
There is no subscription or fixed term. This DPA applies for as long as the Processor holds personal data processed on the Controller's behalf. The Controller ends the arrangement at any time by requesting deletion of their kysigned account and data (see the Privacy Policy) — that deletion request is the termination. Upon it:
- All personal data the Processor holds is permanently deleted.
- Signing records already delivered to recipients remain in their mailboxes (Section 7).
The Controller may export their data before requesting deletion.
12. Governing Law
This DPA is governed by the same law as the Terms of Service (Delaware, United States).
13. Contact
Data Protection Contact: legal@kychee.com Kychee, Inc.