EU servers
No international data transfers outside the European Economic Area.
Security and data protection
Your signed documents, in Europe and under control
What you sign is often among the most sensitive material a company holds. KimoSign stores it on servers in the European Union, encrypted, with daily backups and a log of who did what with each document.
IT's questions, answered
KimoSign stores signed documents and their evidence on servers in the European Union, encrypted in transit and at rest, with daily backups and tested restores and an audit log of every action, and provides the service as a data processor under the agreement required by Art. 28 of the GDPR, with no international data transfers.
- Data location
- European Union No transfers requiring Chapter V GDPR safeguards
- Data processing agreement
- Art. 28 GDPR Including the list of sub-processors
- Security measures
- Encryption, access control, backups Art. 32 GDPR
- Breach notification
- 72 hours Art. 33 GDPR, from becoming aware of it
- Backups
- Daily, with tested restores A backup that has never been restored is not a backup
Encryption
In transit and at rest, for documents, evidence and signer data.
Firewall
Unwanted connections blocked, with dedicated resources.
Audit log
Who sent and who signed each document, and when.
Verified backups
Daily backups with tested restores.
GDPR, no fine print
Data processing agreement in line with Art. 28 GDPR.
Operations
How the service is run
- Continuous monitoring with alerts
- Daily backups with regular restore tests
- Separate test and production environments
- Planned and announced updates
- Support access logged and subject to authorization
- Business continuity and recovery plan
Infrastructure
Data kept inside the European Union
Hosting documents and their evidence in the EU avoids the most awkward part of the GDPR: justifying international transfers with adequacy decisions or standard contractual clauses.
- Servers in the European Union
- Daily backups with tested restores
- Data processing agreement listing sub-processors
Regulatory framework
The regulations we work under
Typical scenarios
The questions that come from the committee
Public sector · tender
Tender requiring data processing in the EU
Before The previous signing tool hosted documents outside the European Economic Area, which had to be justified in every tender.
After The European location is documented in the data processing agreement and the tender requirement is met with no further analysis.
Company with a data protection officer
Assessing the signature provider
Before Gathering the provider's information took weeks of emails and some questions went unanswered.
After Data processing agreement, list of sub-processors and security measures available from the first contact.
Services · client audit
Who took part in a contract
Before There was no way of knowing who had sent or signed each document, or when.
After Each document keeps a record of who sent it and who signed it, with date and time.
Vocabulary
Data protection terms
- Data processor
- A party that processes personal data on behalf of the controller, following its documented instructions and under the agreement set out in Art. 28 GDPR.
- International transfer
- Sending personal data outside the European Economic Area. It requires Chapter V GDPR safeguards, such as an adequacy decision or standard contractual clauses.
- Audit log
- A tamper-proof history of the actions taken on each document: who, what and when.
- Encryption at rest
- Protection of data while it is stored, limiting the damage if someone gains access to the physical media or a copy.
Frequently asked questions
What people ask us before they start
Where are documents stored?
On servers located in the European Union, encrypted in transit and at rest, with daily backups.
Who is the controller and who is the processor?
Your company is the controller: it decides what is signed and with whom. KimoSign acts as processor and only processes data on your instructions, under the agreement required by Art. 28 GDPR.
What signer data is processed?
Only what is needed to identify signers and prove the signature: name, email or phone number, IP address, device and, if authorized, approximate location. Nothing more.
What happens if there is a personal data breach?
Art. 33 GDPR requires it to be notified to the supervisory authority within seventy-two hours at most. The data processing agreement includes our commitment to inform you without undue delay so you can meet that deadline.
Can we see who has been involved in a document?
Yes. Each document records who sent it and who signed it, with date and time.
Is our data still ours if we leave the service?
Yes. The signed documents are yours, and the agreement sets out what happens to them and their evidence when the relationship ends.
Hand our security sheet to your IT team
We will show you how to sign a real document at the level you need, in half an hour.
Keep exploring
Related pages
The evidence file behind every signature
What KimoSign records with every signature: authentication, time stamp, SHA-256 fingerprint, IP and device…
Sign from your ERP without downloading or uploading a PDF
Send documents for signature from Sage 200, Navision, SAP, A3 or Odoo with Kimobox Connector, or from any…
Qualified signature: the same effect as signing by hand
Qualified e-signature with a certificate from a trust service provider and a qualified time stamp: same…
Kimobox and KimoSign: signing inside your workflows
KimoSign is the e-signature of Kimobox: one more step in your workflows and portals, with the same users and…
Electronic signature security and GDPR compliance
KimoSign hosts signed documents and their evidence on servers in the European Union, with encryption in transit and at rest, a firewall, verified daily backups and an audit log of every action.
The service is provided under a data processing agreement in line with Art. 28 of the GDPR and the LOPDGDD (Spain's data protection act), with no international data transfers outside the European Economic Area.