Eversign (Xodo Sign)
VERIFIEDVienna-launched e-signature platform (eversign GmbH, 2017) — acquired by Apryse (US/PDFTron) in 2022, rebranded as Xodo Sign.
Why this score?
Eversign GmbH (Vienna + London, founded 2017) launched as an EU-based e-signature platform with SOC II + GDPR + eIDAS + UETA attestation — but in 2022 it was acquired by Apryse (formerly PDFTron Systems Inc., headquartered in Denver, Colorado, USA with operations in Vancouver, Canada) and subsequently rebranded as Xodo Sign. Per the directory's strict-ownership stance the resulting product is us_owned with direct CLOUD Act exposure under a US parent; score capped at 3/5 reflecting the legacy Vienna engineering operation, eIDAS-compliant signature workflow, and continuing EU-customer base, but procurement-grade EU buyers should choose Yousign (FR, eIDAS-qualified), Skribble (CH, ZertES + eIDAS), Universign (FR), or Signaturit (ES) instead — all structurally cleaner alternatives in this category.
- SCORE
- 3.0/5
- CLOUD ACT
- CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
-
- OWNERSHIP
- OWNERSHIP
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned This listing US-headquartered, or has a US parent company.
-
Other Swiss, UK or another non-EU jurisdiction.
-
- SUB-PROCS
- — not disclosed
JUMP TO
About Eversign (Xodo Sign)
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
Open ↗Terms of Serviceeversign.com/legal…
Alternatives in this category
Barcelona-based Spanish digital-trust group (Signaturit, now a Namirial Italian company), 4 QTSPs with highest eIDAS qualifications, regulator-audited.
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Zurich-based Swiss e-signature platform with **dual ZertES + eIDAS QES** via Swisscom partnership; ISO 27001, 4,000+ DACH customers.
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Long-running French QTSP (originally Cryptolog International, 2001); merged into Signaturit Group (a Namirial Italian company).
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.