# Docusign

> Sends documents out for signature, guides recipients through the signing flow, verifies their identity where requested, and records an audit trail for each transaction that is meant to evidence the signature later.

- Vendor: Docusign, Inc.
- Canonical URL: https://www.convios.com/en/toolbox/docusign
- Language version: https://www.convios.com/de/werkzeugkasten/docusign
- Area: Go-to-market & sales · Cluster: electronic signature
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-11 · Reviewed: 2026-08-11 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: A contract printed out for signature costs days that competitors no longer lose. Signing electronically wins those days back, and a dozen vendors ship the same function. What procurement therefore has to settle is the signature level the case at hand requires: the simple electronic signature sits in every plan, the qualified one costs an extra 10 euros per recipient, and only the latter holds where German law requires written form (Schriftform). That level decides both the price and the evidential position, and it never sits at the top of a feature list.

## Suitability by company size

- Solo: suitable — The Personal plan costs 9 euros a month on annual billing and allows five envelopes per month. For one person having a handful of orders signed each month that is enough. Anyone needing a qualified signature pays an extra 10 euros per recipient and quickly ends up above the base price.
- Mid-market: suitable — Standard costs 23 euros, Business Pro 38 euros per user per month on annual billing. The envelope allowance bites long before the price does: 100 envelopes per user per year, identical in both plans. A sales team having offers signed weekly runs out in October. Custom limits only appear in the quoted plan, which is also where SSO sign-in sits.
- Enterprise: suitable — For a vendor review there is unusually much on the table: a C5 attestation from the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik), Binding Corporate Rules approved both as processor and as controller, a German-language data processing agreement, and an EU region for all three main products. Two points remain before signing: AI training on your own contract data is the default for IAM and has to be actively switched off, and the data processing agreement explicitly rules out any bulk retrieval of your own data.

## Vendor staying power

Established: The vendor has been in the market since 2003, listed since April 2018, and reports quarterly. The German entity has been registered since March 2018 and has filed annual accounts ever since. Development visibly continues, most recently on the AI layer, which runs on acquired technology and on models from Microsoft and Google.

- Legal entity in Germany: Docusign Germany GmbH, Mies-van-der-Rohe-Strasse 4, 80807 Munich, managing director Hugo De La Torre, local court (Amtsgericht) Frankfurt am Main, commercial register HRB 111200, VAT ID DE815769757; the register has carried the company since 12 March 2018, formerly trading as mertus 416. GmbH, with share capital of 25,000 euros (source: https://www.docusign.com/de-de/unternehmen/impressum, as of 2026-08-11)
- Group and stock listing: Docusign, Inc. was founded in 2003 and has been listed on the Nasdaq under the ticker DOCU since 27 April 2018 (source: https://en.wikipedia.org/wiki/Docusign, as of 2026-08-11)
- First-quarter results: Announcement of 4 June 2026 for the first quarter of fiscal 2027: revenue of 830.2 million US dollars, 9 per cent above the prior-year quarter, free cash flow of 289.4 million US dollars, share repurchases of 317.5 million US dollars, and by the vendor own account close to 1.9 million customers; the billings metric is no longer reported from this quarter onwards (source: https://investor.docusign.com/news-and-events/press-releases/news-details/2026/Docusign-Announces-First-Quarter-Fiscal-2027-Financial-Results/default.aspx, as of 2026-08-11)
- Acquisition of the AI layer: In May 2024 the vendor announced the acquisition of Lexion for 165 million US dollars in cash; that entity now appears as DocuSmart, Inc. dba Lexion among the AI suppliers in the subprocessor list (source: https://www.docusign.com/trust/alerts/update-subprocessor-list-for-docusign-services-august-5-2026, as of 2026-08-11)
- Standing as a trust service provider: Docusign France SAS is listed as a qualified trust service provider under Regulation (EU) No 910/2014 in the French Trusted List and is supervised by ANSSI; two of its own remote signing devices appear in the member states compilation of qualified signature creation devices. For the German qualified signature the vendor has worked with D-Trust of the Bundesdruckerei group since 2018, and with A-Trust for Austria (source: https://www.docusign.com/trust/compliance/certifications, as of 2026-08-11)

## Cost of leaving

High: The documents themselves come out, one at a time and through the API. Three things stay behind. First, clause 10 of the data processing agreement states explicitly that no bulk retrieval is offered for the return of data and that the customer must engage Professional Services or customer support against a fee. Second, for transaction data and the Certificate of Completion the vendor states that it can neither delete nor export them even at the customer request, because the service is not architected for it. Yet those are precisely the records that carry the evidential weight of the signature. Third, templates, signing orders and the flows embedded in portals and emails all hang off the vendor address. Whoever moves takes the documents along and leaves behind the evidence of how they came about.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | separate document, in German, publicly available — The data processing agreement exists as a separate document in German, carries the version date 1 December 2022 and is, by its own wording, part of the agreement without any further condition. It sets an order of precedence in which the Binding Corporate Rules rank ahead of the standard contractual clauses and those ahead of the main body. Alongside the German version the vendor maintains separate versions for France and Brazil. | evidenced | 2026-08-11 |
| Storage location | EU region for all three main products, audit trail and identifying data leave it — The vendor runs five regions: United States, Canada, Europe, Australia and Japan. The European region is available for eSignature, IAM and CLM, with data centres in Amsterdam, Frankfurt and Paris according to the vendor. Two limitations appear on the same page, dated 14 April 2026: the region is fixed when the account is provisioned, and part of the data leaves it by design. Named are sender and signer names and email addresses used for authentication, plus audit trail metadata with unique IDs and IP addresses. Support operates on a follow-the-sun model, so staff in other regions can access transaction data; document content is excluded from this and stays encrypted according to the vendor. | partially evidenced | 2026-08-11 |
| Subprocessors | public list with purpose and country, changes announced with dates — The list is available as a freely accessible document and names each subprocessor with purpose and country, separated into infrastructure, platform and customer success. Changes are published with dates in the alerts section and can be subscribed to; clause 7 of the data processing agreement promises thirty days notice and a right to object. The announcement of 5 August 2026 reveals who runs the AI layer: Microsoft with Azure AI Services, Google with Vertex AI, and the acquired DocuSmart, Inc. dba Lexion; newly added was Sierra Technologies, Inc. for an in-product AI support chat. Two observations for a vendor review: the document sits outside the vendor domain on a delivery service, and the version linked on 11 August 2026 carries the word Draft in its file title. | evidenced | 2026-08-11 |
| Third-country transfer | Binding Corporate Rules as processor and as controller, plus standard contractual clauses — The European supervisory authorities approved the Binding Corporate Rules on 16 March 2018 in both roles, as processor and as controller. The data processing agreement additionally incorporates the standard contractual clauses under Implementing Decision (EU) 2021/914, module 2 for controller-to-processor transfers and module 3 for the chain below, with general written authorisation under clause 9. The UK addendum applies for the United Kingdom, and the Swiss deviations are named individually. A basis is therefore assigned to every group of recipients. | evidenced | 2026-08-11 |
| Training on customer data | default for IAM and CLM, opt-out available, a cut-off date decides — The AI attachment dated 8 July 2026 settles this in a table, and that table is the most valuable find in the entire document set. For IAM and CLM the customer consents to training on its own contract data by entering the contract. For eSignature on its own this does not apply as long as a master services agreement is in place. For plans bought through the website, a cut-off date decides instead: anyone who licensed eSignature before 8 July 2026 does not consent, anyone buying after that date does. Two points shape the picture. The licence granted is perpetual and irrevocable, it survives the end of the contract, and the vendor is not obliged to delete AI improvement data created earlier. The opt-out is available at any time through a button in the product but only takes effect going forward. Before use, customer data is anonymised and aggregated according to the vendor. | partially evidenced | 2026-08-11 |
| Retention and deletion | deletion on request promised, without a period; transaction data kept indefinitely — Clause 10 of the data processing agreement promises to delete personal data as quickly as possible at the customer request. No period in days is given, and archived backups are explicitly excluded; they are instead isolated and protected from further processing. Read separately from this is the statement on transaction data: the vendor retains it beyond the end of the subscription, indefinitely, and by its own account even where the customer requests deletion. It justifies this by its role as a neutral third party that must still be able to evidence a challenged transaction later. | partially evidenced | 2026-08-11 |
| Certifications | ISO 27001:2022, 27017:2015 and 27018:2019, C5 Type II, SOC 1 and SOC 2 Type II, PCI DSS 4.0 — The attestations are named with standard and version and relate to the vendor itself. For the German market the decisive one is the C5 Type 2 attestation against the criteria catalogue of the German Federal Office for Information Security, scoped to the eSignature product. Added to that are FedRAMP and GovRAMP authorisations for the government edition and a DISA provisional authorisation at level IL4. The audit reports themselves sit in the Trust Portal and require authentication and a signed non-disclosure agreement, which is customary for reports of this kind. The certification list contains no ISO/IEC 42001 for artificial intelligence management systems. | evidenced | 2026-08-11 |
| EU AI Act, Article 50 | detailed commentary on the regulation, no commitment on its own role — The vendor comments at length on the AI regulation, but as a use case for its own contract management: the German-language post explains the risk tiers and recommends managing supplier contracts and evidence through its product. What is missing is any classification of its own role. On the Iris AI layer, which analyses contracts and flags risks, there is no commitment regarding the transparency duties in Article 50 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, which apply from August 2026. The post also works from the 2024 position and cites the deadlines applicable then. Because Iris operates towards the customer own staff rather than towards its end customers, the disclosure can be set in-house. That does not follow as readily for the in-product support chat added in August 2026. | partially evidenced | 2026-08-11 |
| Audit logging | audit trail per transaction in every plan, no bulk retrieval — Each transaction produces a Certificate of Completion recording participants, timestamps, consents and technical identifiers such as IP addresses, and usable in court according to the vendor. The pricing table lists the real-time audit trail as included in all four tiers. Scope is therefore named, and so is the period: indefinite. What is missing is the export. The customer can download documents and certificates individually during the term; bulk retrieval is ruled out by the data processing agreement, which points to paid assistance instead. Anyone wanting to keep evidence in their own systems has to settle that route before signing. | partially evidenced | 2026-08-11 |

## Cost

- Entry: The German pricing page lists three plans on annual billing: Personal at 9 euros a month and 108 euros a year, Standard at 23 euros per user per month and 276 euros a year, Business Pro at 38 euros per user per month and 456 euros a year. Monthly billing is up to 44 per cent more expensive according to the toggle. The fourth tier is quoted by sales. (as of 2026-08-11)
- Where it gets expensive: In three places, none of them in the headline price. First at the signature level: the qualified electronic signature is a paid add-on at 10 euros per recipient in the three web plans, and the advanced signature is only included in the quoted plan and otherwise a matter of negotiation. Second at the envelope allowance: Personal allows five envelopes a month, Standard and Business Pro 100 per user per year each, and a custom limit only comes through sales. Third at administration: SSO sign-in, central organisation management and round-the-clock support also sit on the quoted tier. Identity verifications and SMS delivery are listed in Standard as a one-off bonus of five each.

## Three routes compared

### Adobe Acrobat Sign, or what the existing framework agreement already covers

Adobe Acrobat Sign covers the same job and in many organisations already sits inside the framework agreement for document tooling, which cuts one round out of procurement. Corporates stay for a second reason that has little to do with features: the chain of evidence hangs off whichever vendor produced the signature. Long-term contracts get challenged years later, and anyone who has switched vendors has to assemble the audit trail from two sources. That inertia is a matter of caution here rather than habit.

### Buying the signature from a European trust service

Anyone who mainly needs the qualified signature can buy it directly in Europe, for instance from Skribble in Switzerland or Yousign in France, both billing per signature rather than per user seat. For the analysis layer above it, Ironclad is a counterpart that treats the contract as a data record rather than a document. What you give up is the bundling: signature, storage, analysis and audit trail then sit with two or three vendors, each with its own contract, its own data processing agreement and its own seam in between. The prices of those vendors deserve checking first-hand before deciding, because they behave differently with signature volume than a per-seat price does.

### Building the flow yourself and buying in the signature

Building the signing flow yourself is feasible; producing the qualified signature yourself is not. It may only come from a qualified trust service provider, in Germany for instance D-Trust with sign-me, in Switzerland from Swisscom Trust Services. What remains is the flow around it, and that is manageable: sign-in through Ory, delivery through Cloudflare Pages, keys and access in Infisical, built with Claude Code. Two to three person-days to the first signature is realistic for the simple case. The bill arrives afterwards, from the evidence. An audit trail that holds up in court has to be complete, tamper-evident and readable for years, even after the database has moved three times. That is where self-building fails, and it fails late: the defect only shows up in the single dispute where the signature is contested.

Recommendation by size:

- Solo: Take Personal, and first work out how often a qualified signature is genuinely required.
- Mid-market: Buy, but check the envelope allowance before the plan.
- Enterprise: Buy, and before signing switch off AI training and settle the data export route in writing.

## Context

- Implements method: [MEDDIC / MEDDPICC](https://www.convios.com/en/methods/meddpicc) — The method treats the paper process as a checkpoint of its own alongside the decision process, because deals routinely stall there, and the signing flow is where that checkpoint becomes observable at all.
- Implements method: [Bowtie Funnel / Revenue Architecture](https://www.convios.com/en/methods/bowtie-funnel) — The method places commitment as the measurable handover between the two halves, and the signature with its timestamp is the one record of it that does not have to be estimated.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The method asks how much regulation a market carries and who earns from it; the tiers of the eIDAS regulation are a case in point, because the highest tier is tied to a state-supervised authorisation and therefore cannot be competed away.
- Displaces: Print, sign, scan, send back, Posting contract copies for countersignature, Chasing by hand who has not signed yet

## Evidence

- Legal entity, address, managing director, register court Amtsgericht Frankfurt am Main, HRB 111200 and VAT identification number of the German entity — https://www.docusign.com/de-de/unternehmen/impressum (as of 2026-08-11)
- Registration of Docusign Germany GmbH on 12 March 2018, former name mertus 416. GmbH, share capital of 25,000 euros and filed annual accounts up to the financial year ending 31 January 2025 — https://www.northdata.com/DocuSign+Germany+GmbH,+M%C3%BCnchen/Amtsgericht+Frankfurt+am+Main+HRB+111200 (as of 2026-08-11)
- Data processing agreement in German dated 1 December 2022, order of precedence of documents, incorporation of the standard contractual clauses under Decision (EU) 2021/914, thirty days notice for new subprocessors, and the exclusion of bulk retrieval on termination in clause 10 — https://www.docusign.com/legal/terms-and-conditions/data-protection-attachment/germany (as of 2026-08-11)
- AI attachment dated 8 July 2026: allocation of training consent by product and contract type, the 8 July 2026 cut-off for eSignature licences bought through the website, perpetual and irrevocable licence, survival beyond contract end, and an opt-out effective going forward — https://www.docusign.com/legal/terms-and-conditions/ai-attachment-docusign-services/germany (as of 2026-08-11)
- Indefinite retention of transaction data beyond the subscription and the statement that it can neither be deleted nor exported even at the customer request, plus the content and purpose of the Certificate of Completion — https://www.docusign.com/trust/security/transaction-data-use (as of 2026-08-11)
- Five data centre regions, availability of the European region for eSignature, IAM and CLM, fixed at account provisioning, and the named data that leaves the region by design, page dated 14 April 2026 — https://www.docusign.com/privacy/data-residency (as of 2026-08-11)
- Public subprocessor list with purpose and country, group entities with countries, ANSSI supervision of Docusign France SAS as qualified trust service provider, and a subscription for changes — https://www.docusign.com/trust/privacy/subprocessors-list (as of 2026-08-11)
- Announcement of 5 August 2026 naming the AI suppliers Microsoft Azure AI Services, Google Vertex AI and DocuSmart, Inc. dba Lexion, and the addition of Sierra Technologies, Inc. for an in-product support chat — https://www.docusign.com/trust/alerts/update-subprocessor-list-for-docusign-services-august-5-2026 (as of 2026-08-11)
- Attestations with standard and version, among them ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, C5 Type II from the German Federal Office for Information Security, SOC 1 and SOC 2 Type II, and PCI DSS 4.0, plus approval of the Binding Corporate Rules on 16 March 2018 in both roles — https://www.docusign.com/trust/compliance/certifications (as of 2026-08-11)
- Plan prices of 9, 23 and 38 euros, envelope allowances of five per month and 100 per user per year, the qualified signature as an add-on at 10 euros per recipient, and the allocation of SSO, advanced signature and custom limits to the quoted tier — https://ecom.docusign.com/de-DE/plans-and-pricing/esignature (as of 2026-08-11)
- Quarterly announcement of 4 June 2026 with revenue of 830.2 million US dollars, up 9 per cent, free cash flow of 289.4 million US dollars, share repurchases of 317.5 million US dollars, and close to 1.9 million customers — https://investor.docusign.com/news-and-events/press-releases/news-details/2026/Docusign-Announces-First-Quarter-Fiscal-2027-Financial-Results/default.aspx (as of 2026-08-11)
- Partnership with D-Trust of the Bundesdruckerei group for the qualified electronic signature in Germany since 2018, and an explanation of the role of a qualified trust service provider — https://www.docusign.com/de-de/fallstudien/partnerschaft-d-trust-und-docusign (as of 2026-08-11)
- The vendor commentary on the AI regulation with risk tiers and deadlines as of 2024, without any statement on the Article 50 transparency duties for its own AI layer — https://www.docusign.com/de-de/blog/navigieren-durch-die-ki-regulierungslandschaft-was-der-eu-ai-act-eu-gesetz (as of 2026-08-11)