Bona Fide Sub-processors
Effective date: 19 October 2026 · Last updated: 19 October 2026
The Republic US LLC (“Bona Fide”) uses the sub-processors below to provide the Services. They process Customer Personal Data only on our instructions, under written data protection terms. We announce new sub-processors at least 30 days in advance by updating this page and notifying workspace owners by email, as described in Section 7 of the Data Processing Addendum.
Infrastructure operated by Bona Fide
The API, background worker, PDF converter (Gotenberg), sealer and the PostgreSQL database (accounts, envelopes, audit trail) run in a dedicated Kubernetes cluster that we operate. The Republic US LLC operates this cluster itself; it is not a sub-processor.
Sub-processors that process Customer Personal Data
| Sub-processor | Service and purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. (USA) | Content delivery network, TLS termination and proxy for all bonafidesign.com hosts; WAF and rate limiting; Turnstile bot checks on sign-up and sign-in; hosting of the website, dashboard, hosted signing page and documentation (Cloudflare Workers); R2 object storage for documents, sealed PDFs and exports | All traffic in transit (including documents and signer data); stored documents | Global edge network (traffic is handled at the Cloudflare data center closest to the user); documents at rest in Cloudflare R2 object storage | Standard Contractual Clauses |
| Microsoft Corporation (USA) | Azure Communication Services: sending envelope invitations, reminders, one-time codes and completion emails from mail.bonafidesign.com; delivery and bounce events | Recipient names and email addresses, sender name, envelope title and message, links, one-time codes | United States (Azure Communication Services data location “United States”) | Standard Contractual Clauses |
| Telnyx LLC (USA) | Telnyx Cloud Storage: encrypted off-site database backups (physical backups and WAL, point-in-time restore) | Encrypted copy of the database (all database records) | United States (us-central-1) | Standard Contractual Clauses; data encrypted with age before upload, keys held by Bona Fide |
| Stripe, Inc. (USA) | Billing, subscriptions, invoices, payment processing, Stripe Tax | Customer billing contacts, workspace ID, usage quantities; Stripe also acts as an independent controller for payment data | United States and other Stripe locations | Standard Contractual Clauses |
Third parties that receive no personal data
| Party | What they receive | Why |
|---|---|---|
| DigiCert, Inc., Sectigo Limited, SSL.com (public RFC 3161 timestamp authorities, used in that order with failover) | A SHA-256 hash of the document only; OCSP/CRL requests about their own certificates | Trusted timestamp in the sealed PDF (PAdES) |
| Have I Been Pwned (Pwned Passwords range API) | First five characters of the SHA-1 hash of a new password | Reject breached passwords (k-anonymity: no password, email or account data is sent) |
| Public anchor log (operated by Bona Fide) | Hourly Merkle roots over completed-envelope fingerprints | Public, tamper-evident record |
Optional services the user chooses (independent controllers)
| Provider | When | Data |
|---|---|---|
| Google LLC | A user chooses “Sign in with Google” | OAuth identity (name, email, account ID) |
| Microsoft Corporation (Entra ID) | A user chooses “Sign in with Microsoft” | OAuth identity |
| The customer’s own SSO identity provider | Workspace SSO / SCIM | Identity and provisioning data, under the customer’s control |
Planned services
The following add-ons are not yet offered, and no provider processes Customer Personal Data for them. We will update this list before launch, with the notice described above.
| Planned add-on | Status |
|---|---|
| SMS one-time codes | Not yet offered; we will update this list before launch |
| ID verification | Not yet offered; we will update this list before launch |
| EU qualified electronic signatures | Not yet offered; we will update this list before launch |
Published in English, which is the governing version. Questions: contact@bonafidesign.com. The Republic US LLC, 16192 Coastal Highway, Lewes, Delaware 19958, USA · +1 302 984 7474