Vendor & Sub-processor Management Policy

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: Robert — Security Lead + [Legal]

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Establish how Touch2Sign assesses, engages, monitors, and offboards third-party vendors and GDPR sub-processors that process personal data or provide critical infrastructure for the eSignature and eWitness platform.

2. Scope

Applies to all vendors that:

• Process personal data on behalf of Touch2Sign customers (sub-processors under GDPR Art 28)
• Host or transmit Touch2Sign production data
• Provide identity verification, payments, AI, email, or other integrated services

3. Roles

Role	Responsibility
Legal	DPA negotiation; SCCs; customer sub-processor notifications
Security Lead	Security assessment; risk rating; annual review
DPO	DPIA for high-risk processors; transfer impact assessments
Engineering Lead	Technical integration review; data minimisation
CEO	Approval for high-risk or new category vendors

4. Vendor assessment process

4.1 Pre-engagement checklist

Before integrating a new vendor or sub-processor:

• [ ] Business purpose and data categories documented
• [ ] Processing location(s) identified (EU, UK, US, other)
• [ ] DPA or equivalent signed (GDPR Art 28 clauses)
• [ ] SCCs, UK IDTA, or adequacy decision for non-EEA transfers
• [ ] SOC 2 Type II and/or ISO 27001 certificate requested and filed
• [ ] Security questionnaire completed (CAIQ, SIG Lite, or vendor-specific)
• [ ] Incident notification commitment (≤ 72 hours)
• [ ] Data return / deletion on termination confirmed
• [ ] Sub-processor listed in Sub-processor Register (docs/compliance/SUB_PROCESSORS.md)
• [ ] Customer notification plan if material sub-processor (DPA §5 — 30 days notice)

4.2 Risk rating

Rating	Criteria	Approval
Low	EU-hosted; certified; limited data	Security Lead
Medium	Non-EU with SCCs; IDV or payments	Security Lead + Legal
High	Biometric, AI document content, US transfer of customer docs	CEO + DPIA

5. Key sub-processors

The following vendors are approved for use subject to ongoing review. Full detail in Sub-processor Register.

Vendor	Purpose	Location	Key safeguards	Review
Amazon Web Services	Hosting — S3, RDS, Cognito, SES, CloudWatch, App Runner	EU (Ireland) eu-west-1	AWS DPA, SCCs; SOC 2, ISO 27001	Annual
Stripe	Payment processing, subscriptions	US/EU	Stripe DPA, SCCs; PCI DSS	Annual
OneID Limited	UK bank identity verification (AES)	UK	DPA with OneID; adequacy / safeguards	Annual
eID Easy / Dokobit	QES signing and EU identity (QTSP)	EU (LT/EE)	eIDAS QTSP audit; DPA	Annual
Anthropic	Document Q&A (Aria AI)	USA	SCCs; data minimisation; DPIA required	Semi-annual

Additional processors (Veriff, Signicat, Adyen, AWS Bedrock, etc.) require assessment before production use and entry in the register.

6. SOC reports and certifications

Requirement	Action
SOC 2 Type II	Request annually; review bridge letter if gap period
ISO 27001	Accept certificate + scope statement
PCI DSS	Required for payment processors (Stripe)
eIDAS / QTSP	Required for eID Easy QES reliance
Gap remediation	Vendor must respond to critical findings before go-live

Reports stored in secure GRC folder — not in public repository.

7. Sub-processor register maintenance

• Register maintained in docs/compliance/SUB_PROCESSORS.md
• Reviewed quarterly by Security Lead and Legal
• Published summary available to customers via DPA §5
• Changes communicated 30 days before new sub-processor processing (unless emergency with DPA carve-out)

7.1 Customer notification template

```

Subject: Touch2Sign sub-processor update

We are adding [VENDOR] for [PURPOSE]. Processing occurs in [LOCATION].

Safeguards: [SCCs/DPA]. Effective date: [DATE+30d].

Objection period: 30 days per DPA §5.

Contact: legal@touch2sign.com

```

8. Ongoing monitoring

Activity	Frequency
Certificate / SOC report renewal	Annual
Security news and breach monitoring	Continuous
Re-assessment after vendor incident	As needed
Contract renewal review	At renewal
DPIA refresh (high-risk vendors)	Annual or on scope change

Vendor incidents affecting Touch2Sign data: follow Incident Response Plan §7.2 (IDV provider incident playbook).

9. Offboarding

When terminating a vendor:

1. Revoke API keys and IAM cross-account access
2. Confirm data deletion or return per DPA
3. Obtain deletion certificate where available
4. Remove from Sub-processor Register
5. Notify customers if sub-processor change affects their data
6. Update privacy policy and DPA annex if published list changes

10. Prohibited engagements

Without CEO and Legal approval:

• Vendors in sanctioned jurisdictions
• Processors refusing DPA or adequate transfer mechanism
• Storage of customer documents in uncertified consumer cloud tools
• Sharing production database access with vendor support without time-limited credentials

11. Related documents

• Sub-processor Register (SUB_PROCESSORS.md)
• Data Processing Agreement
• Information Security Policy
• Incident Response Plan
• Risk Management Policy

12. Review

Reviewed annually and when adding or removing material sub-processors.

---

Approval

Name	Role	Signature	Date
Robert	CEO / Security Lead	Electronic	11 July 2026
	Legal