{
  "slug": "dropbox-sign",
  "category": "e-signatures",
  "name": "Dropbox Sign",
  "description": "Electronic signature service from Dropbox, formerly HelloSign, for sending and signing documents online, with an API for adding signatures to other apps.",
  "website": "https://sign.dropbox.com",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "D",
  "score": 50,
  "coverage": 100,
  "summary": "Dropbox Sign scores 50 out of 100 (grade D) on the electronic signatures criteria. It meets 4 of 8 criteria: transparency report, tells users about requests, TLS configuration and security headers. It partly meets no ads or data sales and independent audit. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A.",
  "url": "https://privacyratings.com/e-signatures/dropbox-sign/",
  "markdown": "https://privacyratings.com/e-signatures/dropbox-sign/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://sign.dropbox.com/about/privacy",
      "note": "Uses Google Analytics, Heap and Google advertising features such as remarketing."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://sign.dropbox.com/about/privacy",
      "note": "Funded by subscriptions. The privacy policy states that information is not sold, although the website uses remarketing to advertise Dropbox Sign."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://trust.dropbox.com/",
      "note": "Dropbox Sign has SOC 2 Type II and ISO 27001 audits. The reports are only available on request."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://help.dropbox.com/transparency",
      "note": "Dropbox publishes counts of government requests for user data. The report does not list Dropbox Sign separately."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://help.dropbox.com/transparency",
      "note": "Dropbox states that it gives users notice of government requests for their information unless a non-disclosure order prohibits it."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=app.hellosign.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=app.hellosign.com",
      "note": "Grade A (95/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "A",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Google DoubleClick",
        "host": "pubads.g.doubleclick.net",
        "effect": "no"
      }
    ],
    "tested_at": "2026-10-01T06:38:55.346Z"
  },
  "last_modified": "2026-10-01T06:56:31Z"
}