1. How to read this schedule
Orbis Sign is a service of Orbis Digital Ltd (the Provider, Orbis, we or us). The person or organisation buying or using the Service is the Customer. A person invited to sign is a Signer.
Orbis Digital LtdCompany number 17116737
Registered in England and Wales
Registered office: 66 Paul Street, London, EC2A 4NA, United Kingdom
This schedule distinguishes the configured deployment provider from integrations that process data only when their feature is enabled. The presence of an available integration does not mean it is enabled for every Customer. Supplier terms and linked official lists may change, so Customers should consult the current links as well as this schedule.
2. Providers and conditional services
| Provider or service | Function | Data involved | Official information |
|---|---|---|---|
| Replit | Deployment and PostgreSQL-backed infrastructure. | Service data, documents, logs, sessions and account data handled by the deployed application. | DPA and subprocessor list. |
| Brevo (Sendinblue SAS) | Transactional email, one-time codes, contact enquiries and delivery/open/click/bounce webhooks where global or Customer email transport is configured. | Names, email addresses, document titles, signing links, message content, codes, completed-PDF and audit-certificate attachments where sent, and message telemetry. | legal terms and privacy information. |
| VoodooSMS | SMS signing links, one-time codes and reminders where Customer SMS transport is configured. | Telephone number, recipient name, document title, signing link, code and delivery reference. | The applicable supplier terms and privacy information govern when the integration is enabled. |
| Stripe | Hosted payment and subscription administration where Stripe is used for the Customer. | Customer/subscription identifiers, contact and billing data, and payment status. Stripe, not Orbis Sign, handles payment credentials in its hosted systems. | Stripe Privacy Center. |
3. Data-protection roles
Replit acts as a processor or subprocessor for the infrastructure function described above. Brevo and VoodooSMS do so only when the relevant transport is configured. Where Stripe is used, Stripe may act as Orbis's processor for billing administration and as an independent controller for payment processing, fraud prevention and legal obligations under its own terms.
4. Locations and transfers
These providers may process data outside the United Kingdom or use onward subprocessors in other countries. Where Orbis makes a restricted transfer as controller or processor, it will use an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with the assessment and supplementary measures required by law. Supplier DPAs and current subprocessor lists provide provider-level detail. Orbis does not promise UK-only processing.
5. Customer information
For an existing Customer, its signed Agreement and any customer-specific schedule prevail. Prospective and existing Customers can ask through the contact form or at for available supplier and transfer information relevant to their assessment.
6. Changes and enquiries
Orbis may add or replace a provider as the Service changes. Where the DPA requires notice or an opportunity to object, Orbis will provide it before the new provider processes Customer personal data. A reasonable objection must relate to data-protection risk; the parties will work in good faith on a commercially reasonable solution. Published changes will be versioned. Submit questions through the contact form or at .