Question 1

Is EndorsedSign HIPAA compliant?

Accepted Answer

EndorsedSign offers a HIPAA profile and a path to execute a Business Associate Agreement for covered entities and business associates. The HIPAA profile enables PHI-safe notifications, two-person deletion confirmation, and extended retention. You must execute the BAA and enable the HIPAA profile before using EndorsedSign for PHI-containing workflows. EndorsedSign is a business associate — not a covered entity. There is no HIPAA certificate for a software vendor to hold.

Question 2

How does EndorsedSign handle GDPR?

Accepted Answer

EndorsedSign processes personal data as a processor. Subject-access export and erasure tooling is live for all tenants, and EU data residency is available for eligible plans and regulated workflows.

Question 3

Does EndorsedSign hold a SOC 2 report?

Accepted Answer

Yes. EndorsedSign maintains a SOC 2 certification report and shares evidence through standard procurement and security review channels.

Question 4

Are EndorsedSign signatures legally binding?

Accepted Answer

Simple electronic signatures are recognised under ESIGN (US), UETA (US states), and eIDAS SES (EU) for most commercial agreements. Qualified signatures are also supported where regulations require them for specific jurisdictions or document classes.

Question 5

What is the difference between the HIPAA profile and HIPAA-safe practices?

Accepted Answer

The HIPAA profile is a set of product-enforced controls: notification content restricted to links only, two-person deletion gate, and extended audit retention. These are product constraints, not guidelines. An executed BAA creates the legal relationship between a covered entity and its business associate. The public BAA page is a draft, not that executed agreement.

Capability	Detail
HIPAA profile	PHI-safe notification content (links only), two-person deletion gate, extended retention settings; enabled per tenant
Business Associate Agreement (BAA)	Public text is a draft awaiting counsel review. Execution is by countersignature with us — the public page is not the contract.
GDPR subject-access export	Export all data for a data subject on request; output as structured JSON
GDPR erasure	Delete all records for a data subject; audit event recorded for the deletion
Retention settings per tenant	Configure document lifecycle: how long completed, declined, and expired envelopes are retained before deletion eligibility
Disclosure consent text	Configurable text shown to signers before they begin; acceptance is an audit event
Certificate of completion	Generated per completed envelope; includes signing event summary, signer identities, document hash
Append-only hash-chained audit trail	Every signing and administrative event recorded; chain is detectable if tampered
Data Processing Addendum (DPA)	Public text is a draft awaiting counsel review. Not an offer and not executable from this site.

Item	Status	Notes
Qualified electronic signatures (QES)	✅ Live	Enabled for supported jurisdictions and compliance profiles
EU data residency	✅ Live	Available for tenants that require EU-regional processing and storage
SAML SSO	✅ Live	Enterprise identity provider integration beyond OIDC
SOC 2 certification	✅ Live	Report available through procurement and security review
eIDAS advanced / qualified signature profiles	✅ Live	Configurable per regulated workflow and jurisdiction

Compliance

Compliance capabilities — live today

Regional and enterprise capabilities

Compliance questions