Dropbox Sign vs Zoho Sign

Dropbox Sign

The vendor documents Advanced and Qualified signatures as eIDAS levels delivered through named qualified trust service providers — InfoCert behind the advanced level, Danish Mit-ID, Belgian eID, Finnish eID and EvroTrust for qualified, and Swisscom acknowledged under ZertES — and names the plan and add-on that carry them, with the countries each method covers. We found no public information on an EU Trust List entry link, qualified electronic seals, or the signature level shown in the signed document and its audit trail, so the chain from provider to evidence is not closed.

Zoho Sign

Qualified electronic signatures issued by a qualified trust service provider are documented for the Enterprise plan, with AATL-capable certificates on Standard and Zoho digital certificates on the free tier. We found no public information naming the trust service provider, its entry on the EU Trust List, a distinction of simple and advanced levels, or guidance on which documents need which level — and for a qualified signature I need to know whose conformity assessment stands behind it.

Dropbox Sign

Ordinary requests are authenticated by an SMS code the signer must enter, and the eID add-on identifies signers through named national schemes — Danish Mit-ID, Belgian eID, Finnish eID, EvroTrust with a long list of accepted ID documents — with InfoCert issuing the personal certificates. Who performs each identification, where the ID data is stored and how long it is kept are questions we found no public information on, while the audit trail keeps each signer's IP address with no stated retention period of its own. As identity proof this is real; as a privacy chain it is half documented.

Zoho Sign

Recipient authentication with SMS delivery and account-free signing are documented, and the qualified signature is described as issued only after the signer's identity has been verified. We found no public information on who performs that identification, by which method such as video ident, eID card or bank ident, in which countries, or what happens to the signer's ID data afterwards — the entire identity chain handed to a provider the signer never chose is undocumented.

Dropbox Sign

Templates with signer roles and field placement, decline to sign, signer reassignment, variable signers and bulk requests with per-signer reminders are all documented, and recipients sign without an account and at no cost. We found no public information on parallel versus sequential signing order, conditional fields, signer languages or signer accessibility.

Zoho Sign

Reusable templates, a definable signing order, bulk sending, automatic reminders, status tracking with notifications, custom roles and permissions, approval workflows, custom branding, mobile and desktop apps, and self-service signing links through SignForms are all documented. We found no public information on delegation or substitute signers, conditional fields, or signer accessibility.

Dropbox Sign

Every executed request carries an appended audit trail — deliverable as a separate file — recording timestamps and IP address from submission to completion, backed by a PDF hash comparison and a transaction-log lookup the vendor promises to assist with. Beyond that the pages are silent on long-term validation, qualified timestamps, a validation report and any retention period for the evidence; the terms commit only that customer access ceases and data may be deleted thirty days after termination.

Zoho Sign

Audit trails, document timestamps and a blockchain timestamp as an additional verification measure are published, and signed documents can be exported; account data is deleted from the active database within six months of cancellation and from backups three months later, so the evidence is not built to outlive the customer relationship. We found no public information on what the audit trail records — including IP addresses and authentication events — on long-term validation such as PAdES-LTV, or on a named qualified timestamp provider.

Dropbox Sign

A documented API with events and callbacks, official SDK libraries, walkthroughs and a free test mode sits alongside embedded signing that runs the signer's experience inside the customer's own application through an iFrame, with a dedicated testing tool, text tags and a single API parameter to switch on the eID levels. Google Drive, Microsoft Word, HubSpot and Dropbox are the named connectors; we found no public information on published rate limits, API versioning, or DMS, ERP and HR connectors.

Zoho Sign

A REST API for signing and document management automation, webhooks, web and mobile SDKs, an API-only plan, white-label and personalised domain options, and signing from the customer's own apps or websites are documented. Integrations with Zoho and third-party apps are claimed, but we found no public information naming individual connectors such as Microsoft 365, Google Workspace or a CRM, nor on a sandbox, API versioning or rate limits.

Dropbox Sign

Customers outside the US, Canada and Mexico contract with Dropbox International Unlimited Company, a data processing agreement and a subprocessor list are published, and the eID chain runs through InfoCert, a qualified trust service provider in the EU. We found no public information on where documents, audit trails and ID data are stored, while the terms expressly permit Dropbox and its subcontractors to store customer data in locations other than the customer's country, with transfers resting on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses — the chain is anchored in Ireland and undocumented after that.

Zoho Sign

The German pages state that data is stored in a data centre within the EU, a data protection officer is reachable at Zoho Corporation BV in Utrecht, and a GDPR-conform data processing addendum is available on request. The captured pages give different statements on where data ends up — the privacy policy describes processing in the USA, the EEA and other countries where Zoho operates, with the data centre assigned by the customer's region at signup — and the contracting company is Zoho Corporation Pvt. Ltd. of Chennai, India. We found no public information on the trust service or identification providers, or on subprocessor locations beyond push notification services.

Dropbox Sign

The Standard plan is public at €24 EUR / user / mo with "Starting at €576 EUR billed yearly", a free plan and a 30-day trial exist, signature requests are unlimited on the paid tiers, and the terms spell out automatic renewal, an automatic paid upgrade when limits are exceeded, and a thirty-day non-renewal notice. The eID add-on is sold only by contacting the account manager, and we found no public per-signature price for advanced or qualified signatures, nor prices for the other plans on the captured pages.

Zoho Sign

Envelope limits and feature lists per plan are public — five per month free, twenty-five per user per month on Standard, unlimited envelopes on Professional — alongside a credit add-on at €0,10 in increments of 500, a 20% annual saving, VAT charged in addition, and volume discounts and OEM pricing on request. We found no public euro amount for the main plans themselves, so a buyer cannot compute the cost of their signing volume from the captured pages.