E-Signature
Dropbox Sign
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Dropbox, Inc. · sign.dropbox.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Dropbox Sign at a glance
- Vendor
- Dropbox, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates Dropbox Sign 2.5/5, the mean of 6 judges. Dropbox Sign, the e-signature service of Dropbox, Inc. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Dropbox Sign, the e-signature service of Dropbox, Inc. of San Francisco, scores highest on signing workflow (6) and integration and API: templates, bulk sending with per-signer reminders, decline to sign, signer reassignment, variable signers and account-free signing are evidenced, and the API brings documented endpoints, SDK libraries, free test mode and embedded signing in an iFrame. Advanced and qualified signatures sit behind a purchased eID add-on on the API Premium plan. Its weakest criteria are sovereignty and pricing transparency. EU customers contract with Dropbox International Unlimited Company in Dublin, yet data residency is not confirmed on the vendor's captured pages, and we found no public information on where documents, audit trails or identity data are stored, or on a subprocessor list. Pricing transparency is the one flagged disagreement: tier names, 'Unlimited signature requests' and a sender definition are public, but no plan figures were captured and the eID add-on is 'contact sales for details', so a qualified signature's cost is not computable — judges differ on how far the published tier structure offsets the missing figures.
Speaks for it
- Signing workflow scored 6, evidenced by custom templates with field placement, bulk sending with per-signer reminder targeting, decline to sign, signer reassignment and variable signers
- Integration and API scored 6-7, with documented endpoints, official SDK libraries, free test mode, events and callbacks, and embedded signing in an iFrame
- Qualified electronic signatures run through named providers — Belgian eID, Finnish eID, EvroTrust, and Swisscom as QES under ZertES — with InfoCert named as an EU qualified trust service provider
- Signers need no Dropbox Sign account and pay nothing to sign a document
- The audit trail is appended to every executed request, tracks timestamps and IP addresses from submission to completion, and a stored PDF hash supports tamper checks
Held against it
- Sovereignty scored 2-3; data residency is not confirmed on the vendor's captured pages, and we found no public information on where documents, audit trails or identity data are stored, or on a subprocessor list
- No price figures for the Essentials, Standard or Premium plans appear in the captured pages, and the eID add-on is 'contact sales for details', so a qualified signature's cost is not computable from public pages
- Advanced and qualified levels are gated behind the API Premium plan plus a purchased eID add-on, with certificates issued by InfoCert and Swisscom rather than a Dropbox trust service
- Retention is stated only as 'as long as necessary', with no stated period for signed documents or their evidence, and we found no public information on qualified timestamps or long-term validation
- We found no public information on sequential versus parallel signing order, automatic reminders, document expiry, signer languages or accessibility
Best for
- You need to embed signing inside your own application, backed by a documented API, SDK libraries, free test mode and iFrame embedded signing
- Your team sends high volumes of routine documents — contracts, NDAs, onboarding forms, purchase orders — where bulk sending, targeted reminders and account-free signers cover the cycle
- You need qualified electronic signatures from named providers and are prepared to buy the API Premium plan plus the eID add-on
- Your documents need signatures legally binding in the United States, European Union or United Kingdom without the qualified levels
Avoid if
- You need a firm total cost, including what a qualified signature costs, before committing — no plan figures are public and the eID add-on is 'contact sales for details'
- Your procurement must see documented data residency, ownership and subprocessors — sovereignty scored 2-3, and those attributes are unconfirmed on the vendor's captured pages
- Your signed evidence must validate independently years later — tamper checks rely on a transaction-log lookup only the vendor can run, and we found no public information on qualified timestamps or long-term validation
The scores
| Criterion | Panel median |
|---|---|
| eIDAS levels & trust services | 2.5 of 5 |
| Signer identification | 3 of 5 |
| Signing workflow & signer experience | 3 of 5 |
| Evidence, validation & retention | 2 of 5 |
| Integrations & API | 3.5 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 1.5 of 5 |
eIDAS levels & trust services
Show reasoningHide reasoning
How this is scored
Which signature levels the platform offers — simple, advanced, qualified, and qualified seals — through which qualified trust service provider on the EU Trust List, for which countries and legal regimes (eIDAS, ZertES), and on which plans.
0 — No signature level named; the platform calls its signature "legally binding" without saying which kind it is.
3 — Simple signatures by default with "advanced" or "qualified" mentioned as available, but no trust service provider named and no statement on which plan or country offers which level.
5 — SES, AdES and QES offered and labelled in the product, the qualified trust service provider named, and which documents need which level explained for at least Germany or the EU.
8 — Every level documented with the plans and countries it is available in, the QTSP's entry on the EU Trust List linked, QES under eIDAS (and ZertES where relevant) stated, qualified electronic seals for company documents, and the signature level printed in the signed document and audit trail.
10 — Levels are an explicit product decision: the provider is or contracts a named QTSP with its conformity assessment published, level selection per document type or template, remote QES without a separate account, EUDI wallet support stated with a date, and the legal effect per level documented for the main EU markets.
The Legal Counsel
Advanced and qualified signatures are labelled with countries and providers through the eID add-on on the API Premium plan — Danish Mit-ID for AES via InfoCert, Finnish and Belgian eID and EvroTrust for QES, and Swisscom stated as QES under ZertES — with InfoCert named as an EU qualified trust service provider. The default signature is only called 'legally binding under the ESIGN Act of 2000' with no level named. We found no public information on an EU Trust List link, qualified electronic seals, the signature level printed in the signed document and audit trail, or guidance on which document needs which level for Germany or the EU. 6 2
The HR Operations Lead
Qualified signatures are labelled and real — Belgian eID, Finnish eID, EvroTrust and Swisscom (per ZertES), with InfoCert named as the EU trust service provider and the eID add-on tied to the API Premium plan — but we found no public statement labelling the standard signature as simple or advanced, and no guidance on which documents need which level in Germany or the wider EU. The pricing page instead frames legality through the US ESIGN Act. 6 2
The Revenue Operations Lead
Advanced and qualified signatures are labelled by country and provider — Danish Mit-ID as AES through InfoCert, Finnish and Belgian eID and EvroTrust as QES, Swisscom as QES under ZertES — with InfoCert named as an EU qualified trust service provider and the eID option tied to the API Premium add-on. I found no public information on simple signatures being labelled, on which level applies to which document type, or on an EU Trust List entry or qualified seals, so this sits between naming levels and mapping them fully. 6 2
The Integration Engineer
Advanced and qualified levels are labelled with countries and providers — AES through Danish Mit-ID, QES through Finnish eID, Belgian eID and EvroTrust, with Swisscom stated as QES under ZertES — and InfoCert is named as the EU qualified trust service provider behind some methods, gated behind the API Premium plan plus a purchased eID add-on. We found no public information explaining which documents need which level for Germany or the EU, on qualified electronic seals, or on the trust service provider's EU Trust List entry. The captured pages also do not show a simple-signature level labelled as such. 6 2
The Data Protection Officer
Qualified and advanced signatures arrive through a separate eID add-on on the API Premium plan, with InfoCert named as an EU qualified trust service provider and per-country methods listed (Belgian and Finnish eID, EvroTrust, Danish Mit-ID for advanced, Swisscom qualified under ZertES); the base product is marketed as legally binding under the US ESIGN Act with no level label. We found no public information on which documents need which level for Germany or the EU, on qualified seals, on the provider's EU Trust List entry, or on the signature level being printed in the signed document and audit trail. 6 2
The Skeptic
The default product signs under the ESIGN Act of 2000 with a non-editable audit trail — a legally binding simple signature — while advanced and qualified levels sit in a paid eID add-on on the API Premium plan, with certificates from InfoCert, a QTSP Dropbox does not operate itself. The eID article does label AES and QES per provider and country (Danish Mit-ID, Finnish eID, Belgian eID, EvroTrust) and names Swisscom as QES under ZertES, but we found no public information on which documents need which level for Germany or the EU, no link to the EU Trust List entry, and nothing on qualified seals or the signature level printed in the signed document. 2 6
Signer identification
Show reasoningHide reasoning
How this is scored
How the signer is identified for each level: email and SMS codes, video ident, eID card (Online-Ausweis), bank ident or EUDI wallet — who performs it, in which countries it works, and what happens to the ID data afterwards.
0 — Email link only; no statement on how signers are authenticated.
3 — Email plus SMS or access code, with "ID verification" mentioned as an add-on but no methods, provider or countries named.
5 — Identification methods for AdES and QES listed by name (for example video ident, eID, bank ident), the identification provider named, and the countries or ID documents they accept stated.
8 — Methods documented per level and country, automated and agent-based ident distinguished, reuse of an identification for later signatures explained, retention and deletion of ID data stated, and the ident provider listed as subprocessor.
10 — Identification is transparent end to end: every method with its countries, assurance level and failure rate or completion guidance, EUDI wallet and national eID supported, ID data minimisation and retention committed, and the signer-facing privacy notice published.
The Legal Counsel
Methods are named by level and country — Danish Mit-ID for AES, Finnish and Belgian eID and EvroTrust for QES, the latter accepting ID documents from a long list of countries — with InfoCert named as the personal-certificate issuer, and SMS verification with code entry and resend is documented for Standard and Premium API plans. The privacy policy promises deletion or anonymisation once no business need remains. We found no public information distinguishing automated from agent-based identification, on reuse of an identification for later signatures, on retention specific to ID data, or on the identification provider appearing on a subprocessor list. 6 7 3
The HR Operations Lead
The eID methods and who performs them are named — national eIDs plus InfoCert and EvroTrust, with the list of countries whose identity documents EvroTrust accepts, which covers the IDs my applicants actually hold — and SMS codes are documented for basic authentication. What happens to ID data afterwards is only a generic "as long as necessary" retention line, and we found no public information on reuse of an identification or the identification provider as a named subprocessor. 6 7 3
The Revenue Operations Lead
Identification methods for qualified flows are named with countries and accepted identity documents — Mit-ID, Finnish and Belgian eID, EvroTrust — and InfoCert is named as the certificate issuer, with SMS verification codes documented for request access including resend behaviour. I found no public information on automated versus agent-based identification, on reuse of an identification for later signatures, or on retention and deletion specific to ID data, and the identification provider does not appear in any published subprocessor listing. 6 7 3
The Integration Engineer
Methods for the higher levels are named with their countries and accepted identity documents — Belgian eID, Danish Mit-ID, Finnish eID, EvroTrust — and InfoCert is named as issuing the personal certificates; SMS codes gate access to requests on Standard and Premium API plans. We found no public information distinguishing automated from agent-based identification, on reusing an identification for later signatures, or on retention and deletion specific to ID data beyond the generic privacy-policy wording, and no subprocessor list placing the identification provider in that chain. 6 7 3
The Data Protection Officer
Methods for advanced and qualified signatures are named by country with the certificate issuer InfoCert disclosed, EvroTrust's accepted identity documents listed, and SMS codes documented for API plans. What matters most to me is the fate of the identity data: we found no public information on retention or deletion of ID data after signing, on reuse of an identification, or on identification providers appearing in a subprocessor list. 6 7 2
The Skeptic
Methods are listed by name with their AES or QES type and country — Danish Mit-ID, Finnish eID, Belgian eID, EvroTrust with a long list of accepted identity-document countries — InfoCert is named as the certificate issuer, and SMS codes gate access on Standard and Premium API plans. We found no public information on video or bank identification, on retention or deletion of identification data specifically, or on the identification provider appearing in a published subprocessor list. 6 7 3
Signing workflow & signer experience
Show reasoningHide reasoning
How this is scored
Getting a document out and back signed: templates and form fields, signing order and roles, bulk sending, reminders and delegation, signing without an account or app, mobile signing, and accessibility for signers.
0 — Single-recipient signing of an uploaded PDF; no templates, order or reminders.
3 — Multiple signers and basic templates, but no signing order, no bulk send, and signers must create an account.
5 — Templates with field placement, sequential and parallel signing order, automatic reminders and expiry, signing without an account on mobile, and a status overview for the sender.
8 — Roles and conditional fields, bulk sending, delegation and substitute signers, team and approval workflows, branded signer experience, signer languages listed, and signer accessibility addressed.
10 — The workflow is complete and documented: web forms and self-service signing links, mixed signature levels within one process, in-person and remote signing, a published accessibility conformance statement, and team administration with shared templates and audit of sender actions.
The Legal Counsel
Templates with field placement, a gallery of over 40, signer roles, bulk sending with reminders targetable per signer, decline-to-sign, signer reassignment and variable signers on named plans, and account-free signing give a workable core workflow with a status view for senders. We found no public information on sequential and parallel signing order, automatic reminders and document expiry, conditional fields, a branded signer experience, signer languages or accessibility. 9 5 8 1
The HR Operations Lead
Bulk requests with per-signer reminder targeting, custom templates with field placement, decline-to-sign, signer reassignment and variable signers cover most of my contract cycle, and signers need no account and pay nothing. We found no public information on signing order, signer languages, accessibility, or a branded signer experience. 9 8 5 1
The Revenue Operations Lead
Templates with field placement and a gallery of over 40, bulk requests with reminders targeted to selected signers, decline-to-sign, signer reassignment and variable signers, data validation rules on fields, and signers who need no account and pay nothing — most of what stalls a quote is covered. I found no public information on sequential or parallel signing order, on automatic scheduled reminders or request expiry, on mobile signing, or on signer accessibility, which are the pieces that make a flow run itself. 9 5 8 10 2 13
The Integration Engineer
Templates with field placement and roles, a gallery of over forty, bulk sending with reminders targeted per signer, decline to sign, signer reassignment and variable signers give a solid core — and the advanced tools are reachable through documented API parameters, which matters to me when embedding the flow. We found no public information on sequential versus parallel signing order, automatic reminders and expiry, signer languages, a branded signer experience, or accessibility, so the workflow stops short of the complete end of the scale. 5 9 8
The Data Protection Officer
Templates with field placement and validation rules, bulk sending with per-signer reminder selection, decline-to-sign with a stated reason, signer reassignment, variable signers, and recipients who sign with no account and at no cost. We found no public information on signing order, automatic reminders and expiry, signer languages, or signer accessibility. 9 5 8 1 10
The Skeptic
Templates with field placement and a gallery of over forty, bulk sending with targeted reminders and a status view, decline-to-sign, signer reassignment and variable signers on Premium, field data validation, and signing without any account are all evidenced. We found no public information on sequential versus parallel signing order, document expiry, signer languages or accessibility, so the workflow evidence stops short of the complete picture. 9 5 8 10 1
Evidence, validation & retention
Show reasoningHide reasoning
How this is scored
What proves a signature years later: the audit trail and certificate of completion, qualified timestamps, long-term validation (PAdES-LTV), validation reports, and how long signed documents and evidence are kept — and whether they can leave the platform.
0 — A signed PDF and nothing else; no audit trail, no statement on storage or deletion.
3 — An audit trail or completion certificate exists, but its contents, the timestamp source and the retention period are unstated.
5 — Audit trail with signer events, IP addresses and authentication method embedded in or attached to the signed PDF, timestamps applied, documents downloadable, and the retention period stated.
8 — PAdES signatures with long-term validation, qualified timestamps from a named provider, a validation tool or report, configurable retention and automatic deletion, and bulk export of documents with their evidence.
10 — Evidence outlives the subscription: LTV and archive timestamps documented, validation verifiable with independent tools such as the EU DSS validator, export to a DMS or archive with evidence intact, and post-termination access and deletion committed in the terms.
The Legal Counsel
A non-editable audit trail is appended to every executed request, timestamping signer events and IP addresses from submission to completion, with a hash of the PDF for tamper comparison, an option to return it as a separate file, and vendor assistance to retrieve the transaction log behind it. Retention is stated only as 'as long as necessary' with no period given for signed documents or their evidence, though export and deletion requests are supported. We found no public information on qualified timestamps or long-term validation such as PAdES-LTV, so whether this evidence still validates when a contract is disputed years later is not evidenced. 11 2 3
The HR Operations Lead
The audit trail is appended to every executed request and tracks timestamps and IP from submission to completion, with hash comparison for tamper checks and the vendor offering transaction-log assistance — decent for a five-year challenge. We found no public information on qualified timestamps, long-term validation or a validation report, and retention is stated only as "as long as necessary" rather than a period I can put in my retention schedule. 11 2 3
The Revenue Operations Lead
The audit trail tracks timestamps and IP addresses from submission to completion, is appended to the executed document or delivered as its own file, and a stored PDF hash lets tampering be detected, with vendor help offered on transaction logs. I found no public information on long-term validation, the timestamp source or provider, or a retention period for signed documents and their evidence — the privacy policy's retention "as long as necessary" is not a period. 11 2 3
The Integration Engineer
The audit trail is appended to every executed request or returned as its own file, tracks timestamps and IP addresses from submission to completion, and the vendor records a PDF hash it can compare against a questioned document, with a transaction log lookup behind it. We found no public information on a stated retention period beyond the privacy policy's wording, on qualified timestamps, long-term validation or an independent validation report, or on bulk export of documents together with their evidence — so what proves a signature years later rests largely on the vendor's own records. 11 3 1
The Data Protection Officer
The audit trail is appended to every executed request and records timestamps and IP addresses, with a PDF hash for tamper checks, a separate-file option, and vendor assistance to rely on the transaction log. The timestamp provider is unnamed, retention is stated only as retention as long as necessary unless longer required by law, and we found no public information on long-term validation, configurable retention, or automatic deletion of the evidence. 11 2 3
The Skeptic
The audit trail tracks timestamps and IP address from submission to completion, can be returned as its own file, and a PDF hash plus a database transaction-log lookup back up tamper disputes — but the vendor remains the party you must ask to run that lookup. We found no public information on qualified timestamps, long-term validation, a validation tool or report, or a stated retention period for signed documents; the privacy policy offers only 'as long as necessary' language. 11 3
Integrations & API
Show reasoningHide reasoning
How this is scored
Signing from inside the systems where contracts are made: a documented API with webhooks and a sandbox, embedded signing, and connectors for Microsoft 365, CRM, HR, DMS and ERP systems.
0 — No API and no integrations; everything happens in the vendor's web app.
3 — A few named integrations or a Zapier connector, and an API mentioned without public documentation.
5 — A documented REST API with webhooks and a sandbox, plus connectors for Microsoft 365 or Google Workspace and at least one CRM or HR system named.
8 — Embedded signing in the customer's own application, API access to every signature level, versioned API with rate limits published, SDKs, and connectors for named DMS, ERP or HR systems with their scope.
10 — Integration is a product: white-label and embedded flows documented, API parity with the web app, a status page with incident history, deprecation policy, and a marketplace of integrations with stated maintainers.
The Legal Counsel
The API is documented with endpoints, walkthroughs, guides, events and callbacks, free test mode from any account, official SDKs and OAuth, and embedded signing runs in the customer's own application through an iFrame with text tags and a testing tool; the API also reaches SMS verification and the eID add-on. Named connectors cover Google Drive, Microsoft Word, HubSpot and Dropbox. We found no public information on a versioned API with published rate limits, or connectors for document-management, ERP or HR systems with their scope. 12 13 2 6 7
The HR Operations Lead
A documented API with endpoints, walkthroughs, SDKs, events and callbacks, free test mode, and embedded signing via iFrame, with eID signature requests reachable through the API. We found no public information on API versioning, rate limits or connectors for HR systems — the named integrations are Google Drive, HubSpot and Microsoft Word. 12 13 2 6
The Revenue Operations Lead
The API is documented with endpoints, walkthroughs, official SDK libraries, free test mode, events and callbacks, OAuth and an app-approval path, and embedded signing runs in an iFrame via the hellosign-embedded library with a testing tool — signing inside our own app or the HubSpot CRM is genuinely available. I found no public information on rate limits, API versioning or a deprecation policy, and the named connectors are Google Drive, Microsoft Word, HubSpot and Dropbox, with no DMS, ERP or HR system named. 12 13 2 4
The Integration Engineer
Documented endpoints with walkthroughs and guides, official SDK libraries, free test mode for every endpoint, events and callbacks, OAuth and an API dashboard, plus embedded signing in our own portal with a testing tool, redirection and client-side events — this is close to what I need to build against. Every level I checked is reachable through the API: eID signature requests, SMS verification, decline, reassignment and variable signers all take documented parameters. We found no public information on API versioning, published rate limits, or connectors for document-management, ERP or HR systems with their scope, and the named connectors stop at Google Drive, Microsoft Word and HubSpot. 12 13 6 7 5 2
The Data Protection Officer
A documented API with endpoints, walkthroughs, webhooks via events and callbacks, free test mode, official SDKs, embedded signing through an iFrame library, and qualified eID requests creatable through the API, alongside Google Drive, HubSpot and Microsoft Word connectors. We found no published rate limits, API versioning policy, or connectors for document management, ERP or HR systems. 12 13 2 6
The Skeptic
A documented API with walkthroughs, SDK libraries, events and callbacks, free test mode, embedded signing via iFrame with a no-code testing tool, text tags and an eID request parameter is evidenced, alongside named connectors for Google Drive, Microsoft Word and HubSpot and a link to API pricing. We found no public information on published rate limits, API versioning or a deprecation policy, and no DMS, ERP or HR connector with its stated scope. 12 13 2 6
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity, the trust service provider and their owners are, where documents, audit trails and ID data are stored and processed, and who the subprocessors are. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents and signer data are stored, and subprocessors unnamed.
3 — An EU entity contracts, but documents or signer data are processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data storage stated, with a DPA, but the hosting, identification or trust service chain is non-EU-controlled without a stated safeguard.
8 — EU entity, documents, audit trails and ID data stored in named EU data centres, an EU qualified trust service provider, subprocessor list with locations published, and certifications (ISO 27001, ETSI conformity) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity and EU QTSP, every processing location and subprocessor European, customer-selectable data residency, and certifications with their scope published.
The Legal Counsel
EU customers contract with Dropbox International Unlimited Company in Dublin and the qualified trust chain runs through InfoCert and Swisscom, but data residency appears only as an unnamed tier feature and we found no public information on where documents, audit trails or ID data are stored and processed, on the subprocessor list, or on certifications such as ISO 27001. That leaves open who holds — and who could be compelled to produce — the evidence for a disputed contract. 3 2 6
The HR Operations Lead
EU customers route to Dropbox International Unlimited Company in Dublin while Dropbox, Inc. serves the Americas, but we found no public statement on where documents, audit trails and signer ID data are stored or processed, and no subprocessor list. Data residency appears only as an unnamed feature row on the pricing page. 3 2
The Revenue Operations Lead
Customers outside the US, Canada and Mexico contract with Dropbox International Unlimited Company in Dublin acting as processor, and "Data residency" appears as a row in the plan comparison, but I found no public information confirming where documents, audit trails or ID data are stored, no subprocessor list, and ownership traces to Dropbox, Inc. of San Francisco. This matches an EU contracting entity with the trust and hosting chain unevidenced rather than sovereign. 3 2
The Integration Engineer
EU customers contract with Dropbox International Unlimited Company in Dublin as processor, and the eID certificates come from InfoCert, an EU qualified trust service provider. Beyond that, we found no public information on where documents, audit trails and ID data are stored or processed, on the subprocessor list, or on certifications, and data residency appears only as a row in the plan comparison; the group's US entity serves other regions. 3 6 2
The Data Protection Officer
EU customers contract with Dropbox International Unlimited Company in Dublin and qualified signatures run through EU trust services such as InfoCert, which is welcome. The captured pages give no location for where documents, audit trails containing IP addresses, or identity data are stored or processed, a Data residency row appears in the plan comparison without any detail, and we found no published subprocessor list or certifications. 3 2
The Skeptic
EU customers contract with Dropbox International Unlimited Company in Dublin and a pricing feature row mentions data residency, but we found no public information on the vendor's own captured pages confirming where documents, audit trails or identification data are stored, and no subprocessor list; the qualified path runs through InfoCert and Swisscom rather than a Dropbox trust service. With a San Francisco parent and every ownership and residency attribute unconfirmed, there is little a European buyer can pin down. 3 2 6
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of their signing volume from public pages alone — plan prices, envelope or document limits, the per-signature price of AdES and QES, identification fees, API pricing and overage.
0 — No public prices at all; every plan is a sales conversation.
3 — Plan prices published, but envelope limits, QES and identification fees are unstated — the cost of a qualified signature is unknowable.
5 — Plans with envelope or document limits priced, but at least one commonly incurred cost (per-QES fee, video ident, API access, overage) is missing or "on request".
8 — Every plan and limit priced publicly, AdES and QES priced per signature, identification fees and overage stated, API pricing published, and contract term and notice period given.
10 — Complete cost computability: the cost of a given monthly volume per signature level derivable from public pages, volume tiers published, and every add-on and price-change term on a public page.
The Legal Counsel
The pricing page sets out tiers with unlimited signature requests, a sender definition, auto-renewal and a link to API pricing, but the eID add-on that carries the advanced and qualified signatures is 'additional cost add-on, contact sales for details', with only a quota viewable under billing add-ons. The cost of a qualified or identified signature is therefore not computable from the public pages, and we found no public per-signature or identification figures. 2 6
The HR Operations Lead
Plan names and "unlimited signature requests" per sender are public and an API pricing page exists, but the captured pages give no price figures, and the eID add-on needed for qualified signatures is "contact sales for details" with a quota only viewable after purchase. I cannot know the price of a qualified signature before an employment contract goes out the door. 2 6
The Revenue Operations Lead
The pricing page defines a sender, lists Essentials, Standard and Premium with "Unlimited signature requests" and feature-comparison rows, and points to a separate API pricing page, but I found no public information on the plan prices themselves. The eID add-on that carries qualified signatures is "additional cost add-on, contact sales for details", and its quota is managed only after purchase — the cost of a qualified signature is not computable from these pages. 2 6
The Integration Engineer
The pricing page names the plans with unlimited signature requests, defines senders and points to a separate API pricing page, but we found no public price figures for any plan in the captured pages. The eID add-on that carries the qualified levels is 'contact sales for details' with only a quota view under Billing, so the cost of a qualified signature cannot be computed from what is public. 2 6
The Data Protection Officer
The pricing page defines senders and lists unlimited signature requests across Essentials, Standard and Premium, auto-renewal with cancellation from account settings, and a pointer to API pricing. The captured pages give no figures for the plans, and the eID add-on that qualified signatures require is additional cost with contact sales for details, so the cost of a qualified signature cannot be computed from public pages. 2 6
The Skeptic
The captured pricing page shows Essentials, Standard and Premium tiers with unlimited signature requests and a sender definition, but no plan prices appear in the capture, and the eID add-on required for qualified signatures is something you purchase and manage as a quota with no figure given anywhere — other add-ons say 'contact sales for details'. The cost of a qualified signature is therefore not computable from these pages; we found no public information on per-QES or identification fees, and the API pricing page is linked but its figures were not captured. 2 6
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Dropbox Sign
Is Dropbox Sign European?
No. whats-best.ai classifies Dropbox Sign as Rest of world.
Where does Dropbox Sign store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Dropbox Sign have a free plan?
Yes. Dropbox Sign has a free plan, per the vendor’s page captured 13 Oct 2026.
What are the best alternatives to Dropbox Sign?
As of 15 Oct 2026, the panel rates Penneo (2.5/5), Youtrust (Yousign) (2.5/5) and MOXIS (2.5/5) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Penneo (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Dropbox Sign alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage sign.dropbox.com Checked 13 Oct 2026 Details →
- 2 Pricing page sign.dropbox.com Checked 13 Oct 2026 Details →
- 3 Privacy policy sign.dropbox.com Checked 13 Oct 2026 Details →
- 4 Terms of service sign.dropbox.com Checked 13 Oct 2026 Details →
- 5 EIDAS levels & trust services — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 6 Signer identification — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 7 Signer identification — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 8 Signing workflow & signer experience — found from sitemap help.dropbox.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 9 Signing workflow & signer experience — found from sitemap sign.dropbox.com Checked 13 Oct 2026 Details →
- 10 Evidence, validation & retention — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 11 Evidence, validation & retention — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 12 Integrations & API — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →
- 13 Integrations & API — found from sitemap help.dropbox.com Checked 13 Oct 2026 Details →