# Dropbox Sign — E-Signature

Dropbox Sign by Dropbox, Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Dropbox, Inc. (https://sign.dropbox.com)
- Category: [E-Signature](https://whats-best.ai/software/e-signature.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/e-signature/dropbox-sign
- Alternatives: https://whats-best.ai/software/e-signature/dropbox-sign/alternatives ([markdown](https://whats-best.ai/software/e-signature/dropbox-sign/alternatives.md))
- Data as of: 2026-10-20 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Dropbox, Inc.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S3]

## The panel's verdict

Dropbox Sign, the e-signature service of Dropbox, Inc. of San Francisco, scores highest on signing workflow (6) and integration and API: templates, bulk sending with per-signer reminders, decline to sign, signer reassignment, variable signers and account-free signing are evidenced, and the API brings documented endpoints, SDK libraries, free test mode and embedded signing in an iFrame. Advanced and qualified signatures sit behind a purchased eID add-on on the API Premium plan. Its weakest criteria are sovereignty and pricing transparency. EU customers contract with Dropbox International Unlimited Company in Dublin, yet data residency is not confirmed on the vendor's captured pages, and we found no public information on where documents, audit trails or identity data are stored, or on a subprocessor list. Pricing transparency is the one flagged disagreement: tier names, 'Unlimited signature requests' and a sender definition are public, but no plan figures were captured and the eID add-on is 'contact sales for details', so a qualified signature's cost is not computable — judges differ on how far the published tier structure offsets the missing figures.

**Speaks for it:**
- Signing workflow scored 6, evidenced by custom templates with field placement, bulk sending with per-signer reminder targeting, decline to sign, signer reassignment and variable signers
- Integration and API scored 6-7, with documented endpoints, official SDK libraries, free test mode, events and callbacks, and embedded signing in an iFrame
- Qualified electronic signatures run through named providers — Belgian eID, Finnish eID, EvroTrust, and Swisscom as QES under ZertES — with InfoCert named as an EU qualified trust service provider
- Signers need no Dropbox Sign account and pay nothing to sign a document
- The audit trail is appended to every executed request, tracks timestamps and IP addresses from submission to completion, and a stored PDF hash supports tamper checks

**Held against it:**
- Sovereignty scored 2-3; data residency is not confirmed on the vendor's captured pages, and we found no public information on where documents, audit trails or identity data are stored, or on a subprocessor list
- No price figures for the Essentials, Standard or Premium plans appear in the captured pages, and the eID add-on is 'contact sales for details', so a qualified signature's cost is not computable from public pages
- Advanced and qualified levels are gated behind the API Premium plan plus a purchased eID add-on, with certificates issued by InfoCert and Swisscom rather than a Dropbox trust service
- Retention is stated only as 'as long as necessary', with no stated period for signed documents or their evidence, and we found no public information on qualified timestamps or long-term validation
- We found no public information on sequential versus parallel signing order, automatic reminders, document expiry, signer languages or accessibility

**Best for:**
- You need to embed signing inside your own application, backed by a documented API, SDK libraries, free test mode and iFrame embedded signing
- Your team sends high volumes of routine documents — contracts, NDAs, onboarding forms, purchase orders — where bulk sending, targeted reminders and account-free signers cover the cycle
- You need qualified electronic signatures from named providers and are prepared to buy the API Premium plan plus the eID add-on
- Your documents need signatures legally binding in the United States, European Union or United Kingdom without the qualified levels

**Avoid if:**
- You need a firm total cost, including what a qualified signature costs, before committing — no plan figures are public and the eID add-on is 'contact sales for details'
- Your procurement must see documented data residency, ownership and subprocessors — sovereignty scored 2-3, and those attributes are unconfirmed on the vendor's captured pages
- Your signed evidence must validate independently years later — tamper checks rely on a transaction-log lookup only the vendor can run, and we found no public information on qualified timestamps or long-term validation

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Legal Counsel | The HR Operations Lead | The Revenue Operations Lead | The Integration Engineer | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| eIDAS levels & trust services | 2.5/5 | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Signer identification | 3/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 2.5/5 |
| Signing workflow & signer experience | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Evidence, validation & retention | 2.5/5 | 2/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Integrations & API | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 |
| Pricing transparency | 2.5/5 | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 | 1/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **3/5** | **2/5** | **2/5** |

### The judges

- **The Legal Counsel** (v1.0): Decides which contracts may be signed electronically and at which level. Wants SES, AdES and QES named per plan and country, the qualified trust service provider linked to the EU Trust List, and an audit trail with timestamps that still validates when the contract is disputed in eight years.
- **The HR Operations Lead** (v1.0): Sends two hundred employment contracts a year, many of them fixed-term and so under written form. Wants QES that a new hire can complete on a phone in ten minutes, identification that accepts the IDs applicants actually hold, bulk sending from templates, and a price per qualified signature known before the contract is signed.
- **The Revenue Operations Lead** (v1.0): Measures how long a quote takes to come back signed and where it stalls. Wants signing from inside the CRM, templates sales cannot break, reminders and signing order that run themselves, and a signer experience that needs no account, no app and no explanation.
- **The Integration Engineer** (v1.0): Embeds signing into the company's own portal and archives the result in the DMS. Wants a versioned API with webhooks and a sandbox, every signature level reachable through the API rather than only in the web app, and signed documents exported with their evidence intact.
- **The Data Protection Officer** (v1.0): Knows every signer who holds an ID card up to a camera hands biometric and identity data to a provider they never chose. Asks who performs the identification, where documents and ID data are stored, how long the audit trail keeps IP addresses, and who the subprocessors in the trust service chain are.
- **The Skeptic** (v1.0): Knows "legally binding" usually means a simple signature. Reads for the level the default plan actually signs at, the QTSP the provider does not operate itself, the per-QES and ident fees on top of the plan, the envelope limit, and "eIDAS-compliant" from a provider that names no trust service at all.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- DPA available: assets.dropbox.com/documents/en/legal/hs-data-processing-agreement.pdf · yes [S4]
- Dpf certification: EU-U.S. · Swiss-U.S. · UK Extension · yes [S3]
- Dpf dispute resolution: free · JAMS [S3]
- Eidas: AES and QES via QTSPs, compliant with eIDAS regulation [S6]
- Legal binding regions: legally binding in US, EU, UK, and many countries [S9]
- Privacy contact: privacy@dropbox.com [S3]
- Privacy shield certified: yes · yes [S4]
- Security standards: generally accepted standards for data in transit and at rest [S3]
- Transfer mechanisms: Standard Contractual Clauses · EU-U.S. Data Privacy Framework · UK Extension · Swiss-U.S. Data Privacy Framework · adequacy decisions [S3]

**Data**
- Access request form: yes [S3]
- Deletion or anonymization: yes [S3]
- Export: machine readable · yes [S3]
- Retention policy: retained as long as necessary for stated purposes unless longer required by law [S3]

**Hosting**
- Processing entity by region: Dropbox International Unlimited Company · Dropbox, Inc. [S3]

**Integrations**
- Client side events: yes [S13]
- Eid API parameter: API parameter is_eid=true creates eID signature request [S6]
- Featured: Google Drive · HubSpot · Dropbox [S2]
- Sdk libraries: yes [S12]
- Sms verification endpoints: /signature_request/send · /signature_request/send_with_template · /signature_request/create_embedded · /signature_request/create_embedded_with_template [S7]
- Sms verification parameter: signers[%i%][sms_phone_number] [S7]
- Templates included: yes · yes [S4]

**Legal**
- Contracting entities: Dropbox International Unlimited Company · Dropbox, Inc. [S4]
- No po required: yes [S4]
- Non renewal notice days: 30 [S4]
- Policy effective date: 2025-01-14 [S3]
- Termination for cause cure period: 30 [S4]
- Terms effective date: 2025-01-07 · 2025-01-07 [S4]

**Pricing**
- Auto renewal: 30 [S4]
- Cancellation downgrade to free: yes [S4]
- Eid addon availability: Dropbox Sign API Premium · add-on purchase · yes [S6]
- Fees exclusive of taxes: no [S4]
- Free plan template gallery: yes · no [S9]
- Free tier: paid upgrades · yes [S3]
- Free trial: free trial · 30 [S9]
- Late fee: 1.5 [S4]
- Standard: Standard · Small team · EUR · 576 · 24 [S2]
- Templates paid plans: Free 30-day trial available · any paid plan [S9]
- Trial: yes · 30 [S2]

**Product**
- Advanced signing tools: decline to sign, signer reassignment, variable signers [S5]
- API available: API available for building integrated fax, signature, workflow automation solutions [S4]
- API documentation exists: endpoints, walkthroughs, guides · yes [S12]
- API guides: App approval, events and callbacks, API dashboard, SMS tools, OAuth [S12]
- API pricing: yes [S2]
- API test mode free: yes [S12]
- API walkthroughs: Signature request, embedded signing, embedded templates, embedded requesting, Text Tags, using templates with the API [S12]
- App approval: yes [S13]
- Article updated: 2025-12-04 [S5]
- Audit trail appended: yes · yes [S11]
- Audit trail pdf hash: yes [S11]
- Audit trail separate file: yes [S11]
- Audit trail tracking: submission through completion · timestamps · IP address [S11]
- Auto renewal: yes · yes [S2]
- Autosave signed docs: yes [S1]
- Bulk reminder targeting: Reminders for bulk requests can be sent to selected signers via checkbox selection in Bulk requests > View status [S8]
- Bulk reminders: Reminders can be sent for bulk signature requests; all signers receive an email with a new document link [S8]
- Custom templates: custom templates from frequently used documents [S9]
- Customer data ownership: yes [S4]
- Data validation definition: Sets rules on text fields in documents to collect accurate information from signers [S10]
- Data validation plan availability: Essentials · Standard · Premium [S10]
- Data validation rule types: numbers_only · letters_only · telephone_10_digit_us · bank_routing_9_digits · bank_account_min_6_digits · email · zip_code_5_or_9_digits · ssn_9_digits · ein_9_digits · custom_regex [S10]
- Data validation setup: Configured by creating a text field and choosing a Validation Type dropdown [S10]
- Decline to sign API endpoints: /signature_request/send · /signature_request/send_with_template · /signature_request/create_embedded · /signature_request/create_embedded_with_template · /unclaimed_draft/create · /unclaimed_draft/create_embedded · /unclaimed_draft/create_… [S5]
- Decline to sign API parameter: allow_decline [S5]
- Decline to sign behavior: Decline to sign halts a signing flow; signer must fill in a Reason for Decline box and the original sender receives a summary of why the document wasn't signed [S5]
- Decline to sign plans: Essentials · Standard · Premium [S5]
- Domain restriction: yes · yes [S13]
- Eid channels: supported via web (sign.dropbox.com) and Sign API [S6]
- Eid enable admin console: admin console [S6]
- Eid features: signer identity verification via digital certificates from Qualified Trust Service Providers [S6]
- Eid infocert qtsp: some identity verification methods use personal certificates issued by InfoCert, an EU QTSP [S6]
- Eid providers aes: Danish Mit-ID · AES · Denmark · Finnish eID · QES · Finland [S6]
- Eid quota management: eID quota viewable and manageable under Billing > Add-Ons [S6]
- Eid supported providers: Belgian eID · QES · Belgium · EvroTrust · QES [S6]
- Embedded signing: hellosign-embedded · yes · iFrame [S13]
- Embedded testing tool: yes [S13]
- Features by tier: feature comparison rows include SMS authentication, SSO, advanced signer fields/tools, advanced reporting, data residency, multi-teams, performance dashboards [S2]
- G2 rating: 4.7 · G2 [S1]
- Geo legality: United States · European Union · United Kingdom [S2]
- Https required: yes · yes [S13]
- Integrations footnote: Google Drive · Microsoft Word · HubSpot [S2]
- Legal binding: non-editable, on every request · ESIGN Act of 2000 · yes [S2]
- No data sale: no [S3]
- Processor role for user content: data_processor · data_controller [S3]
- Recipients no account: no [S1]
- Redirection: yes · yes [S13]
- Sender definition: Definition of a sender on pricing page [S2]
- Services covered: Dropbox Sign · Dropbox Forms · Dropbox Fax [S4]
- Signature links expiry: yes · 60 [S13]
- Signer copy: yes [S2]
- Signer reassignment API endpoints: /signature_request/send · /signature_request/create_embedded · /template/create_embedded_draft · /unclaimed_draft/create_embedded · /unclaimed_draft/create_embedded_with_template [S5]
- Signer reassignment API parameter: allow_reassign [S5]
- Signer reassignment behavior: Recipients can enter the name and email of the appropriate person and reassign the signature request when sent to an incorrect email address [S5]
- Signer reassignment plan: Premium [S5]
- Signer reassignment template endpoints: while creating a template · when editing an existing one · /signature_request/send_with_template · /signature_request/create_embedded_with_template · /unclaimed_draft/create_embedded_with_template [S5]
- Signers free: 0 · no [S2]
- Sms verification behavior: Signers must enter a verification code to access and complete requests sent with SMS verification [S7]
- Sms verification incorrect code: yes [S7]
- Sms verification plan requirement: Standard API · Premium API [S7]
- Sms verification resent: yes [S7]
- Standard addon: Some features are additional cost add-ons; contact sales for details [S2]
- Swisscom zertes: Swisscom is considered QES according to ZertES [S6]
- Template gallery count: yes [S9]
- Template use cases: HR, Sales, Real Estate, general business; contracts, NDAs, onboarding forms, purchase orders [S9]
- Template workflow steps: Upload document, decide signer roles, place fields, save/send/reuse [S9]
- Text tags: yes [S13]
- Unlimited signature requests: Essentials · Standard · Premium · unlimited signature requests [S2]
- Variable signers API endpoints: /signature_request/send_with_template · /signature_request/create_embedded_with_template [S5]
- Variable signers behavior: Users can adjust the number of signers for a template; useful for documents with a variable number of signers like rental agreements [S5]
- Variable signers plan: Premium [S5]
- Variable signers setup: Enable by setting up the template with the maximum amount of signers needed [S5]

**Support**
- API implementation help: support request for API implementation questions [S12]
- Transaction log assistance: vendor assists when customers need to rely on a transaction log [S11]

## Questions

### Is Dropbox Sign European?

No. whats-best.ai classifies Dropbox Sign as Rest of world.

### Where does Dropbox Sign store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Dropbox Sign have a free plan?

Yes. Dropbox Sign has a free plan, per [the vendor’s page captured 13 Oct 2026](https://whats-best.ai/evidence/6589).

### What are the best alternatives to Dropbox Sign?

As of 15 Oct 2026, the panel rates [Penneo (2.5/5)](https://whats-best.ai/software/e-signature/penneo), [Youtrust (Yousign) (2.5/5)](https://whats-best.ai/software/e-signature/youtrust) and [MOXIS (2.5/5)](https://whats-best.ai/software/e-signature/moxis) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Penneo](https://whats-best.ai/software/e-signature/penneo) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Dropbox Sign alternatives](https://whats-best.ai/software/e-signature/dropbox-sign/alternatives).

## What this page leaves out

- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://sign.dropbox.com/ (checked 2026-10-13)
- [S2] Pricing page: https://sign.dropbox.com/products/dropbox-sign/pricing (checked 2026-10-13)
- [S3] Privacy policy: https://sign.dropbox.com/about/privacy (checked 2026-10-13)
- [S4] Terms of service: https://sign.dropbox.com/about/terms (checked 2026-10-13)
- [S5] EIDAS levels & trust services — found from sitemap: https://help.dropbox.com/integrations/advanced-signing-tools-an-overview (checked 2026-10-13)
- [S6] Signer identification — found from sitemap: https://help.dropbox.com/plans/dropbox-sign-and-eid (checked 2026-10-13)
- [S7] Signer identification — found from sitemap: https://help.dropbox.com/integrations/sms-verification-api-dropbox-sign (checked 2026-10-13)
- [S8] Signing workflow & signer experience — found from sitemap: https://help.dropbox.com/share/bulk-signature-request-reminders-dropbox-sign (checked 2026-10-13)
- [S9] Signing workflow & signer experience — found from sitemap: https://sign.dropbox.com/features/templates (checked 2026-10-13)
- [S10] Evidence, validation & retention — found from sitemap: https://help.dropbox.com/view-edit/dropbox-sign-data-validation (checked 2026-10-13)
- [S11] Evidence, validation & retention — found from sitemap: https://help.dropbox.com/security/dropbox-sign-audit-trail-overview (checked 2026-10-13)
- [S12] Integrations & API — found from sitemap: https://help.dropbox.com/integrations/dropbox-sign-api-documentation (checked 2026-10-13)
- [S13] Integrations & API — found from sitemap: https://help.dropbox.com/integrations/embedded-signing-sequence-diagram (checked 2026-10-13)

---

Cite as: whats-best.ai, "Dropbox Sign — E-Signature", AI panel analysis, as of 2026-10-20. https://whats-best.ai/software/e-signature/dropbox-sign

Corrections: https://whats-best.ai/correct/643?target=page