E-Signature
sproof sign
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by sproof GmbH · www.sproof.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
sproof sign at a glance
- Vendor
- sproof GmbH
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Default not stated; pages mention Europe source, captured 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates sproof sign 2.5/5, the mean of 6 judges. sproof sign, from sproof GmbH of Salzburg, Austria, is strongest at signing workflow, scored a uniform 7 — the highest mark awarded anywhere on this product — for templates with editable fields, grouped or sequential signing order, batch signing and web forms with QR codes. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
sproof sign, from sproof GmbH of Salzburg, Austria, is strongest at signing workflow, scored a uniform 7 — the highest mark awarded anywhere on this product — for templates with editable fields, grouped or sequential signing order, batch signing and web forms with QR codes. Integration and API follows at 6–7 on a documented REST API with a free development license and connectors, though the captured pricing page shows general API access on the Enterprise plan only and gives different signals on which plans include it. Weakest is pricing transparency, a flat 3: quotas are published ("100 / Jahr" private, "1200 / Jahr" business, "Individuell" enterprise, private use always free), but no public price for the plans, the User+ upgrade that unlocks qualified signing, identification or API fees, so a qualified signature's cost is not computable. The judges genuinely split on sovereignty, scores running 3 to 6: the vendor states development and hosting in Europe in its own ISO 27001 certified data centres, but legal-entity jurisdiction, ownership, data residency and subprocessors are unconfirmed on the captured pages, and the partner issuing qualified signatures is unnamed.
Speaks for it
- Signing workflow scores sit at a uniform 7, with templates, simultaneous, grouped or ordered signing, batch signing, mail merge and web forms via link or QR code all evidenced
- Integration and API scores cluster at 6–7 on a documented REST API with a free development license, embedded signing as button, widget or iFrame, and connectors for SAP, Salesforce, Microsoft 365, Microsoft Dynamics, Power Automate, Zapier and Make
- Identity verification scores cluster at 4–5 on an agent-guided video identification of roughly five minutes with photo ID and mobile phone as second factor, plus an eID Hub advertising more than 25 national eIDs
- The audit trail is documented as a court-admissible record of who viewed, approved and signed with which verification method, checked against the certificate chain, CRL/OCSP revocation lists and the EU Trust List
- Annual advanced-signature quotas are published ("100 / Jahr" private, "1200 / Jahr" business, "Individuell" enterprise) and private use is always free
Held against it
- Pricing transparency sits at a flat 3: no public price for the paid plans, the User+ upgrade that unlocks qualified signing, identification fees, overage or API pricing
- Qualified signatures are issued "via a partner of sproof" that is never named, with no EU Trust List entry linked and no public information on qualified seals or ZertES
- Sovereignty scores run 3 to 6 — the one criterion the score computation flags as a disagreement — with legal-entity jurisdiction, ownership, data residency and subprocessor exposure unconfirmed on the captured pages
- No public information on qualified timestamps, long-term validation or a retention period for documents and their evidence; the only statement is no permanent storage after completion
- The published privacy policy covers the website only and describes the signing application as technically separate, so retention and deletion of identification data are not addressed on public pages
Best for
- You send employment or sales contracts in volume and need templates, batch signing, mail merge and grouped signing order — the workflow scoring is the product's strongest
- Your team builds against a REST API and wants to embed signing and identification as a button, widget or iFrame, with a free development license to start (verify plan-level API access first — the captured pages give different signals)
- You are Austria-based and want qualified signing via the mobile phone signature (ID Austria), which the vendor names as its qualified route
- You want a vendor stating development and hosting in Europe in its own ISO 27001 certified data centres and can confirm jurisdiction and subprocessors directly in procurement
Avoid if
- You must know the cost of a qualified signature before committing — pricing transparency scored a flat 3 and no public price exists for the plans, the User+ upgrade or identification fees
- You send contracts whose qualified trust service provider must be named and traceable to the EU Trust List for legal review — the issuer is described only as a partner of sproof
- You need evidence that still validates years after signing — ask the vendor: the public pages we read do not show it
- Your procurement requires confirmed legal-entity jurisdiction, ownership, data residency or a subprocessor list before signature — all are unconfirmed on the captured pages
The scores
| Criterion | Panel median |
|---|---|
| eIDAS levels & trust services | 2 of 5 |
| Signer identification | 2.5 of 5 |
| Signing workflow & signer experience | 3.5 of 5 |
| Evidence, validation & retention | 2.5 of 5 |
| Integrations & API | 3.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 1.5 of 5 |
eIDAS levels & trust services
Show reasoningHide reasoning
How this is scored
Which signature levels the platform offers — simple, advanced, qualified, and qualified seals — through which qualified trust service provider on the EU Trust List, for which countries and legal regimes (eIDAS, ZertES), and on which plans.
0 — No signature level named; the platform calls its signature "legally binding" without saying which kind it is.
3 — Simple signatures by default with "advanced" or "qualified" mentioned as available, but no trust service provider named and no statement on which plan or country offers which level.
5 — SES, AdES and QES offered and labelled in the product, the qualified trust service provider named, and which documents need which level explained for at least Germany or the EU.
8 — Every level documented with the plans and countries it is available in, the QTSP's entry on the EU Trust List linked, QES under eIDAS (and ZertES where relevant) stated, qualified electronic seals for company documents, and the signature level printed in the signed document and audit trail.
10 — Levels are an explicit product decision: the provider is or contracts a named QTSP with its conformity assessment published, level selection per document type or template, remote QES without a separate account, EUDI wallet support stated with a date, and the legal effect per level documented for the main EU markets.
The Legal Counsel
All three eIDAS levels are labelled with their legal effect — the simple signature as having no evidential value, the advanced for contracts without formal requirements, the qualified as fully equivalent to a handwritten signature — and qualified signing is tied to the User+ plan, with the Austrian mobile phone signature (ID Austria) named as the qualified creation device. But qualified signatures are stated to be issued 'über einen Partner von sproof', and we found no public information naming that trust service provider, linking it to the EU Trust List, covering ZertES, qualified seals, or which level is available in which country beyond Austria. I will not send Germany-critical contracts on an unnamed trust service provider. 6 5 7 1 2
The HR Operations Lead
Simple, advanced and qualified levels are all labelled and explained, including which documents suit which level — they even name simple employment contracts as a fit for advanced signatures, which speaks directly to my fixed-term hires. But the qualified trust service provider behind the signatures is described only as "a partner of sproof", and I found no public information linking that issuer to the EU Trust List or mapping which plan and country offer which level beyond Austria. 6 7 5 2
The Revenue Operations Lead
All three levels are labelled and genuinely explained — simple with no evidential value, advanced for contracts without formal requirements, qualified equal to a handwritten signature under eIDAS — with qualified signing tied to the User+ tier and Austria handled via the mobile phone signature. What caps it: qualified signatures are issued "via a partner of sproof" and that trust service provider is never named, and we found no public information on the provider's EU Trust List entry or on qualified seals for company documents. 2 5 6 7
The Integration Engineer
All three eIDAS levels are labelled and explained with their legal effect and typical use, and qualified signing is tied to the "User+" upgrade with registration proposed automatically — but qualified signatures are described only as issued via a partner of sproof, and we found no public information on qualified seals or on level availability per country beyond the Austrian mobile phone signature example. 5 6 7
The Data Protection Officer
All three eIDAS levels are labelled and explained with their legal effect, the qualified signature is tied to the User+ plan, and Austria's ID Austria is named as a route — but the qualified trust service provider is only ever described as a partner of sproof, and I found no public information naming that provider, linking its EU Trust List entry, or covering qualified seals or ZertES. 5 6 7 1
The Skeptic
All three levels are labelled and explained, the standard plans issue the advanced signature, and qualified signing is gated behind a User+ purchase — but the qualified signature is issued "über einen Partner von sproof" and no trust service provider is ever named, no EU Trust List entry is linked, and we found no public information on qualified seals or ZertES. Every page repeats "eIDAS-compliant" without one concrete trust service behind it. 2 5 6 7 1
Signer identification
Show reasoningHide reasoning
How this is scored
How the signer is identified for each level: email and SMS codes, video ident, eID card (Online-Ausweis), bank ident or EUDI wallet — who performs it, in which countries it works, and what happens to the ID data afterwards.
0 — Email link only; no statement on how signers are authenticated.
3 — Email plus SMS or access code, with "ID verification" mentioned as an add-on but no methods, provider or countries named.
5 — Identification methods for AdES and QES listed by name (for example video ident, eID, bank ident), the identification provider named, and the countries or ID documents they accept stated.
8 — Methods documented per level and country, automated and agent-based ident distinguished, reuse of an identification for later signatures explained, retention and deletion of ID data stated, and the ident provider listed as subprocessor.
10 — Identification is transparent end to end: every method with its countries, assurance level and failure rate or completion guidance, EUDI wallet and national eID supported, ID data minimisation and retention committed, and the signer-facing privacy notice published.
The Legal Counsel
The one-time identification for qualified signatures is documented method by method — an agent-guided video call of roughly five minutes with photo ID, the mobile phone registered as second factor — the eID Hub advertises signing with more than 25 national eIDs plus EUDI wallet readiness, and advanced signatures identify the signer via email address. We found no public information naming who performs the identification, the countries each method covers, or the retention and deletion of the ID data afterwards. Before relying on this in a dispute I would want the identification provider and its subprocessor status on the record. 7 8 2 1
The HR Operations Lead
The methods are named and fit my ten-minute new-hire window: a roughly five-minute agent-guided video call with photo ID and the mobile phone as second factor, the Austrian mobile phone signature, and signing with more than twenty-five national eIDs through the eID hub, with EUDI readiness claimed. I found no public information on who performs the identification, on the countries and ID documents accepted beyond Austria, or on retention and deletion of the ID data afterwards. 8 9 6 2 1
The Revenue Operations Lead
The qualified flow is documented in operational detail — photo ID, mobile phone as second factor, an agent-guided video call of about five minutes, one-time identification reused for later signatures — plus an eID Hub advertising more than twenty-five national eIDs and EUDI wallet readiness. Countries are only partly covered (Austria via ID Austria, otherwise unnamed "European identity providers"), the identification provider itself is never named, and we found no public information on retention or deletion of ID data. 2 6 7 8 9
The Integration Engineer
Agent-guided video identification is documented down to the photo ID, webcam and mobile phone as second factor, with the check described as one-time, and the eID Hub promises signing with more than 25 national eIDs including EUDI wallet readiness — but the identification provider is never named, and we found no public information on accepted countries per method or on retention and deletion of identification data. 1 2 8
The Data Protection Officer
The qualified-signature identification is documented in unusual detail — agent-guided video call, photo ID, mobile phone as second factor, one-time and reusable — and the eID Hub advertises signing with more than 25 national eIDs, but I found no public information on who performs the identification or what happens to the ID data afterwards; the published privacy policy covers the website only and states the signing application is technically separate, so storage and deletion of ID data go unstated. 2 3 6 8 9
The Skeptic
Methods are named — a roughly five-minute agent-guided video ident with photo ID and mobile second factor for QES, identification by email address for the advanced level, an eID Hub with more than 25 national eIDs and an EUDI wallet claim — but who performs the identification, in which countries it works, and what happens to the ID data afterwards are not stated. The captured privacy policy explicitly covers only the website, not the signing application, so retention and deletion of identification data are unverifiable from public pages. 2 3 6 8 9
Signing workflow & signer experience
Show reasoningHide reasoning
How this is scored
Getting a document out and back signed: templates and form fields, signing order and roles, bulk sending, reminders and delegation, signing without an account or app, mobile signing, and accessibility for signers.
0 — Single-recipient signing of an uploaded PDF; no templates, order or reminders.
3 — Multiple signers and basic templates, but no signing order, no bulk send, and signers must create an account.
5 — Templates with field placement, sequential and parallel signing order, automatic reminders and expiry, signing without an account on mobile, and a status overview for the sender.
8 — Roles and conditional fields, bulk sending, delegation and substitute signers, team and approval workflows, branded signer experience, signer languages listed, and signer accessibility addressed.
10 — The workflow is complete and documented: web forms and self-service signing links, mixed signature levels within one process, in-person and remote signing, a published accessibility conformance statement, and team administration with shared templates and audit of sender actions.
The Legal Counsel
The workflow is genuinely built out: signing order simultaneous, in groups or an individual sequence with automatic invitation of the next group, existing PDF form fields editable or newly created, batch signature, mail merge, reminders and chat, out-of-office deputies, role management, and on-site signing on higher plans. Web forms with links or QR codes for mass signature collection and a barrier-free user interface are stated. We found no public information on conditional fields, signer languages, or a published accessibility conformance statement. 11 2 14 10
The HR Operations Lead
Templates with editable form fields, simultaneous or ordered group signing with automatic invitations, batch signature and serial mail for bulk sends, plus out-of-office representation and on-site signing on the larger plans — that covers my two hundred contracts a year comfortably. A barrier-free interface is claimed, but I found no public information on a published accessibility conformance statement, on signer languages, or on completing a signature on a phone without an account. 10 11 2 14 5
The Revenue Operations Lead
This is where a revenue team gets its money's worth: signing order with simultaneous, grouped or individual sequences that auto-invite the next group, form fields and templates, mail merge plus batch signature for volume, absence deputies, shared team workflows, corporate branding, web forms with links and QR codes, and on-site signing. Gaps: we found no public information on conditional fields, signer interface languages, or a published accessibility conformance statement — only a "barrier-free user interface" claim — and nothing confirming signers can sign on mobile without an account. 2 10 11 13 14
The Integration Engineer
Templates with editable form fields, parallel, grouped and sequential signing order with automatic invitations, reminders, batch signing, mail merge, out-of-office substitution and web forms via link or QR code cover nearly everything I need to run volume signing, and a barrier-free interface is claimed — we found no public information on conditional fields, signer languages or a published accessibility conformance statement. 2 10 11 14
The Data Protection Officer
Templates with editable form fields, group and sequential signing order with automatic invitations, batch and serial sending, reminders, absence and deputy arrangements, team roles and corporate branding are all shown on the captured pages, alongside web forms with QR codes and on-site signing; I found no public information on signer languages, conditional fields, or a published accessibility conformance statement beyond a barrier-free interface claim. 2 10 11 14
The Skeptic
Templates with editable form fields, sequential, parallel and grouped signing order with automatic next-group invitation, reminders, status tracking, batch signing, mail merge, out-of-office deputies, teams with roles, branded signing, on-site signing and web forms with links or QR codes are all evidenced. We found no public information on conditional fields, signer languages, mobile signing, expiry, or a published accessibility conformance statement beyond a "barrier-free" claim. 1 2 10 11 14
Evidence, validation & retention
Show reasoningHide reasoning
How this is scored
What proves a signature years later: the audit trail and certificate of completion, qualified timestamps, long-term validation (PAdES-LTV), validation reports, and how long signed documents and evidence are kept — and whether they can leave the platform.
0 — A signed PDF and nothing else; no audit trail, no statement on storage or deletion.
3 — An audit trail or completion certificate exists, but its contents, the timestamp source and the retention period are unstated.
5 — Audit trail with signer events, IP addresses and authentication method embedded in or attached to the signed PDF, timestamps applied, documents downloadable, and the retention period stated.
8 — PAdES signatures with long-term validation, qualified timestamps from a named provider, a validation tool or report, configurable retention and automatic deletion, and bulk export of documents with their evidence.
10 — Evidence outlives the subscription: LTV and archive timestamps documented, validation verifiable with independent tools such as the EU DSS validator, export to a DMS or archive with evidence intact, and post-termination access and deletion committed in the terms.
The Legal Counsel
The audit protocol documents who viewed, approved and signed together with the verification method used, is presented as court-admissible primary evidence, signatures are applied in PAdES, and a validation service traces the certificate chain against revocation lists and the EU Trust List. But we found no public information on qualified timestamps, long-term validation such as PAdES-LTV, whether the trail is embedded in the signed PDF, or any retention period — the only statement is that no permanent storage or further processing takes place after completion. For a contract disputed in eight years, nothing published tells me the evidence still validates. 13 12 5
The HR Operations Lead
The audit protocol is described in detail — who viewed, approved and signed, with the verification method used — and is positioned as primary evidence in disputes, backed by a validation tool that checks the certificate chain, revocation lists and the EU Trust List. The captured pages state that documents are not stored permanently after completion of the process, and I found no public information on qualified timestamps, long-term validation, or on how long the evidence itself is kept and whether it can be exported. 13 12 5 2
The Revenue Operations Lead
The audit trail is described with its contents — who viewed, approved and signed, including the verification method — and claimed court-admissible, signatures are applied in PAdES, and there is a real validation story with certificate chain, CRL/OCSP and EU Trust List checks plus a validation module with API and web tool. But we found no public information on qualified timestamps or a named timestamp provider, long-term validation, export of documents with their evidence, or post-termination access; the only retention statement found is that no permanent document storage happens after a process completes. 5 12 13
The Integration Engineer
The audit trail is described as court-admissible, recording who viewed, approved and signed with the verification method used, and a validation module checks the certificate chain to the root CA, revocation lists and the EU Trust List — but we found no public information on qualified timestamps, long-term validation, the retention period for signed documents and their evidence, or export to a DMS with evidence intact. 5 12 13
The Data Protection Officer
The audit trail is described as a court-admissible record of who viewed, approved and signed with which verification method, and the validation tool traces the certificate chain, CRL/OCSP and the EU Trust List on all plans, with a statement that no permanent storage of documents occurs after completion; I found no public information on timestamps or long-term validation embedded in the signed PDF, on IP addresses inside the trail, or on retention and export of documents with their evidence — the published log figures of 30 days with shortened IP addresses cover the website, not the signing application. 3 5 12 13
The Skeptic
The audit trail is documented as court-admissible, recording who viewed, approved and signed, when, and with which verification method, and a validation tool checks the certificate chain to the root CA, CRL/OCSP revocation lists and the EU Trust List. But no timestamp source is named, long-term validation is not mentioned for the PAdES signatures, the only retention statement is "no permanent storage after completion" without a period, and export of documents with evidence or post-termination access is not addressed. 5 12 13
Integrations & API
Show reasoningHide reasoning
How this is scored
Signing from inside the systems where contracts are made: a documented API with webhooks and a sandbox, embedded signing, and connectors for Microsoft 365, CRM, HR, DMS and ERP systems.
0 — No API and no integrations; everything happens in the vendor's web app.
3 — A few named integrations or a Zapier connector, and an API mentioned without public documentation.
5 — A documented REST API with webhooks and a sandbox, plus connectors for Microsoft 365 or Google Workspace and at least one CRM or HR system named.
8 — Embedded signing in the customer's own application, API access to every signature level, versioned API with rate limits published, SDKs, and connectors for named DMS, ERP or HR systems with their scope.
10 — Integration is a product: white-label and embedded flows documented, API parity with the web app, a status page with incident history, deprecation policy, and a marketplace of integrations with stated maintainers.
The Legal Counsel
A documented REST API covers signatures and identification workflows, qualified and advanced signatures are embeddable as button, widget or iFrame into the customer's DMS, a free development license via API token is offered, and SAP, Salesforce, Microsoft 365 and Microsoft Dynamics are named alongside Outlook sync, Power Automate, Zapier and Make. General API access is reserved for the enterprise plan on the pricing page. We found no public information on webhooks, rate limits, API versioning or SDKs. 14 2 1
The HR Operations Lead
A documented REST API with a free development licence, widget and iFrame embedding, and named connectors for SAP, Salesforce, Microsoft 365 and Microsoft Dynamics is enough to wire signing into our HR systems. I found no public information on webhooks, rate limits or SDKs, and the captured pricing page gives different signals on API access — it appears in the Team feature list while the availability matrix places general API access on the Enterprise plan only. 14 1 2 1
The Revenue Operations Lead
Signing from inside the systems where deals close is well served: a documented REST API with public documentation and a free development license, widget and iFrame embedding for signing and identification, and named connectors for SAP, Salesforce, Microsoft 365 and Microsoft Dynamics alongside Zapier, Make and Power Automate. What holds it back: we found no public information on webhooks, API versioning, rate limits or SDKs, and the captured pricing page gives different signals on which plans include API access, so verify before counting on mid-tier use. 1 2 14 1
The Integration Engineer
Embedded signing as a button, widget, iFrame or directly in the DMS with both advanced and qualified signatures reachable through the REST API, plus a free development license via API token and named connectors for SAP, Salesforce, Microsoft 365 and Dynamics, is close to the integration story I want — but we found no public information on webhooks, API versioning, published rate limits or SDKs, and the captured pricing page gives different signals on which plans include API access. 1 2 14
The Data Protection Officer
A documented REST API with a free development license covers signatures and identification, signatures embed as button, widget or iFrame at both qualified and advanced level, and SAP, Salesforce, Microsoft 365, Microsoft Dynamics, Power Automate, Zapier and Make are all named, though several APIs and the development-facing modules sit on the enterprise plan only; I found no public information on webhooks, SDKs, API versioning or rate limits. 1 2 14
The Skeptic
A documented REST API with a free development license, embedded signing as button, widget or iFrame carrying both qualified and advanced levels via API, and named connectors for SAP, Salesforce, Microsoft 365 and Microsoft Dynamics plus Zapier, Make and Power Automate are all on the pages. However, the pricing page shows general API access on the Enterprise plan only, and we found no public information on webhooks, rate limits, API versioning, SDKs or a status page. 1 2 14
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity, the trust service provider and their owners are, where documents, audit trails and ID data are stored and processed, and who the subprocessors are. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents and signer data are stored, and subprocessors unnamed.
3 — An EU entity contracts, but documents or signer data are processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data storage stated, with a DPA, but the hosting, identification or trust service chain is non-EU-controlled without a stated safeguard.
8 — EU entity, documents, audit trails and ID data stored in named EU data centres, an EU qualified trust service provider, subprocessor list with locations published, and certifications (ISO 27001, ETSI conformity) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity and EU QTSP, every processing location and subprocessor European, customer-selectable data residency, and certifications with their scope published.
The Legal Counsel
The vendor's pages state one hundred percent development and hosting in Europe, hosting in sproof's own ISO 27001 certified data centres, and independence from US providers. But the captured pages leave the contracting entity's details, ownership, data residency and subprocessor exposure unconfirmed, the partner issuing qualified signatures is unnamed, and we found no public information on a subprocessor list or the scope of the certifications. European by the vendor's own claim, not yet European by independent evidence. 1 5 1
The HR Operations Lead
An Austrian company, hosting in sproof's own ISO 27001 certified data centres in Europe with no US Cloud Act dependency and development in Europe — the profile I want for employment records. The data centres are described only as being in Europe without a named location, the qualified signatures are issued by a partner that is not identified further, and I found no public information on subprocessors or their locations. 5 1 1 13
The Revenue Operations Lead
The vendor's own pages state development and hosting 100% in Europe, ISO 27001 certified data centres in Europe, hosting in sproof's own data centre and independence from US providers, from an Austrian entity in Salzburg. But the independently computed sovereignty attributes mark contracting entity, ownership and data residency as unconfirmed, and we found no public information on a named EU trust service provider, a subprocessor list with locations, or customer-selectable data residency — the European story is asserted more than evidenced end to end. 1 3 5 1
The Integration Engineer
Hosting in sproof's own ISO 27001 certified data centres in Europe, development in Europe and independence from US providers are stated repeatedly — but the data centre locations are not named, qualified signatures are issued via a partner of sproof whose identity the captured pages do not give, and we found no public information on a subprocessor list with locations or a published data processing agreement. 1 5 1
The Data Protection Officer
The pages insist on development and hosting in Europe in ISO 27001-certified data centres with no US Cloud Act dependency, but the claims stop at region level: no named data-centre locations, no subprocessor list, and qualified signatures issue through an unnamed partner whose location and ownership are not shown; the independent sovereignty check could not confirm legal-entity jurisdiction, ownership, data residency or subprocessor exposure on the captured pages, which is exactly the chain a data protection officer needs to see. 1 3 5 1
The Skeptic
"100% developed and hosted in Europe" in ISO 27001 certified data centres, "unabhängig von US-Providern" and hosting in a data centre of sproof are stated, and the site claims exclusively European partners — but only for operating the website. The contracting entity's jurisdiction is not confirmed on the captured pages, and we found no public information on ownership, named data centre locations, subprocessors, or the identity of the partner that issues the qualified signatures. 1 5 13 1
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of their signing volume from public pages alone — plan prices, envelope or document limits, the per-signature price of AdES and QES, identification fees, API pricing and overage.
0 — No public prices at all; every plan is a sales conversation.
3 — Plan prices published, but envelope limits, QES and identification fees are unstated — the cost of a qualified signature is unknowable.
5 — Plans with envelope or document limits priced, but at least one commonly incurred cost (per-QES fee, video ident, API access, overage) is missing or "on request".
8 — Every plan and limit priced publicly, AdES and QES priced per signature, identification fees and overage stated, API pricing published, and contract term and notice period given.
10 — Complete cost computability: the cost of a given monthly volume per signature level derivable from public pages, volume tiers published, and every add-on and price-change term on a public page.
The Legal Counsel
The pricing page publishes volume tiers — '100 / Jahr' on the private plan, '1200 / Jahr' on business, 'Individuell' for enterprise — and private use is always free. But we found no public information on the monetary price of the paid plans, the cost of the User+ upgrade that qualified signatures require, the video identification fee, or API pricing. The cost of a qualified signature cannot be computed from what is published. 2 7 5
The HR Operations Lead
The pricing page shows a free private tier, annual advanced-signature quotas stated as "100 / Jahr" for private and "1200 / Jahr" for business, and a clear plan-by-plan feature matrix. I found no public information on the price of the plans themselves, on the User+ upgrade that qualified signatures require, or on identification fees — so the cost of one qualified signature, the number I need before sending two hundred contracts, is not computable from public pages. 2 7 1 5
The Revenue Operations Lead
From the captured pricing page a buyer can see the plan structure and the annual advanced-signature figures of 100 per year on private and 1200 per year on business, enterprise individual — but we found no public information on the monetary price of the plans or of the User+ upgrade that unlocks qualified signing, on identification or per-qualified-signature fees, on API or overage pricing, with premium support sold only as an unnamed "additional fee". The cost of a qualified signature is not computable from what is public. 2 5 7
The Integration Engineer
The plan structure with a free private tier and advanced-signature quotas of "100 / Jahr" and "1200 / Jahr" is public, while the enterprise tier is listed as "Individuell" — but qualified signing sits behind a "User+" upgrade whose price is not stated, and we found no public information on euro prices for the paid plans, per-signature qualified fees, identification fees or API pricing. 2 7 1
The Data Protection Officer
The pricing page publishes tier figures of "100 / Jahr" for private, "1200 / Jahr" for business and "Individuell" for enterprise, with a free private plan and clear plan-level feature gating; I found no public information on the price of the User+ upgrade that carries qualified signatures, on identification fees, overage or API pricing, so the cost of a qualified signature cannot be computed from public pages. 2 5 7
The Skeptic
Plan tiers are published with annual signature counts (private "100 / Jahr", business "1200 / Jahr", enterprise "Individuell", private use free), so the advanced-signature volume is computable. But the price of the User+ upgrade that unlocks qualified signing, the identification fee, API pricing, overage and the premium support surcharge are all unstated, so the cost of a qualified signature is not computable from public pages alone. 2 5 7
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Questions about sproof sign
Is sproof sign European?
Yes. whats-best.ai classifies sproof sign as EU-Made.
Where does sproof sign store data?
The default storage location for customer data is not stated on the vendor’s pages as of 13 Oct 2026. The vendor’s pages mention Europe as hosting location, per the vendor’s page captured 13 Oct 2026.
Does sproof sign have a free plan?
Yes. sproof sign has a free plan, per the vendor’s page captured 13 Oct 2026.
What are the best alternatives to sproof sign?
As of 15 Oct 2026, the panel rates Penneo (2.5/5), Youtrust (Yousign) (2.5/5) and MOXIS (2.5/5) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Penneo (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: sproof sign alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.sproof.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 2 Pricing page www.sproof.com Checked 13 Oct 2026 Details →
- 3 Privacy policy www.sproof.com Checked 13 Oct 2026 Details →
- 4 Legal notice www.sproof.com Checked 13 Oct 2026 Details →
- 5 Terms of service www.sproof.com Checked 13 Oct 2026 Details →
- 6 EIDAS levels & trust services — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 7 EIDAS levels & trust services — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 8 Signer identification — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 9 Signer identification — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 10 Signing workflow & signer experience — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 11 Signing workflow & signer experience — found from sitemap www.sproof.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 12 Evidence, validation & retention — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 13 Evidence, validation & retention — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →
- 14 Integrations & API — found from sitemap www.sproof.com Checked 13 Oct 2026 Details →