Snapshot 25072
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Verifieddocspring.com DocSpring, Inc. Trust Center Compliance and Security Overview This Trust Center provides transparent visibility into DocSpring, Inc.'s security, compliance, governance, and trust documentation, giving your procurement and security teams everything they need in one place. 22 Policies Questionnaire availabledocspring.com Compliance All active SOC 2 Type 2 Compliant GDPR Compliant HIPAA Compliant 3 Frameworks 22 Policies 7 Subprocessors 1 Documents 22 Policies Internal policies that govern how we operate and protect customer data. Acceptable Use Policy Capacity and Performance Management Policy Endpoint Protection Policy Logging Policy Privacy Policy HR Policy Vulnerability Management Policy Secure Development Policy 35 Controls Safeguards continuously monitored across our infrastructure and processes. Acceptable Use Access Rights Asset Inventory Change management Configuration & Patch Management Credential Management Data Privacy Data Retention & Destruction 7 Subprocessors Third parties that process data on our behalf under strict contractual safeguards. 1Password (AgileBits Inc.) Password manager and secrets management service. SC-3730 verification, 23 September 2026: Authenticated account-domain metadata and 1Password's region mapping establish US secure-vault storage for DocSpring's account. Published business terms and DPA identify AgileBits Inc., Canada; the business subscription terms incorporate the DPA. Published DPA v4.8, revised 30 July 2026, includes EU controller-to-processor SCCs and a UK addendum. The secure-vault region does not establish that every support or service-metadata operation occurs only in the US. No routine customer PDF-content processing is inferred from password management. Exact historical order-form/terms version was not retrieved. Sources: https://support.1password.com/regions/ ; https://1password.com/legal/terms-of-service ; https://1password.com/files/legal/agilebits-dpa-012026.pdf . Amazon Web Services Cloud computing platform providing hosting, storage, and database services. CircleCI Continuous integration and continuous delivery platform. Google Workspace (Google LLC) Cloud productivity suite and identity provider. SC-3730 verification, 22 September 2026: DocSpring's Google Workspace invoice dated 31 August 2026 identifies Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Source: Gmail message 1a062a8f2296eccb, invoice 5673766768.pdf (extracted invoice header). This corrects the parent-company label Alphabet Inc.; it is the same supplier record. Workspace mail/Drive may process customer content shared for support. Published CDPA: https://cloud.google.com/terms/data-processing-addendum/ . Account-specific acceptance and region/retention settings have not been verified by this invoice. SC-3730 follow-up, 22 September 2026: Marked as a support subprocessor where Gmail/Drive handle customer-provided support contents or attachments, in addition to business-data processing. Google Workspace's 16 February 2023 account notice (Gmail 1865c12cf95afa5b) confirms that section 5.2 ties customer-data processing to the CDPA. The 16 August 2023 notice (189fe1155d382cd1) describes automatic CDPA updates where already incorporated and asks non-EMEA customers subject to European law to record that applicability in the Admin console. Do not treat a missing separately signed PDF as proof of missing terms. Current Google terms incorporate CDPA URL terms, but September 2026 master-term changes take effect at renewal, so an exact accepted version and any non-EMEA applicability setting remain to verify. Sources: https://workspace.google.com/terms/premier_terms/ and https://cloud.google.com/terms/data-processing-addendum/ . SC-3730 verification, 23 September 2026: The page 2 extraction of the August 2026 invoice (Gmail 1a062a8f2296eccb, 5673766768.pdf) identifies Google Workspace Business Starter and its Archived subscription. Google's current edition comparison does not provide a selectable data-region policy for Business Starter. This resolves the question for the invoiced edition: do not describe Workspace as pinned to the US or EU. It does not establish the physical location of each stored item, a later subscription change, the European-law applicability setting or actual disposal settings. Source: https://knowledge.workspace.google.com/admin/compliance/compare-data-region-features-across-google-workspace-editions . Notion (Notion Labs, Inc.) Knowledge management and project tracking workspace. SC-3730, 22 September 2026: Notion Labs, Inc. is the named service provider in its published DPA. Notion's GDPR guidance states that its DPA is incorporated where GDPR applies: https://www.notion.com/help/gdpr-at-notion . A missing standalone signature is not by itself a gap. Current role is business documentation; the proposed customer DPA authorizes conditional restricted support/incident documentation if customer-instructed contents are shared. That conditional authorization is not evidence that production document contents are routinely sent to Notion. Verify workspace regions, retention and applicable AI features against actual use. Existing role flag is retained pending confirmation of customer-content use. 1 Documents Reports, DPAs, and security artifacts. CPA Signed _ DocSpring Inc. _ Final Report_SOC 2 Type 2.pdf NDA DocSpring, Inc. - Security Trust Center