Email Signature Compliance: SyncSignature's Deployment-Layer Posture

SyncSignature is not a HIPAA Business Associate and does not sign BAAs. We deploy the HIPAA disclaimer language your compliance team defines. Email signatures are organizational metadata, not PHI. SyncSignature does not access, read, or store the body or attachments of emails. The HIPAA certification chain runs through your underlying email platform (Google Workspace BAA or Microsoft 365 BAA) and your covered entity, not through the signature deployment layer. See our full email signature compliance posture for the deployment-layer breakdown.

No. SyncSignature does not sign BAAs because we are not a Business Associate under HIPAA. We do not access, read, or store email content or PHI. The BAA you need is with your email platform: Google has a signed BAA option for Workspace customers, Microsoft has one for Microsoft 365 enterprise plans. SyncSignature operates on the signature layer only, deploying the disclaimer text your compliance team defines.

SyncSignature is not a FINRA-registered entity. FINRA registration applies to broker-dealers, not to email signature deployment software. SyncSignature deploys the disclaimer language your registered firm defines. Your retention, supervision, and recordkeeping obligations under FINRA Rule 3110 and SEC Rule 17a-4 apply to the email content itself, which lives in your email platform's archive (Google Vault, Microsoft Purview, or a third-party WORM archive). SyncSignature does not store email content.

SyncSignature does not currently hold a SOC 2 Type 1 or Type 2 report. Our infrastructure runs on AWS in India. We use OAuth-scoped access to Google Workspace and Microsoft 365 APIs with the minimum permissions required to manage signatures. We do not access, read, or store email content. If your procurement requires a SOC 2 report from every vendor in your stack, the gap is documented openly here. The downstream certifications you actually rely on for email content (Google Workspace, Microsoft 365) carry SOC 2 reports of their own.

SyncSignature does not currently hold ISO 27001 certification. Our infrastructure runs on AWS, which is itself ISO 27001 certified, but SyncSignature has not pursued an independent audit. We use OAuth-scoped access to Google Workspace and Microsoft 365 APIs and do not store email content. If ISO 27001 is a procurement gate for you, the gap is documented openly.

SyncSignature is GDPR-aligned. We process directory data (name, email, title, department, phone) on behalf of your organization as a data processor, with a Data Processing Addendum available on request. We do not access or store email content. EU-resident user data lawful basis, retention, and subject-access procedures live with your organization as the data controller. We do not hold a formal GDPR certification because none of the major GDPR certification schemes (GDPR-CARPA, Europrivacy) apply to single-feature SaaS at our footprint.

Yes. SyncSignature does not access, read, or store the body, subject, attachments, or recipients of any email. Attorney-client privileged communications never pass through our systems. We operate on the signature settings layer only, deploying the confidentiality and privilege disclaimer language your firm's general counsel defines. The email content remains exclusively inside your Google Workspace or Microsoft 365 tenant where existing privilege protections already apply. See our full email signature compliance posture for the deployment-layer breakdown.

ABA Model Rule 1.6 places the duty of confidentiality on the lawyer and the firm, not on signature software. SyncSignature supports your Rule 1.6 obligations by deploying the confidentiality notice and unauthorized-disclosure disclaimer language your firm defines on every outbound email, without ever touching email content. We do not access, read, or store privileged client communications. The reasonable-effort obligation under Rule 1.6(c) for protecting client information runs through your email platform (Google Workspace or Microsoft 365) and your firm's internal access controls, with SyncSignature handling only the standardized disclaimer footer.

No. SyncSignature interacts only with the signature settings via the Gmail sendAs API and the Microsoft Graph mailbox-settings API. We do not request, receive, or process email subjects, bodies, attachments, recipients, or metadata about messages. The OAuth scopes we request cover signature management only and exclude every Gmail or Outlook scope that would expose message content.

For Google Workspace: gmail.settings.sendas.basic (signature settings only) and userinfo.email / userinfo.profile (account identification). For Microsoft 365: MailboxSettings.ReadWrite (signature settings only) and User.Read (account identification). Excluded scopes that would grant email content access: gmail.modify, gmail.readonly, gmail.send, Mail.Read, Mail.Send, Mail.ReadWrite. The OAuth consent screen lists the exact scopes you grant before any token is issued.

Production infrastructure runs on AWS in the Asia-Pacific (Mumbai) region, ap-south-1. Directory attributes processed for signature rendering are stored in the same region. Email content is never received, processed, or stored. If your procurement requires EU, US, or UK data residency as a hard gate, contact us before signing up.

Yes. A Data Processing Addendum is available on request. SyncSignature processes directory data on behalf of your organization as a data processor. Your organization remains the data controller for EU-resident user data and retains the lawful basis, retention, and subject-access procedures.

We have not announced a public roadmap or target date for SOC 2 Type 2, ISO 27001, or HITRUST. Our compliance focus today is on the deployment-layer model: documenting exactly what we do and do not touch, narrowing OAuth scopes, and aligning with the certification chain customers already trust (Google Workspace BAA, Microsoft 365 BAA, AWS underlying certifications). If a formal independent attestation is a procurement gate for your organization, treat the gap as a current limitation.

Scope SyncSignature as a signature deployment vendor with OAuth-scoped access to signature settings only (no email content access, no PHI, no PCI, no privileged content). The directory data we process (name, title, department, phone, custom fields) is the same data already classified as low-risk corporate metadata in most vendor risk frameworks. SyncSignature does not change your existing HIPAA, FINRA, SEC, ABA, or GDPR exposure because we do not touch the regulated content.

Your last pushed signatures remain on your employees' accounts in Google Workspace or Microsoft 365 because they are written to the platform's native signature settings, not to a SyncSignature server. Some signature management vendors (notably Newoldstamp) have a lock-in model where signatures stop rendering when you cancel because they proxy the signature through their own infrastructure. SyncSignature does not.

Each regulated vertical has its own deployment-layer breakdown: healthcare HIPAA posture, financial services FINRA / SEC posture, law firm ABA Model Rule 1.6 posture, and enterprise procurement posture.