DocuSign changed its email delivery sub-processors in September 2026.
In September 2026, DocuSign announced a sub-processor update for its eSignature and Intelligent Agreement Management services. Mailgun was removed for email delivery, and Amazon Simple Email Service added Australia, Canada and Japan as processing locations.
The same month, DocuSign added Government Products to the service schedules that can govern purchases under its Master Services Agreement.
In August 2026, its Privacy Policy began naming Clay as a third-party provider of marketing contact data.
What DocuSign’s documents say about client data.
Quoted from the current version of each document. The right-hand column shows how many of the 75 vendors we monitor have a matching clause.
Using customer data to train AI
Addressed“For clarity, if Customer uses other Docusign Services and has consented to Docusign AI/ML Training within such other Docusign Services, the Docusign AI/ML Training rights shall not extend to the Analytics Services.”
Sharing data with third parties
Addressed“Certain features of third party integrations may use, transfer, and/or store Your Customer Data or information outside of the Services, and Docusign is not responsible for any such use, transfer, or storage.”
What changed, and when.
Notable changes since monitoring began in April 2026, newest first. Each is written from our automated comparison of the before and after versions, then reviewed by a person.
Removed Mailgun and expanded Amazon SES locations for email delivery
Applies to eSignature and Intelligent Agreement Management. Amazon SES now lists Australia, Canada and Japan as processing locations.
Added a Government Products schedule under the Master Services Agreement
Government Products joins the service schedules and attachments that can apply to purchases under the MSA.
Named Clay as a source of marketing contact data
The Privacy Policy says DocuSign obtains marketing contact data from Clay, and keeps minimum data to honour email opt-outs.
Removed Syria from the MSA’s sanctioned territories
The Restricted Party definition now lists Cuba, Crimea, Iran and North Korea.
+ 10 other updates detected, such as formatting, page layout and wording changes.
- Oct 5, 2026: Docusign App Center Terms
- Oct 3, 2026: Docusign Digital Signature Service Attachment
- Oct 2, 2026: Docusign App Center Terms
- Sep 30, 2026: Docusign Digital Signature Service Attachment
- Sep 18, 2026: DocuSign Services Subprocessor List
- Aug 14, 2026: DocuSign Services Subprocessor List
- Aug 6, 2026: DocuSign Services Subprocessor List
- Aug 4, 2026: Privacy Policy
43 DocuSign documents.
Sub-documents are other DocuSign documents that its policies link to, such as addenda and product terms. We list the ones identified so far; there may be others.
Who else touches the data.
Third parties DocuSign names in its own documents.
DocuSign terms: common questions.
When did DocuSign last update its sub-processor list?
DocuSign announced a sub-processor update on September 18, 2026, removing Mailgun for email delivery and adding Australia, Canada and Japan as Amazon SES processing locations.
Does DocuSign use customer data for AI training?
DocuSign’s service schedules refer to customers consenting to “Docusign AI/ML Training”. Its Insight and Analyzer schedule says those training rights don’t extend to its Analytics Services.
Which DocuSign documents does Legal Sentinel monitor?
43 public documents, including the Privacy Policy, Data Protection Attachments, Services Subprocessor List, AI Attachment, Master Services Agreement and service schedules.