Skip to content
EU VETTED

E-signature

E-signature platforms process signed contracts, identity verification data, and in some cases qualified certificate credentials. For EU buyers, eIDAS compliance determines legal validity across the EU, and operator jurisdiction determines data sovereignty. On the sovereignty axis the cleanest option is Skribble (Switzerland, Swiss-law, non-US corporate structure, and the only option here with no US-owned provider holding signed documents at rest, though its DPA names Cloudflare and four other US processors around that core). Universign (France) and Signaturit/Namirial (Spain) remain eIDAS-qualified QTSPs with strong track records, but both are now US private-equity owned and hosted on AWS at rest, so they carry material CLOUD Act exposure.
See e-signature with zero US sub-processors

Showing all 7 alternatives in this category

Source: EU Vetted dataset, 7 products, methodology v2026.05, as of Aug 2026.

About E-signature

E-signature platforms are the digital infrastructure for binding agreements: they route contract documents to signers, capture legally attributable electronic signatures, and retain signed documents with their accompanying audit trails as legal evidence. The category spans simple click-through consent tools, advanced electronic signature (AdES) platforms used for most commercial contracts, and qualified electronic signature (QES) services backed by accredited Trust Service Providers, the latter being legally equivalent to a handwritten signature across all EU member states under eIDAS.

This category carries high stakes on two separate axes: legal validity and data sovereignty. Legal validity comes first: for contracts to be enforceable and courts to recognise them, the signature level must match the requirement, and for regulated transactions, QES from a qualified Trust Service Provider is mandatory. Data sovereignty is the second axis: signed contract documents, counterparty identity data, and biometric or ID-verification records are some of the most legally sensitive data an organisation processes. If the platform operator is a US-incorporated entity, or ultimately US-owned, or hosts on a US-owned cloud, the CLOUD Act can in principle compel production of those records regardless of storage location. On this axis Swiss-based Skribble is the cleanest option: it offers QES under Swiss ZertES, brokered through Swisscom IT Services Finance S.E. as the eIDAS-qualified provider, and its non-US corporate structure keeps signed documents on Swiss infrastructure with no US-owned provider at rest. Its published DPA names five US-incorporated processors around that core, Cloudflare, SparkPost, Chargebee, Userpilot and Clay Labs, which is why its exposure is recorded as minor rather than none. Universign (France) and Signaturit/Namirial (Spain) remain eIDAS-qualified Trust Service Providers with strong track records, but both are now US private-equity owned and hosted on Amazon Web Services at rest, so they carry material CLOUD Act exposure and are no longer the EU-owned, exposure-free picks they once were. Yousign (France) is EU-headquartered but carries a US-funding signal that buyers should evaluate. Eversign/Xodo Sign reflects US corporate ownership despite Austrian operations, which means CLOUD Act exposure applies.

Country of incorporation, ownership signal, supported eIDAS signature level, and sovereignty signals sit alongside each listing below. The signature-level filter is worth reaching for first, since it separates QES-capable platforms from those offering AdES or SES only; the ownership filter narrows further by sovereignty requirement.

Feature comparison

Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.

Table 2Capabilities by product
Feature Tresorit eSign Eversign (Xodo Sign) Signaturit (Namirial) Signicat Skribble Universign Youtrust
Qualified signature (QES) Yes No Yes Yes Yes Yes Yes
Advanced signature (AES) No No Yes Yes Yes Yes Yes
Audit trail Yes Yes Yes Yes Yes Yes Yes
Templates No Yes Yes Not assessed No Yes Yes
Bulk send Not assessed Yes Yes Not assessed Not assessed Not assessed Yes
In-person signing Not assessed Yes Yes Not assessed Not assessed Yes Yes
ID verification Yes Not assessed Yes Yes Yes Yes Yes
API / webhooks No Yes Yes Yes Yes Yes Yes

Source: vendor documentation, as of Aug 2026.

Switching from US e-signature?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

Frequently asked questions

What is the best EU-hosted e-signature platform?
On the sovereignty axis, Skribble (Switzerland) is the cleanest option: it operates under Swiss law with a non-US corporate structure and keeps signed documents on Swiss infrastructure, with IONOS in Germany for German customers, so no US-owned provider holds them at rest. Its published DPA does name five US-incorporated processors around that core, Cloudflare, SparkPost, Chargebee, Userpilot and Clay Labs, which is why its exposure is no longer recorded as none. It offers qualified electronic signatures under the Swiss ZertES standard with cross-recognition to eIDAS through bilateral arrangements. Universign (France) and Signaturit/Namirial (Spain) are eIDAS-qualified QTSPs with strong track records, but both are now US private-equity owned (Namirial by Bain Capital, Signaturit by PSG Equity, merged in 2025) and hosted on Amazon Web Services at rest, so they carry material CLOUD Act exposure rather than being sovereignty picks. Yousign (France) is a widely used EU-headquartered alternative with a strong track record in the SMB market, though it has received US investment which buyers with strict sovereignty requirements should evaluate.
Is there a GDPR-compliant e-signature tool?
Any e-signature platform operated by an EU-incorporated company with EU-only infrastructure and a published DPA qualifies as GDPR-compliant in its processing role. Universign (France), Signaturit/Namirial (Spain), and Yousign (France) all publish DPAs. E-signature platforms process identity data and signed document content, making them a high-priority category for data-processing impact assessments. What a published DPA shows is process, not proof against every incident; check it against your own document types and signer data.
Does e-signature data fall under the US CLOUD Act?
E-signature platforms retain signed contract documents, signer identity data (name, email, and sometimes biometric or ID-verification data), and audit trails. If the platform is operated or ultimately owned by a US-incorporated company, or hosts data on a US-owned cloud, the CLOUD Act can in principle compel production of those records. Exposure has to be assessed per operator: Skribble (Switzerland) has a non-US corporate structure and keeps signed documents on Swiss infrastructure with no US-owned provider at rest, so it avoids that direct exposure, though its DPA names Cloudflare and four other US processors around that core, whereas Universign (France) and Signaturit/Namirial (Spain) are now US private-equity owned and host on Amazon Web Services at rest, which brings them within material CLOUD Act reach despite their EU incorporation. This is particularly relevant for contracts involving trade secrets, M&A activity, or regulatory filings.
What does eIDAS mean for e-signature platforms?
eIDAS (Electronic Identification, Authentication and Trust Services) is the EU regulation that defines three legally recognised signature levels: Simple Electronic Signature (SES), Advanced Electronic Signature (AdES), and Qualified Electronic Signature (QES). A QES has the same legal effect as a handwritten signature across all EU member states and is the standard required for land registry transactions, notarised documents, and certain regulated financial agreements. Universign and Signaturit/Namirial both offer QES. Skribble offers QES under the Swiss ZertES standard.
What is the difference between a simple, advanced, and qualified electronic signature?
A Simple Electronic Signature (SES) is any electronic mark indicating consent: a typed name or an image of a signature. An Advanced Electronic Signature (AdES) is linked to the signer's identity through a certificate and detects post-signing tampering. A Qualified Electronic Signature (QES) requires a Qualified Trust Service Provider (QTSP) and a secure signing device; it has the highest legal standing under eIDAS and is equivalent to a handwritten signature in all EU countries. Most B2B contracts require AdES or QES for court-admissible evidence; some regulated industries require QES specifically.
Is DocuSign or Adobe Sign safe to use for EU contracts?
DocuSign and Adobe Sign are both US-incorporated companies. Signed contracts and identity data processed through their platforms fall within CLOUD Act reach, regardless of where data is physically stored. Both offer EU data residency options as add-ons on enterprise plans, but data residency does not remove CLOUD Act exposure since it is the corporate structure, not the storage location, that matters for CLOUD Act purposes. EU buyers with strict sovereignty or sector-specific compliance requirements are better served by EU-incorporated alternatives.
What about Yousign, is it fully EU-owned?
Yousign is a French company with strong EU market presence. Its ownership signal is eu_hq_us_funded, meaning it has received US investment, which can introduce potential CLOUD Act exposure at the parent-group level depending on corporate structure. Universign (France) and Signaturit/Namirial (Spain) share the same limitation and then some: both are now US private-equity owned and hosted on Amazon Web Services at rest, so they carry material CLOUD Act exposure and are not the sovereignty picks either. For buyers whose requirement is strict sovereignty without US ownership or US cloud dependency, Skribble (Switzerland), with its non-US corporate structure and no US-owned provider holding signed documents at rest, is the stronger choice, though its DPA does name Cloudflare and four other US processors around that core. For buyers whose primary concern is eIDAS compliance and GDPR-compliant processing rather than sovereign ownership, Yousign remains a solid and widely used option.