Universign
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Long-running French QTSP (originally Cryptolog International, 2001); merged into Signaturit Group (a Namirial Italian company).
Universign offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under E-signature.
Assessment notes
Universign was a long-running French Qualified Trust Service Provider (originally Cryptolog International, Paris, founded 2001). As of audit time universign.com 301-redirects to signaturit.com under the consolidated Signaturit Group / Namirial portfolio, with Universign now operating as one of four QTSPs inside that European trust-services group. Compliance posture inherits from the consolidated Signaturit Group and was revised at the 2026-07 re-verify: highest eIDAS QTSP qualifications, ANSSI-recognised French QES capability and regular regulator audits remain, but the Namirial parent was acquired by Bain Capital (US private equity) in 2025 (so eu_hq_us_funded, not eu_owned), and the shared Signaturit Platform runs at rest on Amazon Web Services with Twilio/SendGrid (US) for OTP and email (so cloud_act_exposure: material, not none). See the Signaturit listing and data/sub-processors/signaturit.yaml for the mapped detail; score 3/5, same tier as Signicat.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Universign
Universign is a long-running French Qualified Trust Service Provider originally founded in 2001 as Cryptolog International in Paris, one of the earliest French entrants in qualified electronic signatures, time stamping, and certificate authority services under the eIDAS framework (and ANSSI's national supervision). The platform built a strong reputation for QES (Qualified Electronic Signature) workflows used by French banks, insurance carriers, and public-sector buyers; before consolidation it operated as one of the four legacy French QTSPs alongside Yousign and Docaposte.
As of audit time universign.com 301-redirects to signaturit.com: Universign has been consolidated into the Signaturit Group (itself now a Namirial Italian company) and operates as one of four QTSPs inside the unified group. This consolidation simplifies procurement: a single contracting relationship gives buyers access to French ANSSI-attested QES via the Universign-legacy infrastructure, Spanish QTSP capabilities from the original Signaturit Solutions stack, and EBSI-prepared digital identity from the 2025-acquired Validated ID asset. The aggregate group sits inside the EU regulatory framework with Italian + Spanish + French national bars covered.
Best fit: existing Universign customers retained through the consolidation; French enterprises specifically requiring ANSSI-recognised QES; multi-country EU regulated workflows (financial services, insurance, public administration) that benefit from the consolidated multi-QTSP umbrella. Pricing is enterprise / volume-based and aligned with the broader Signaturit Group catalogue; see the parent listing for category context. Universign-branded and Signaturit-branded contracting sit under the same Namirial parent, so they now share the same sovereignty profile: a US-private-equity ultimate owner (Bain Capital, since 2025) and AWS hosting at rest. Buyers who need French ANSSI-supervised QES should compare Youtrust (formerly Yousign), though the sub-processor list it published on 2026-07-02 names AWS, Microsoft Azure and Google as cloud infrastructure and storage, so it no longer offers a US-free at-rest path either; buyers who can accept a Swiss jurisdiction should compare Skribble, whose signed documents sit with Swiss and German providers even though its CLOUD Act exposure is recorded as Minor.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Universign
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Austria · $10/moUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
SpainEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Eversign (Xodo Sign)
Austria
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$10/mo |
Signaturit (Namirial)
Spain
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Signicat
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |