Q39
Are you PCI DSS compliant? At what level?
PCI DSS compliance claim found on trust page (Vendor attested)
Public evidencemedium confidence
DocuSign Vendor Risk & Security Assessment
ThirdProof independently checks public intelligence sources to show what your team can verify about DocuSign before DocuSign sends a questionnaire or a security document.
DocuSign's SOC 2 report is confidential. There is no public registry for SOC 2, so the report itself has to come from DocuSign — ThirdProof does not hold or distribute it. What this page gives you is an independent assessment built from evidence anyone can check, and a record of which certifications are registry-verified versus claimed on DocuSign's own trust page.
✓ FedRAMP Certified — Class C (Moderate) Checked August 2026.
Docusign IAM eSignature is FedRAMP Certified at Class C (Moderate) via the Agency path (package F1609267945).
Risk
Tier 4 — Low RiskEvidence confidence
100%26 of 27 sources returned data
Questionnaire
115 / 133 answered86% from public evidence
Last assessed
Aug 27, 2026Evidence confidence measures how much of the evidence ThirdProof set out to gather it was able to gather and corroborate. It is not a statement that every fact about this vendor is known.
🟡IP Reputation: Abuse score: 2%, 1 report🟡SSL/TLS: TLSv1.3🟢Domain Age: 27.2 years🟢Infrastructure: 2 open ports, 0 CVEs
- FedRAMP Status
- DocuSign is listed on the FedRAMP Marketplace — Independently verified (checked August 2026).
- SOC 2 Status
- DocuSign — SOC 2: Vendor attested — trust page. SOC 2 reports are confidential with no public registry, so compliance status is not publicly verifiable. Request the full Type II report and bridge letter directly from the vendor.
- Sanctions Screening
- DocuSign returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
- Risk Tier
- ThirdProof assigned DocuSign a Low Risk tier across 27 intelligence sources, 26 of which returned usable evidence (evidence confidence 100%).
27 sources queried, 26 returning usable evidence. The DocuSign assessment ThirdProof has already run covers both a risk report and an auto-filled security questionnaire, with anything the evidence could not settle listed as an open question.
Get the Latest DocuSign Vendor Assessment →Full risk assessment + 133-question security questionnaire|Free · Delivered by email
Certification & Compliance Status
Security questionnaire — auto-filled
115 questions answered before DocuSign responds.
ThirdProof used public evidence to pre-fill 86% of a 133-question vendor security questionnaire — without waiting for DocuSign. The remaining 18 are listed as open, so the follow-up you send is short and specific.
Q37
Do you have a current SOC 2 Type II report?
SOC 2 Type II: Vendor attested — trust page
Public evidencemedium confidence
Q42
Are you GDPR compliant? Do you have a DPA available?
Docusign operates on internal privacy and data protection policies aligned to industry best practices, including international regimes, such as the GDPR...undergoes rigorous review and approval by the Irish Data Protection Commission...Binding Corporate Rules (BCRs)
Public evidencemedium confidence
Q40
Are you HIPAA compliant? Do you sign BAAs?
HIPAA compliance / BAA claim found on trust page (Vendor attested)
Public evidencemedium confidence
Q23
Is data encrypted at rest? What encryption standard is used (e.g., AES-256)?
Docusign will encrypt Customer Data using industry-recognized encryption standards and protocols, including cryptographic algorithms that meet or exceed current best practices and secure key management practices.
Public evidencemedium confidence
+ 110 additional evidence-backed answers
Get the Complete DocuSign Assessment →
See all 133 questions, evidence links, findings, and the vendor follow-ups still required.
What you can verify before DocuSign sends anything
Independent evidence settles part of the review. The rest still needs the vendor.
Public evidence establishes
- FedRAMP — independently verified
- No Sanctions Matches Found
- FedRAMP Authorization Independently Verified
- FedRAMP Authorization Confirmed via Registry
- No SEC Enforcement Filings Found
- Legal Entity Actively Registered
Still requires vendor confirmation
- Current SOC 2 report and its audit scope
- Data Security — 4 of 14 questions need vendor input
- Access Control — 3 of 12 questions need vendor input
- Incident Response — 2 of 10 questions need vendor input
- Vulnerability Management — 2 of 8 questions need vendor input
Reviewing DocuSign for your company?
Get the complete ThirdProof assessment now, then use the same workflow to assess the rest of your vendor stack.
5 vendors free · No credit card
Need ongoing vendor reviews? ThirdProof includes up to 50 vendor assessments per month for $399. See pricing
Executive Summary
Narrative analysis for DocuSign
DocuSign is a mature, publicly traded electronic signature and agreement management platform with a strong security posture and a Tier 4 (Low Risk) rating.
Area Requiring Attention
The vendor demonstrates robust governance and compliance infrastructure, including FedRAMP authorization for DocuSign CLM at the Moderate impact level, multiple vendor-attested certifications (ISO 27001, SOC 2 Type II, SOC 1 Type II, PCI DSS), a designated Chief Information Security Officer, and comprehensive security controls documented in published data processing agreements and security attachments. Infrastructure exposure is minimal with only standard web ports (80, 443) exposed, clean domain reputation across threat intelligence databases, and no critical CVEs detected.
The full risk rationale, every finding and the recommended vendor follow-ups are in the complete assessment below.
Independence Statement
All evidence in this assessment was independently sourced from public registries, threat intelligence platforms, domain analysis tools, and vendor-published trust documentation without vendor participation.
Investigation Findings
4 findings identified for DocuSign
4 low
low
Adverse media coverage detected
Adverse media coverage identified one article from September 2025 documenting a class action lawsuit against DocuSign with ongoing litigation and potential settlements. The article title ('Docusign Class Action Lawsuit Details and Litigation Exposed') suggests litigation remains active. …
Source:Adverse Media Scancgaa.org →
low
Moderate security header configuration
HTTP security scanner HTTP security scan returned a grade C (score 55/100) for the docusign.com marketing site. The scan found 8 passing security header tests but 2 failures, specifically missing Content-Security-Policy and X-Frame-Options headers. …
low
Threat intelligence pulses detected
DocuSign appears in 50 Open Threat Exchange threat intelligence pulses. Large, globally used SaaS vendors accumulate threat intelligence references because threat actors actively phish or impersonate them (as evidenced by historical media mentioning 'Docusign phishing' attacks). …
low
Minimal IP abuse reports
The primary IP address (15.197.167.90) associated with docusign.com has an IP reputation service confidence score of 2% with 1 reported incident. This IP is registered to Amazon Technologies Inc. and classified as Content Delivery Network infrastructure. …
Source:IP Reputationabuseipdb.com →
✓
Security Strengths
Evidence that positively supports DocuSign's posture
Neutral observations, source coverage notes and items ThirdProof could not independently establish are recorded separately in the complete assessment — they are not counted as strengths.
✓
No Sanctions Matches Found
Sanctions & Watchlist Screening →✓
FedRAMP Authorization Independently Verified
Trust & Compliance Page Scan →✓
FedRAMP Authorization Confirmed via Registry
Certification Registry Verification →✓
No SEC Enforcement Filings Found
SEC Filing Search →✓
Legal Entity Actively Registered
Business Registration →✓
Clean domain reputation
Threat Intelligence →✓
Clean Safe Browsing Status
Malware & Phishing Check →DocuSign complete vendor assessment
Tier 4
Low Risk
115 / 133
questionnaire answers
27
sources checked
Aug 27, 2026
assessment date
- Complete 133-question security questionnaire
- Evidence behind every answered item
- Full findings and risk rationale
- Recommended vendor follow-ups
- Source and evidence inventory
- Source-cited PDF assessment
Risk tiers are set by a deterministic rules engine. AI summarises sourced evidence and writes the narrative; it does not assign the tier. Read the full methodology.
Compliance Resources
→ HIPAA Vendor Risk Assessment with ThirdProof→ CMMC Level 2 Supply Chain Risk Assessment→ ABA Model Rule 1.6 Vendor Due Diligence for Law Firms→ FedRAMP Authorized Vendor List→ FedRAMP Vendor Authorization Status Guide→ Sanctions Screening for Vendor Due Diligence→ Vendor Due Diligence Checklist→ All 27 Intelligence Sources
Frequently asked about DocuSign
Does DocuSign have SOC 2 Type II?+
DocuSign states that it maintains SOC 2 on its trust page. Because SOC 2 reports are generally confidential and there is no public SOC 2 registry, ThirdProof classifies this as vendor-attested until the current report and its scope have been reviewed. Request the report directly to confirm the audit period and which systems are in scope.
Is DocuSign on the OFAC sanctions list?+
DocuSign returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of August 2026.
What is DocuSign's vendor risk tier?+
ThirdProof assigned DocuSign a risk tier of Low Risk as of August 2026, with an evidence confidence of 100% across 27 intelligence sources. Evidence confidence describes how much of the evidence ThirdProof set out to gather it was able to gather — not certainty about every fact concerning DocuSign.
Has DocuSign had any data breaches or security incidents?+
ThirdProof's assessment as of August 2026 records 1 incident-related finding for DocuSign. The most severe concerns adverse media coverage detected. Each finding states whether the incident affected DocuSign's own systems, a customer's environment, or a third party — a distinction that changes what you should ask about — and links to the source it was drawn from. The complete assessment carries all of them with their evidence.
Is DocuSign PCI DSS compliant?+
PCI DSS compliance claim found on trust page (Vendor attested) ThirdProof records this from DocuSign's published compliance evidence; request the current Attestation of Compliance to confirm the scope that applies to your integration.
Does DocuSign support HIPAA and sign BAAs?+
HIPAA compliance / BAA claim found on trust page (Vendor attested) If protected health information is in scope for your use, confirm BAA availability in writing before contracting.
Can ThirdProof pre-fill a DocuSign security questionnaire?+
Yes. ThirdProof answered 115 of 133 questions (86%) about DocuSign from public evidence, before contacting the vendor. Each answered item carries the evidence it was drawn from. The remaining 18 are listed as open, so the follow-up you send DocuSign is short and specific.
What evidence should I request from DocuSign?+
Public evidence settles a large part of the review, so the request you send should be short. Ask DocuSign for the current SOC 2 report and, where applicable, a bridge letter covering the period since the report date; the audit scope — which systems and services the report actually covers; written answers on data security, access control, incident response; contractual commitments, cyber insurance, and the current subprocessor list. Everything ThirdProof could already establish is recorded with its source, so you are not asking DocuSign to re-confirm what is already documented.
Represent DocuSign? Submit updated security evidence.
If DocuSign is in your vendor stack, can you prove you assessed them?
SOC 2 CC9.2, HIPAA, PCI DSS and CMMC all require documented vendor due diligence — not just knowing the answer, but holding evidence that you verified it. The DocuSign assessment above is already written; ask for it and it lands in your inbox.
✓ This assessment: free, no account required✓ Your first 5 vendor investigations are free✓ No credit card required