What data is stored on the device?
Android: Generally speaking we store metadata about the envelopes the user has access to, user data, and account data. If the user is using offline functionality and is downloading envelopes to the device for offline use, we store the actual PDFs in that case.
iOS: We store data that is required for envelopes and signing, such as e-mail addresses of senders / recipients, tags, document PDFs, and preview thumbnail images in the device’s Core Data storage. Passwords and tokens are stored in the device’s keychain.
What data is transferred to and from the devices?
Primarily envelope (e.g. documents, tags) user (e.g. e-mails, names, passwords), and account (e.g. names, plans) data is transferred between our backend servers and our mobile apps. We do also support importing documents from third-party sources (e.g. Google Drive) into our mobile apps for the purposes of sending / signing.
How is data transmitted to and from the devices?
Our mobile apps interface with our DocuSign REST APIs over HTTPS to communicate with our backend servers.
Is the data encrypted at rest on the phone?
Android: Yes, user data (name, email, push notification ID, access token, etc) is encrypted at rest. Everything else is unencrypted. Storage on Android is silo-ed, meaning that no other app can access data we store.
iOS: Yes using native OS security/encryption methods, but it only works when the device is password protected.
Can a user or the company do a remote wipe of their data?
Android: The user can always uninstall the app, which would wipe everything. Also if the company is utilizing Android for Work, the AFW administrator can wipe app data remotely.
iOS: Apple has a feature that allows users to remotely wipe their device’s data entirely that users can set up, but we do not currently support remotely wiping specifically just the DocuSign iOS app’s data.
What is the authentication model on the devices?
DocuSign supports standard username / password login with two-factor authentication support. We also support Single Sign On if customers choose to use their own identity provider to manage access to DocuSign.
What happens with the data from an app that connects via SSO when the AD account gets turned off?
Android: Nothing would happen to the app or the mobile device at that time. If the access token and refresh tokens were disabled/expired as the result of this operation, then the user would be logged out the next time they attempt to open or access the app.
iOS: The data for the logged-in user would still be on the device at the time the AD account is turned off. However, if the user were to open the iOS app after that point and the user’s Account Server access / refresh tokens had been forced to expire in the back end, the app would log the user out.
What application and other settings or certificates must be on the devices to connect?
No other application is required. However, administrators who set up SSO may have additional requirements from the identity provider.
What's our formal answer for MDM support?
Android: The Android app supports Android for Work.
Who do I contact with questions about this document?
DocuSign sends email notifications on behalf of its users. You can simply "reply to" the email notification to contact the sender of the document with questions.
Often times, only the sender of the document can assist you with inquiries regarding the following:
- The contents of the document / errors in the document
- For questions about the contents of the document or to request correction of errors in the document please contact the sender.
- Access codes / Authentication
- If you never received an access code or are having trouble with the access code, the sender can provide the correct code or resend the envelope with a new code.
- Failed authentication
- If you fail authentication three times, you must contact the sender to have them resend the envelope with a new code.
- Envelope not accessible / Envelope correction in progress
- If the sender is correcting the envelope, they must finalize their corrections before you can access the document. Please contact sender regarding the corrections.
- Finish button does not appear
- If the Finish button is not appearing, it is due to one or more incomplete required fields. Once a page has had all required fields met – A green check mark appears. If this does not resolve the issue, please reach out to the sender of the document to ask them to investigate. One possibility is that the document has overlapping tags, which can only be corrected by the sender.
How do I know who sent me this document?
The notification email you received contains the name and email address of the sender - to contact the sender, please use the email address included in the notification.
Why do I keep getting notifications - how do I stop these?
DocuSign sends email notifications on behalf of its users. Each sender has the ability to set how often to send email reminders.
Your options to stop receiving email reminders to sign:
- Decline to sign
- Complete signing
- Contact the sender and ask them to Void/Cancel the document. You can simply "reply to" the email notification to contact the sender of the document.
How do I download documents from my account?
To download your completed documents from your account, follow these steps:
- Log in to your DocuSign Account.
- Open up the completed document that you would like to save.
- You will see this menu at the top of the page, click the icon with the down arrow.
- You will get the option to download as separate PDFs or combined PDFs.
- Separate PDF - This will download the documents as the sender uploaded them. (For example, an envelope sent with two different documents will be downloaded as a ZIP file containing the two documents).
- Combined PDF - This will combine all documents into a single PDF.
Note: Documents over 5MB will not be attached to the confirmation email after signing, you will have to download them using this method.
Why am I unable to access the envelope?
It could be that someone forwarded you their DocuSign email. Best Practice - do not forward DocuSign email notifications
lf you are not a party (sender or recipient) to the envelope, you will be unable to access for security reasons.
You can request that the sender uses the DocuSign forward feature to provide you a copy of the completed envelope.