How to choose a Canadian e-signature provider

Where the data and backups live

Ask where the documents, the backups and the audit trail are stored, and where signers’ names and email addresses go. Our guide to where signed documents are stored lists the questions and the rules behind them.

Several providers, including DocuSign, offer a Canadian hosting region. Ask whether it applies to your plan or account, and what data still leaves it.

Two rules to keep in mind: you remain responsible for personal information you send to a provider for processing (PIPEDA, Schedule 1, clause 4.1.3), and in Quebec a business must conduct a privacy impact assessment before personal information is communicated outside Quebec (Act respecting the protection of personal information in the private sector, s. 17).

Who owns and operates the service

A Canadian data centre and a Canadian company are two different facts. Ask who owns the provider, who operates the service day to day, and which other companies (subprocessors) handle your data.

Ask, too, whether the hosting location is written into your contract, or only described as how the service runs today.

English and French signing

Check that signers can read the signing screens, the consent to sign electronically and the emails in French as well as English, and choose their language.

In Quebec, a contract of adhesion must first be given in French (Charter of the French language, s. 55). For a contract made through a website or an app, the Office québécois de la langue française says the duty is met when the French standard clauses are given to the adhering party, or when the website or app is available in French and the French version of the contract is accessible on it.

A French signing screen does not make the contract French: it is the French version of the contract itself that the Charter asks for.

The record you keep

If a signature is challenged, the party relying on the record has to show it is what it claims to be, and its integrity can be shown through the system that stored it (Canada Evidence Act, ss. 31.1 and 31.2; Ontario Evidence Act, s. 34.1). In Quebec, a signature on a technology-based document can be set up against the signer if the document’s integrity is ensured and the link between the signature and the document has been maintained since signing (Act to establish a legal framework for information technology, s. 39).

So compare what you keep at the end: the completed PDF, a certificate that lists each signer’s steps, a history of events that shows any change, and whether you can download all of it yourself.

Identity checks

An emailed link is the usual starting point. Ask which further checks are offered, such as an access code the sender gives the signer separately, a code sent by text message, or a check of government-issued ID, and what each one adds to the record.

Under some provincial acts, documents named in regulations need a signature that is reliable for identifying the person (Ontario Electronic Commerce Act, 2000, s. 11(3); Alberta Electronic Transactions Act, s. 16(2)).

Security assessments

Ask which independent security assessments the provider can share, such as a SOC 2 report or an ISO/IEC 27001 certificate, and what each one covers.

Price and plans

Many e-signature services are sold per user, with features spread across plans. Work out the cost for your own volume, and check which plan carries each feature you need, including the Canadian hosting region.

Integrations

List the systems the service has to connect to. Some providers offer a large catalogue of ready-made integrations; others offer an API that your team or a partner connects. Check which you need before you choose.