Dropbox Sign
Hosted e-signature for sending, signing and tracking agreements.
Jobs Sign
Operated by Dropbox
Opens the vendor's own site.
Jobs covered
Open a task to see exactly what the vendor documentation supports.
Sign
Browse all sign toolscreating and sending a signature request through the Dropbox Sign API from uploaded or URL referenced documents, delivered to signers by email, with signers added by name and email address and an optional order, grouped signers, CC recipients, fields placed per document as signature, initials, date signed, text, checkbox, radio, dropdown or hyperlink fields or through text tags, and signature options allowing a signature to be drawn, typed or uploaded, where the API returns a signature request id, a signing URL and per signer status with signed timestamps and the completed files are available through the files endpoints
Where your files are processed
Reported to upload your files
The vendor states that files are uploaded to their servers. We have not independently tested this.
The signing service uploads and processes documents on the vendor’s servers, which is what the record can evidence; that does not establish that no browser-side work happens, so it is not written as a statement about the device. Storage is regional in a limited sense: the United States is the default at-rest region, and UI Premium and API Premium can select alternative at-rest storage for documents.
Dropbox states that active editing, sending and signing temporarily processes copies on United States servers even when regional storage is chosen, and API request storage depends on the API configuration rather than on sender or signer location.
What it does
Dropbox Sign, formerly HelloSign, is a cloud e-signature service for sending, signing and tracking agreements, with templates, signer fields and validation, in-person signing, bulk send, reminders, audit trails and branding. It connects to Dropbox, Google Drive, OneDrive, Salesforce and HubSpot, and a separate API lets developers embed signing into their own apps and websites.
Recipients can sign without creating an account. Paid plans start at $15 USD per month for an individual.
Best for
Small and mid-sized teams already working in the Dropbox, Google or Microsoft ecosystems that want straightforward e-signature without enterprise complexity.
Worth knowing
Fully hosted with no offline or self-hosted mode - documents are uploaded to and stored on Dropbox's servers. Published prices are in USD, not GBP, and the cheaper tiers are per user.
The free plan carries a documented three-request monthly limit and a signer limit rather than an unqualified yes. Sender account requirements are separate from account-free recipients.
Billing cadence and currency are recorded as published, and the web plans are distinct from the separate API plans.
Details, and where each comes from
Vendor statements, our own reading of their pages, and the things nobody has established yet, each answered separately. Where we have not confirmed something it says so rather than guessing, and a row nobody has established is greyed out.
- Versions covered
- Web · API
- Website
- sign.dropbox.com
- Requires an account
- Yes
- Free tier
- Yes
- Watermark on the free tier
- Not verified
- Maximum file size
- Not verified
- Batch processing
- Yes
- Data residency
- Multiple regions
- Open source
- No
- Self-hostable
- No
- Licence
- Not verified
- Redaction
- No redaction feature
- Programmatic access
- HTTP API
- Last availability check
- Responded in 98 ms 21 October 2026
Checked automatically by our own runner, not reported by the vendor. 100% of our last 30 checks got a response.
What the redaction verdict rests on
From the vendor's own documentation, read 22 September 2026. Not tested by us.
What that does not establish
The vendor’s own site was read on 22 September 2026 and contains no mention of redaction, sanitisation, blackout or whiteout. Absence from a vendor’s own material is not proof that a feature does not exist - it may be undocumented, or on a page the reading did not reach - but for a NEGATIVE claim it is the strongest evidence available, and it is weaker than a positive quote.
Recorded as such rather than presented as certainty.
What the vendor says
Claims are labelled rather than repeated as fact. Where we have checked something ourselves, it says so and shows when. Checked means we read the vendor's own page and it says what we recorded - not that we tested the behaviour, unless the note says we did.
-
“4.7/5 G2 rating”
Checked by us - the source says this Read 22 September 2026
Confirmed verbatim: the page states "4.7/5 G2 rating", and it states it twice, in the header area and again further down the page. This is unusual in the tier for being the one social-proof claim with a checkable external source - G2 publishes its own ratings, so the figure could be verified against the review site rather than taken from the vendor.
That check was not run here, and it is worth noting that G2 ratings move and depend on the number of reviews and the period, none of which this page states. Recorded as the vendor's wording with its source named.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the text a browser renders
- SHA-256
- 7fbbcad0f064b22e0c34f1d2c3365318b23567424adc781f505d5c6d088d855e
How we checked
Re-verified verbatim on 2026-09-22: https://sign.dropbox.com/ re-rendered in headless Chrome with scripts/render-page.mjs and the claim's wording found in the rendered text. Originally verified on 2026-09-21. sourceHash is the SHA-256 of the re-rendered text, held as rv-sign-dropbox-com-5570fd06.txt.
-
“Compliant with SOC 2 Type II, ISO 27001, eIDAS, GDPR, and more.”
Checked by us - the source says this Read 21 September 2026
Confirmed verbatim. The claim is the first sentence of a tooltip that reads in full: "We take a proactive stance toward information security and privacy.
Compliant with SOC 2 Type II, ISO 27001, eIDAS, GDPR, and more. Use 2FA for an added layer of protection.
Plus all documents are stored and encrypted at rest using AES 256-bit encryption." Two things follow from where it was found. The compliance statement is not visible on the pricing page until a reader hovers a tooltip, which is a mild accessibility point and a real one: the page's own compliance claims are the least discoverable text on it, and a reader using a screen reader or a text-only view would not encounter them at all.
And the four named frameworks are of three different kinds - SOC 2 Type II and ISO 27001 are auditable certifications, eIDAS is a European regulatory framework for electronic identification and trust services, and GDPR is a data protection law that an organisation complies with rather than holds. Listing them together as "compliant with" is common in this market and flattens that distinction.
No audit report or certificate number is referenced, and nothing here was independently verified. Recorded as the vendor's assertion.
Standing: Re-read and matched byte for byte
Check it yourself: the source, the SHA-256, and how we checked
- From
- the raw HTTP response
- SHA-256
- 177f5b31f4d9f44431d7a3d91518ad0c8c992e3c820e2c9d10f4b2093f98f064
How we checked
https://sign.dropbox.com/products/dropbox-sign/pricing rendered 3561 bytes of visible text in headless Chrome on 2026-09-21, none of which contains the claim: the sentence lives in a tooltip. The claim was therefore read from the raw HTML response, 182647 bytes saved and hashed, where it appears inside the tooltip markup for a security feature row. sourceHash is the SHA-256 of that raw response.
Each claim is quoted from the vendor's own pages. This section describes what we have and have not checked - it is not a judgement about anyone.
Sponsorship is distribution, not an endorsement or a promise of search rankings, AI citations, traffic, or sales. This listing is a free entry, compiled from published sources.
Compared head to head
- Dropbox Sign vs DocuSign The two best-known e-signature services.