Scope of Services
Defines the exact services, subprocessors, and geographic data flows covered by the SSP; clarifies excluded activities.
A clear SSP documents operational controls, assigns accountability, and supports audits under ESIGN, UETA, HIPAA, and other U.S. frameworks. It reduces ambiguity about signing authority, recordkeeping, and electronic submission procedures while helping purchasers and regulators assess vendor readiness.
Organizations use a Business Services SSP when engaging vendors, centralizing signature workflows, or preparing for compliance reviews by internal or external auditors.
The SSP is a living document used by legal, procurement, IT security, and compliance teams to align expectations and operational controls across the contract lifecycle.
A senior officer or delegated representative with written authority to bind the company. The SSP should identify role, delegation limits, and any required countersignatures to validate authority for different transaction types.
A compliance or security lead responsible for attesting that the vendor or internal service meets documented controls, including encryption, access controls, and retention policies described in the SSP.
Defines the exact services, subprocessors, and geographic data flows covered by the SSP; clarifies excluded activities.
Maps required controls (access, encryption, logging) to standards such as SOC 2, HIPAA, and ISO 27001 to show compliance alignment.
Describes acceptable eSignature methods, signer authentication levels, audit trail requirements, and any notarization or witness conditions.
Specifies encryption in transit and at rest, data segmentation, backup routines, and data export procedures.
Lists retention periods, legal holds, and secure disposal methods for business and regulated records.
Includes escalation paths, notification timelines, and responsibilities for breach reporting and remediation.
| Field | Configuration |
|---|---|
| Signer Authentication | Email link or SMS one-time passcode |
| Signing Order | Sequential for approvals; parallel for acknowledgements |
| Audit Recording | Retain full audit trail and signed PDF |
| Retention Tagging | Apply retention labels per policy |
Record standards and integrations reduce manual reconciliation and support long-term access and reproducible audit trails.
Provide required payee forms upon request; 1099-NEC due Jan 31
Keep I-9 for three years after hire or one year after termination
Retain health-related records six years under 45 CFR §164.530(j)
Match retention to effective date and termination clauses
Allow 30–60 days for document production in most audits
Finalize scope and control mappings before review.
Legal, procurement, and security verify obligations.
Obtain vendor and counterparty signatures in agreed order.
Store signed record with audit trail and retention tags.
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7-day free trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes | Yes | Yes | Yes | No |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| Envelope Cap | No envelope cap | 100 envelopes/user/year | Varies | Varies | Varies |
The team standardized vendor attestations across portfolios to save review time.
Healthcare provider aligned vendor PHI handling to HIPAA standards and BAA requirements.