Group Card GDPR and Security for Companies: What IT Should Check

Quick answer: SignThisCard is run by a UK company and publishes a privacy notice covering what it collects, lawful bases, retention and third parties (Google Fonts, reCAPTCHA, Stripe) that may process data outside the UK. It has no published DPA and no SSO; sign-in is by email and password or an emailed link and code. Contact us for questionnaires.

Your HR team wants to roll out a group card tool, and the request has landed on IT's desk with three words: "Is it GDPR?" This guide answers the questions reviewers actually ask about group card GDPR and security for companies, honestly and in plain English, and ends with a checklist you can use for SignThisCard or any other vendor.

For seats, roles and billing, read our guide to company group card accounts first.

Is SignThisCard GDPR compliant?

We don't use a "GDPR compliant" or "certified" badge. Instead, we describe our practices in our privacy notice so you can assess them yourself. In our view, a badge tells a reviewer less than the facts do.

What we can tell you:

• Who runs it: SignThisCard is operated by Williation Technologies Ltd, a private limited company registered in England and Wales (company number 17289183).
• Privacy notice: our privacy notice explains what personal data is collected, the lawful bases we rely on, how long data is kept and which third parties may process it.
• Retention: cards are kept while they remain available. There is no fixed public expiry; deletion is available on request.
• Payments: card details are handled by Stripe, not stored by SignThisCard.
• Transport security: the site uses HTTPS.
• Abuse protection: reCAPTCHA v3 and email verification for organisers.

The UK GDPR and the Data Protection Act 2018 apply to how your organisation uses staff data, too. GOV.UK has a plain-English summary of the UK's data protection rules.

Do you sign a data processing agreement (DPA)?

There is no published DPA. If your organisation needs a data processing agreement or a security questionnaire answered, contact us and we'll discuss it.

Before you ask, it helps to decide how your organisation sees the relationship. The ICO explains the difference between a controller (decides why and how personal data is used) and a processor (acts on a controller's instructions), and lists what a controller–processor contract must contain under Article 28 of the UK GDPR. Your data protection officer is the right person to make that call for your use case.

Where is our employee data stored?

Hosting provider details are available on request. Some third parties named in the privacy notice (Google Fonts, reCAPTCHA and Stripe) may process data outside the UK. If you need the hosting details for a transfer assessment, ask us via the contact page.

The ICO's guidance on international transfers explains when sending personal data outside the UK counts as a restricted transfer and what safeguards apply. Your reviewer can map our answers against it.

What data does a group card hold?

A group card typically holds:

• The organiser's account details (name and email)
• The cover image, cover message and any music or video the organiser adds
• Each signer's message and the name they type, plus any photo or drawn signature they choose to add
• The recipient's email address, if the organiser uses the email send button

Does SignThisCard support SSO with Microsoft or Google?

No. SignThisCard does not support single sign-on (SAML, Microsoft or Google sign-in). Organisers sign in with an email and password, or with a sign-in link and code sent by email. Signers don't sign in at all.

What this means in practice:

• Who needs accounts: only organisers, the people who create cards. On a team account, that's the people with seats.
• Joining: the team owner or admins invite people by email (invitation links work once, for 14 days), or the owner can let anyone with a confirmed email at the company's own domain join while seats are free. Personal email domains can't be used for this. There is no SCIM or other automatic provisioning.
• Roles: owner, team admin and member. Only the owner and admins see the member list; only the owner manages billing.
• Leavers: owners and admins can remove members from the team. Cards belong to the person who created them and stay in their own account; removal returns that person to their own plan. Add this to your offboarding checklist.

The UK's National Cyber Security Centre (NCSC) includes single sign-on in its lightweight questions for cloud services. If SSO is a hard requirement in your policy, SignThisCard isn't the right fit today; our guide to the best group card platform for companies compares the options fairly.

Who can see a card?

Anyone with a card's signing link or finished-card link can open it. The link is the access control, much like a shared document link.

Good practice to put in your organiser guidance:

1. Share signing links only with intended signers, in private channels or direct messages.
2. Keep the card's management link private; it's for the organiser only.
3. Send the finished-card link only to the recipient and anyone they choose.
4. Download a PDF as a keepsake, then ask support to delete the card if you no longer want it online.

Our general guide on whether group card websites are safe to use covers this from a signer's point of view.

Security-review checklist for IT teams

Use this checklist for any group card vendor. It follows the themes in the NCSC's lightweight approach to cloud security. The right-hand column gives SignThisCard's answers as of November 2026.

Anything not answered here, such as encryption at rest or incident response, is a question for us directly. We'd rather answer it properly than guess in an article.

When is SignThisCard the right fit, and when isn't it?

It suits organisations that want a simple, low-cost card tool where only a few organisers hold accounts and signers stay anonymous to the system. It's a weaker fit when policy requires SSO, a signed DPA before any use, SCIM provisioning or central audit logs.

For very large organisations, our guide to group card platforms for large companies covers seat numbers, custom arrangements and contacting us for more than 500 seats.

Key takeaways

• SignThisCard is operated by Williation Technologies Ltd, registered in England and Wales (company number 17289183).
• The privacy notice sets out data collected, lawful bases, retention and third parties that may process data outside the UK.
• There is no published DPA; organisations needing one, or a security questionnaire, should contact us.
• Hosting provider details are available on request.
• SSO (SAML, Microsoft, Google) is not supported; sign-in is by email and password or an emailed link and code.
• Signers need no account; anyone with a signing link can open the card, so share links carefully.

Frequently asked questions

Is SignThisCard GDPR certified?

No, and we don't claim a certification badge. We describe our practices in the privacy notice, which covers the data we collect, lawful bases, retention and third parties. Your data protection officer can review it and contact us with any follow-up questions or a security questionnaire.

Will you sign our DPA?

There is no published DPA. If your organisation needs a data processing agreement, contact us through the contact page with your requirements and we'll discuss what we can do. We can't promise specific terms in advance, so raise it early in your review.

Is our data stored in the UK?

Hosting provider details are available on request. The privacy notice explains that Google Fonts, reCAPTCHA and Stripe may process data outside the UK. If you need hosting details for a transfer risk assessment, ask us via the contact page before rolling the tool out.

Can staff sign in with Microsoft or Google accounts?

No. SignThisCard doesn't support SSO through SAML, Microsoft or Google. Organisers sign in with an email and password or an emailed link and code. Signers never sign in. If your security policy requires SSO for every SaaS tool, SignThisCard isn't the right fit today.

What happens to an employee's cards when they leave?

Owners and admins can remove them from the team, which returns them to their own plan. Their cards stay in their own account, because cards belong to whoever created them. If a card should be deleted, the creator can ask support, or you can contact us.

Do signers have to give us personal data?

Signers don't need an account. They type a message and a name, and can optionally add a photo or drawn signature. Encourage people to keep messages general and avoid sensitive details such as health information, especially on get-well and sympathy cards.

Conclusion

Group card GDPR and security for companies comes down to clear answers: who runs the service, what data it holds, where it goes, and how people sign in. SignThisCard publishes a privacy notice, gives hosting details on request and is upfront about what it doesn't have: no published DPA and no SSO.

If you're reviewing us for your organisation, read the privacy notice, run the checklist above and send our team your security questions.