Docuseal: Open-source DocuSign alternative

https://github.com/docusealco/docuseal

by thunderbong • 3 years ago

671 196 3 years ago

github.com

jstummbillig• 3 years ago

Sweet! The SaaS pricing in this space is insane. Will look into it.

dcu• 3 years ago

have you looked at zapsign.co? it's a good UX and it's not too expensive

wintermutestwin7• 3 years ago

I just tried it out and it was totally unintuitive how to add fields to a PDF. I tried to chat with support, but it wants you to use WhatsApp. (?!) Then I went to their youtube channel to see if I could see a walk through and every video is in Spanish. I guess they aren't interested in other geos like the US.

Karunamon• 3 years ago

Definitely going to formally evaluate this; it looks straightforward enough to administer and prices outfits like Docusign charge are just north of silly.

ketanip• 3 years ago

Very nice and easy to use product. Loved that you provided an live version to try it without any signup wall or anything.

Also won't DocuSign accuse you of "misleading" their customers by using a name that is "too similar" to their ?

paulnpace• 3 years ago

won't DocuSign accuse you of "misleading" their customers by using a name that is "too similar"

Docuseal would be the winner with all the free press, and changing a name costs almost nothing.

tough• 3 years ago

They should make a seal be the mascot

tyingq2• 3 years ago

It does seem on somewhat dangerous ground for "trademark similarity testing", "consumer perception", etc...with "docu-<next word starts with S>".

I'd have gone with "DocSeal" or something that was a harder break from the "DocuSxxx" pattern.

somery29• 3 years ago

Thanks for pointing this out - it actually didn't expect that because of GitHub and GitLab and i haven't hears any trademark dispures between them. When Gitlab differs from Github by only 2 letters - DocuSeal vs DocuSign is already 3 letters.

But i think that's a valid concern and i need to better investigate this - changing the name shouldn't be a problem when the project is still very new.

wintermutestwin7• 3 years ago

I think the real problem with the name is that there is a docuseal.co

reisr3• 3 years ago

What is the bar for a "legally binding digital signature"? Is this a very complicated topic - or is it quite simple?

I can sign a PDF with OSX Preview for free. I can pay a bunch of money to sign with Docusign. Both produce a PDF with a digital image of my signature. I assume both documents constitute a legally binding agreement, so long as I actually preformed the digital signature. What justification do the e-signature SaaS companies have for their exorbitant prices? I understand the "audit trail" angle - that's just collecting my IP every time I interact with the document.

Is this a big SaaS scam?

hellcow• 3 years ago

Docusign makes it easy to collect lots of signatures from lots of people. That’s the use-case from my POV. 1 signature on 1 doc, use any PDF tool—no problem. When a board needs to approve 4 docs and you need 5 signatures on each, it needs to be easy.

Whether that’s worth Docusign’s pricing or if there’s better alternatives, up to you. But it’s objectively a helpful tool.

haswell2• 3 years ago

Docusign makes it easy to collect lots of signatures from lots of people. That’s the use-case from my POV. 1 signature on 1 doc, use any PDF tool—no problem.

Collecting lots of signatures isn’t Docusign’s value prop.

The value is signature certification, and a proven track record in court.

A single signature on a PDF is not technically difficult. The machinery to reasonably guarantee (edit: verify is a better word here) that it was you who signed the PDF is the thing that matters.

The value increases from there as the complexity of the document being signed increases.

jazzyjackson• 3 years ago

What justification do the e-signature SaaS companies have for their exorbitant prices?

They will defend their digital signature in court.

I was shocked to find these "click here to sign" contracts manage to do it all without an ounce of cryptography, but the fact is lawyers don't need cold hard math, they need a warm body to be a subject matter expert to explain to a jury that unless you're claiming someone else has access to your inbox, you're the one that clicked the button.

bottled_poe• 3 years ago

Bingo. This is why it’s worth paying for. It’s more akin to paying for insurance than paying for software.

alright2565• 3 years ago

I'm skeptical--are there any court cases where they've actually testified about this?

doliveira• 3 years ago

Yeah, I find it funny to see technologists being surprised that in most cases judges won't mind that the signature wasn't done with quantum-resistent cryptography stored in a blockchain or whatever. Technical solutions to political problems...

colechristensen2• 3 years ago

I had to get a notary to sign my I-9 form for a new remote job. The process of identity verification involved a seemingly 19 year old dude looking at my ID and then signing a piece of paper.

A website sending you an email and tracking your IP and keeping a log... seems to be about the same level of trust to be honest.

_jal3• 3 years ago

Like anything, but especially in law, the devil is in the details. Docusign has been rejected by a court before -

https://www.cryptomathic.com/news-events/blog/us-court-rejec...

That was fact-specific and doesn't call Docusign invalid, but it does demonstrate why simply "using Docusign" might not save you in a dispute.

jjfoooo4• 3 years ago

They would need the warm body to explain the cold hard math anyways

mhrmsn• 3 years ago

I think there's more to that. A proper digital signature requires you to obtain some certificate/key from an authority which you can then use to sign documents (this doesn't even require an image of your physical signature in the document). This proves that it was actually you who signed the document. The document also can't be altered afterwards without rendering the signature invalid etc.

Just adding the image of your signature to a PDF is probably fine for unimportant things, but it certainly isn't enough to be legally binding (at least in the EU).

V__5• 3 years ago

It actually is for most contracts. See eIDAS.

Foobar85682• 3 years ago

Oral agreement is enough to be legally binding in several countries in Europe. And most providers can reach what ever European directives on eSign.

V__5• 3 years ago

As always, it depends on the jurisdiction. The EU has the eIDAS [1] which allows simple signatures such as these for most form-free-contracts (the majority). There are however some, which need a digital cert and have to be encrypted.

[1] https://en.wikipedia.org/wiki/EIDAS

traspler2• 3 years ago

And Switzerland ZertES: https://en.wikipedia.org/wiki/ZertES - There are not normally various levels of trust with afaik only QES (Qualified Electronic Signature), the highest level to legally be on the same level as a hand signature.

bux93• 3 years ago

Mostly yes. In the EU at least, the rule is "An electronic signature shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form or that it does not meet the requirements for qualified electronic signatures."

However, the burden of proof is higher if you dispute a "qualified electronic signature". To be qualified, there's no specific technical requirements, e.g. use of cryptographic signatures, but you'd need to be certified and registered as a “Remote QSCD” according to ETSI EN 419 241‐2 PP.

Self-hosting this solution (or using PGP) won't magically make you a certified QSCD trust provider. You need to convince some certifying body that everything is nice and safe, which will mostly involve a lot of paper work and (evidence of) processes being in place.

pantulis• 3 years ago

Self-hosting this solution (or using PGP) won't magically make you a certified QSCD trust provider. You need to convince some certifying body that everything is nice and safe, which will mostly involve a lot of paper work and (evidence of) processes being in place.

This! Just like a self-signed SSL certificate for a website: yes, the traffic will be encrypted but you cannot be sure that the website is who it says it is.

lolinder2• 3 years ago

See the recent Canadian case of the thumbs up emoji signature [0]. The bar for a legally binding contract is much lower than what most people believe. The main thing you need is to be able to prove that the other party actually did express their assent to the contract. In the thumbs up case, who sent the text was not disputed, so the issue hinged on whether a reasonable person would interpret thumbs up emoji as expressing assent.

[0] https://news.ycombinator.com/item?id=36618650

tiahura2• 3 years ago

Electronic Signatures in Global and National Commerce Act

https://en.wikipedia.org/wiki/Electronic_Signatures_in_Globa...

“may not be denied legal effect, validity, or enforceability solely because it is in electronic form”

lawtalkinghuman• 3 years ago

The legal rules around formality are somewhat complicated. To give you an idea, here are the broad laws in England and Wales.

Not a lot of formality is required for most contract signing, and so long as the other side of a contract is sure that you signed it, a PDF signed in a standard PDF editor like Preview is almost certainly fine.

But if you are making a deed, there are attestation requirements under s1 of the Law of Property (Miscellaneous Provisions) Act 1989 - see https://www.legislation.gov.uk/ukpga/1989/34/section/1

If a company is executing a document, it has to follow the rules in sections 43 to 47 of the Companies Act 2006. See https://www.legislation.gov.uk/ukpga/2006/46/part/4/crosshea...

For property transactions, there's still an issue in use of e-signatures. There's a statutory scheme for "e-conveyancing" set out in Part 8 of the Land Registration Act 2002 which gives the Land Registry the ability to set up provision for using e-signatures for formalities that previously required wet ink signatures. They never got round to actually implementing this up until COVID restrictions made it somewhat impractical to get wet ink signatures so made a temporary change to allow it. When the COVID restrictions were lifted, they've gone back to the old practice but have promised that they're totally going to sort out a permanent solution. Whether they will is another matter.

See https://www.gov.uk/government/publications/electronic-signat...

I've personally used an iPad with an Apple Pencil to sign and have attested a (non-company) deed that had to comply with the LP(MP)A requirements and nobody seemed to have any trouble with it.

I suspect the target audience of a lot of e-signature SaaS products are companies where there are teams managing a lot of documents being signed across multiple jurisdictions, and juggling between sales, in-house legal and so on. Most of the problems those products are solving are likely business process issues rather than strictly legal requirements.

magundu• 3 years ago

I had same feeling when I build a free tools to unlock the password protected pdf. It can be easily done with OSX Preview. Then I see that people who don’t have technical knowledge and tools, they can easily unlock pdf from browser itself.

arnley• 3 years ago

What makes docuseal better than documenso, which is in the same space and also open source?

https://github.com/documenso/documenso

somery29• 3 years ago

Documenso doesn't have all the features that are currently available at DocuSeal - also Docuseal if free in the Cloud when Documenso is $30/month

Afaik the only thing Documenso can do is to place a signature - when with Docuseal it's possible to create more complex PDF forms with different field types like file/image/checkbox etc.

While Documenso looks like an ambitions project - DocuSeal already appears to be more robust and can become a true DocuSign alternative with all the features already available and open-source

wintermutestwin7• 3 years ago

Documenso is $30/month

WTF? Considering that DocuSign is $25 or even $10 and has the name and weight behind it, I can't imagine that they are selling many subs.

somery29• 3 years ago

Hi everyone, my name is Alex and I'm the creator of DocuSeal.

I was not happy with the existing mainstream document signing solutions so I decided to create an open-source alternative.

I've been working on this project since the middle of May and here is what the tool can do so far:

- PDF form fields builder

- 10 field types available (Signature/Date/File/Checkbox etc)

- Multiple submitters per document

- Automated emails via SMTP

- File storage on AWS S3, Google Storage, or Azure

- Automatic PDF eSignature

- PDF signature verification

- User management

- Mobile-optimized

DocuSeal can be self-hosted on-premises or used in the Cloud for free. DocuSeal was built with Ruby on Rails with a bit of Vue3 for complex UI parts like the form builder.

Looking for some feedback and would be happy to answer any questions

2Gkashmiri• 3 years ago

hey. do you have support for pfx based signatures like jsignpdf does?

somery29• 3 years ago

Currently it’s possible to sign documents only using the autogenerated pkcs7 certificate in self-hosted DocuSeal (it’s done automatically be default).

But it should be doable to make it work with different certificate formats to bring your own certificates.

I’d be happy to explore those options and would appreciate it if you could open on issue on GH in case you’re interested to have this supported this in the tool.

_aaed• 3 years ago

Looks like great work for a 2 month project

somery29• 3 years ago

Thanks

dtx16• 3 years ago

Hi Alex,

what a great idea, thank you very much. Two years ago I was evaluating different signing solutions for the company I worked with and there were two killer features that forced us to go with docusign since at the time they were the only ones really supporting it:

1. Relaying of Submissions to other Signers

We often found that we needed to get a Signature from someone at another company. However, we couldn't a priori say "Person X has to sign it". Often we had a contact person that would help us navigate the internal structure of the other company and relay the signing to that person. Docusign has the ability to allow us to say this person we know can decide who has to sign this document, even if we don't know that person. No one else at the time supported that use case.

2. Qualified Electronic Signatures

So... Here in Germany our Government has some kind of Angst (might call it german angst) of anything digital. A Handwritten signature on a piece of paper is held in such high regards that the digital equivalent (qualified electronic signatures) require a video ident workflow with a passport held into the camera and so on. This has to be done via a third party service that takes like 15-20 Euro per validation. I know it's insane. There's a reason that theres no german silicon valley... Anyway, there are many situations where this level of validation is required by law.

Just my 2cts after dealing with this issue here, I think 1. is something you might look into implementing, cause it's a use case that might come up more often, 2. is just really annoying for everyone.

rkagerer2• 3 years ago

I'm interested in reading more about #2, can you provide a source?

https://www.docusign.com/products/electronic-signature/legal... doesn't mention anything about videos or passports. I could see how that might be one means a third party has chosen to collect proof of intent, but haven't found anything legally mandating it.

Bilal_io• 3 years ago

Thank you for creating this and making it open source.

What mechanism(s) is used to ensure non-repudiation?

I appreciate that the demo is not behind a sign up wall, but is account creation and email verification required for invitees to sign any documents?

Are IP addresses stored as part of the digital signature?

Any other mechanism?

somery29• 3 years ago

IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available.

but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services

hkhanna• 3 years ago

One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform.

The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated details has the motive and means to fake them.

That argument is much harder to assert with something like DocuSign because it is unlikely DocuSign would put their business on the line to fake someone's signature.

I'm not saying repudiation based on custody of the e-signature platform is a winning argument, but it's something to consider before self-hosting if you are going to use the platform to sign your own contracts.

stevefan1999• 3 years ago

Only if we can use our Yubikey to sign the document...

rodolphoarruda• 3 years ago

Hi Alex. First of all, congratulations. The product looks great for a 1.5 month worth of dev work. Impressive.

Is it possible at the moment to send signature requests via WhatsApp? (even at a cost per send)

somery29• 3 years ago

It's not possible at the moment - but i've been planning to add this feature to use phone number and text messages (including WhatsApp) as a second layer of authorization when signing docs. Stay tuned!

WirelessGigabit• 3 years ago

If it's a US phone number, you can send an email to the phone number:

E.g. for T-mobile it is @tmomail.net.

michaelmior• 3 years ago

I tested it out briefly and it looks very cool for something put together within a couple months. One thing that doesn't seem to work at the moment is automatically recognizing existing PDF form fields (although perhaps there was a problem with the specific PDF I tested).

Being able to quickly import existing forms and then just add some labels would make things move a lot quicker.

One other thing that would be helpful is to handle variable numbers of signatures required. Some documents I have to deal with have space for many signatures but for any given instance, only one or two might be needed. Perhaps I've missed this, but I'm not sure existing templates would handle this case. I think that ideally a template would contain all the signature fields but then I can specify which ones are actually required when I send out the document for signature.

29athrowaway3• 3 years ago

Does it comply with US regulations for e-signatures? Otherwise, what's the point to have a signature that is not legally binding?

That is the whole point of signatures. Otherwise it is just an image editor.

somery29• 3 years ago

The E-Sign Act grandfathered in existing agreements that existed digitally prior to Oct. 1, 2000. All agreements after this date, however, must comply with the following set of guidelines in the E-Sign Act to be considered legally binding:

- Intent to sign. Electronic signatures are only valid if the involved parties have the intention to sign. Signature requests can be declined.

- Consent to do business electronically. Involved parties must agree to conduct transactions electronically.

- Attribution. The signature must uniquely attribute to the individual signing the document.

- Association of signature with the record. E-signatures must have a mark on the document from the signer that can then be associated with the record.

- Record retention. Electronic documents must be savable, viewable and printable by either party.

I think the tool provides all that - usually when working as a contractor i've been signing documents in PDF viewer and sending them back via email and that was what my clients wanted me to do. Tools like DocuSeal are making the process of signing docs easier than doing it via email.

wintermutestwin7• 3 years ago

I am involved with two nonprofits that need to have an easy way to get many non-technical people to sign a document. Each is paying for their own DocuSign account. The thing is, they only need to do 6-12 documents per year each, so the cost per document is insane.

Testing it now with fingers crossed and hoping that the cloud version sticks around.

wintermutestwin7• 3 years ago

Darn. I created a document, setup the info for three sigs, added the recipients emails and then it was unclear how to push it out. I guessed at "Submit it yourself," which required me to add my email so I used the first recipient's and then it opens the doc for me to fill out. It asks for full name and then when I submit, "next" just keeps spinning. FWIW, I am running FireFox with UBO, etc.

This is really important to me, so I'd be glad to work with you to troubleshoot and provide detailed user feedback.

wintermutestwin7• 3 years ago

I was going to try it with Safari, but it didn't recognize the account that I created earlier in FF...

V__5• 3 years ago

This looks great. What's the best way to contribute a translation?

I think a great feature would be an email with a confirmation link after the pdf gets signed to ensure the owner of the email was the person who signed the document, if the link share option is used.

somery29• 3 years ago

That's a good idea! will definitely add this feature to the project

FpUser3• 3 years ago

Thanks for nice work. Will be checking it out and most likely using IRL if works as advertised.

gamblor9564• 3 years ago

can be self-hosted on-premises

This kills it as a viable alternative to DocuSign. The point of Docusign is that it is an independent third party that maintains custody of the signed contract and proof of acceptance (i.e., digital signatures) by all parties to the contract.

A self-hosted digital signature system isn't worth anything in court; the other parties will simply reject the authenticity of any data held within it and the amount you'd have to spend to get that data into evidence would probably pay for several centuries of DocuSign's enterprise edition.

That being said, the cloud-hosted option seems viable as a competitor for Docusign if it's offered by you/your organization as a service, and could provide financial support for continued development.

somery29• 3 years ago

A self-hosted digital signature system isn't worth anything in court; the other parties will simply reject the authenticity of any data held within it and the amount you'd have to spend to get that data into evidence would probably pay for several centuries of DocuSign's enterprise edition.

When self-hosting it - you can integrate it with AWS s3 Azure or Google Cloud files storage - those are the trustworthy third parties that provide the entire history of logs to ensure that the documents were not altered and signed at specific date/time with the specific content.

So bringing cloud storage providers as a thirdparty when self-hosting will bring enough evidences to the court to defend the signed documents.

cyberax• 3 years ago

Looking for some feedback and would be happy to answer any questions

It would be great if you could add support for AWS QLDB. It's an immutable blockchain database (basically, "git with an SQL interface"), and you can periodically "stamp" it by notarizing its hash with one of the public blockchains.

This way you can guarantee that the records are going to be immutable and unalterable.

somery29• 3 years ago

thanks, i think that's an interesting space to explore. there were many comments regarding the 'consistency' of the data/documents so solving this 'trust' issue especially when selfhosting it is really important

capableweb• 3 years ago

- File storage on AWS S3, Google Storage, or Azure

I'm guessing it's just a mistake/miss in this comment, but for file storage it is also possible to store it locally on the server right? Otherwise all "editions" are "in the Cloud" yes or yes, so would kind of defeat the purpose of the self-hosted version.

somery29• 3 years ago

It's possible to use local storage or Aws s3, Azure, Google Cloud to store files. When storing locally it makes all the documents 100% owned by you - but in some cases companies might want to bring a third party files storages to ensure the integrity of the documents.

But as was mentioned before in the comments - maybe bringing AWS QLDB as a third party to ensure the consistency of data with a local files storages is the best option. This way all documents can be logged with a third party so they can't be altered - while to content of the documents won't be shared with any third party.

btown2• 3 years ago

This is amazing work, and this space desperately needs an open-source solution!

The signing experience could use some polish, but it's well on its way. A few things: clicking a signature field immediately opens a file upload despite the very functional draw-your-signature canvas. Focusing to type into a field scrolls the page not so the field is in view, but so it's at the top of the viewport, which prevents the reader from seeing the paragraph of context above the field. And minimizing the bottom panel where you type fields should be unminimized if you click another field, otherwise it can cause non-technical users to feel "stuck." Oh, and in terms of demonstrations, the demo PDF should likely be a (fake) legal contract of some sort, to show off how things can be positioned in a realistic document!

If there's one thing I'd suggest you implement, though, it would be the ability to embed the signing interface in an iframe whose URL can be parameterized to prefill values via the query string, e.g. following https://helpx.adobe.com/sign/adv-user/web-form/url-parameter.... (Oh, and postMessage to the parent page when signing is done so the interface can react to that!)

So many real-world workflows can be handled with a simple wizard that pre-populates a PDF to sign, with the values from that wizard. But most of the solutions out there charge an arm and a leg for this, with large minimum order sizes and even charging for the view even if the user doesn't complete the form! Not to mention that letting people self-host, thereby avoiding third-party cookie issues, makes things significantly more accessible.

Really looking forward to how this progresses!

somery29• 3 years ago

Thanks for the feedback! All your UI suggestions/fixes make sense and will definitely be brought into the the tool soon! Also I like the idea of using some 'fake' legal document for the demo.

Regarding the iframe - i've been thinking about creating an npm package for better integration with the host app - but maybe giving an option to use iframe should be available as well for companies that don't have developers to implement a better integration with the npm package.

toomuchtodo2• 3 years ago

Hi Alex. Would you be interested in help running this as a non profit like Let’s Encrypt, but for digital signatures? I would be willing to contribute both financially and infra/DevOps/biz ops to bootstrap.

somery29• 3 years ago

It's hard to say at this point if something like Let's Encrypt can exist in this space - but I'm for sure going to continue offering a free Cloud SaaS option with a generous set of features for document signing. I'd love to chat to explore more about the potential non-profit solution - please feel free to drop me a line at alex@docuseal.co

abound• 3 years ago

I run a small tech nonprofit (see profile) and have also been unsatisfied with DocuSign and alternatives in the past. I'd be happy to help if I can be useful here, either with hosting (and PKI) or with development directly.

fakedang• 3 years ago

DocuSeal can be self-hosted on-premises or used in the Cloud for free.

Charge something for the cloud product. If you feel your product is good, then don't give it away for free. Your product charges will help sustain future development down the road.

Semaphor• 3 years ago

It's not perfect for a single person just using it for themselves (a lot of workflows seems very company/team oriented), but it's still better than nothing which is what I had before. Thank you for open sourcing it, this will absolutely help me :)

somery29• 3 years ago

Thanks, please feel free to open an issue with your suggestion to improve the tool at https://github.com/docusealco/docuseal/issues

logiczilla• 3 years ago

I love the fact that this exists, however my major concern is that because this is self-hosted, in the event of a dispute, the other party can claim that I forged the document. In such a scenario, how would I ever prove that I didn't?

somery29• 3 years ago

When self-hosting it it's possible use merkle tree to ensure the documents integrity (similar to how git works with its commit hashes). So to forge one document it will require to change all document hashes after the disputed document making it impossible to cheat by the organization that is self-hosting it. This will be added into the project soon.

https://en.wikipedia.org/wiki/Merkle_tree

Alternatively I'm thinking about adding a third party AWS QLDB integration - QLDB allows to maintain an immutable, cryptographically verifiable log of data changes.

phrz• 3 years ago

One of the features DocuSign charges a lot of money for is batch envelopes, like uploading a CSV to fill out fields and send to different recipients (basically Mail Merge). Is this something that could work in DocuSeal?

somery29• 3 years ago

I was planning to add this week a feature to download csv or xlsx with all the data from submitted documents (the person that posted this link on HN somewhat spoiled the release - it was not be posting this link and wanted to wait just a bit )

But I’m sure this can work the other way around - it should be easy to make it possible to import contacts from csv to collect signatures and data from the PDF submissions form in batches.

johnfonesca• 3 years ago

Our product Bulksign https://bulksign.com does this, the name of the product is directly inspired by that feature (sending same documents for signature to hundreds of recipients).

KingOfCoders2• 3 years ago

The benefit of DocuSign for me is, my clients already use DocuSign and have no problem using it with me.

lolinder2• 3 years ago

Do your clients even notice, though?

I'm a rare user of these platforms, but all I ever see is that I get an email with a link to sign something. Sometimes it's DocuSign and sometimes it's Adobe or something else, but I certainly don't feel any loyalty towards one over another, and as a signer, I certainly don't trust the platforms to hold onto my copy for me.

It seems that unless you've got clients who are trying to use DocuSign as their personal document management system, as long as the interaction flow is essentially the same it should be fine.

KingOfCoders2• 3 years ago

It's usually NDAs they want (an me to provide) to have and DocuSign is fine with their legal department because they use it themselves.

If I can't use DocuSign usually I need to print a PDF, sign it, scan it and send it back.

insanitybit• 3 years ago

I suggest a new name. `SealDoc` etc. The `Docu` part is going to cause you trouble imo.

I would also suggest maybe an explainer about how it's possible. Specifically, what makes a contract legally binding if it uses this system? The main reason people use DocuSign/ HelloSign is, in my opinion, because it feels safe legally to do so. Are there laws that make it possible for your service to work?

quadrature2• 3 years ago

What is the API like ?, is this something I could easily embed into an application ?

somery29• 3 years ago

embedding will be available in August - the ideas is to create a npm package to bring the PDF document form into apps for developers

quadrature2• 3 years ago

thats awesome. great work developing this!

woodylondon• 3 years ago

As i understood it the difference was esignature (was what this was providing) and esign was to sign with a digital certificate. esignature is plenty for most things.

Docudeal looks really cool and simple! and compared to the crazy costs of HelloSign, Docusign etc.

One thing I would say is provide a RestAPI so easy to integrate into our own applications so we can have the GUI on our side.

somery29• 3 years ago

RestAPI integration will be available in August

supermatt2• 3 years ago

The way a system like docusign works is that it is a (trusted) independent third party that will verify that the owner of email address X is the one that "signed" the specific version of an agreement.

By self-hosting, you have access to the infrastructure and can manipulate it to your will. There is no proof that the counterparty signed anything - you could just manipulate it to say they did.

This potential for misuse could make it difficult to enforce your contract should you be required to do so.

dtx16• 3 years ago

Not entirely true, cryptographic signatures exist. For example the EU eIDAS Law allows Advanced Cryptographic Signatures to basically just be PGP Signed Emails

Nextgrid• 3 years ago

Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice.

Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use.

I wish smartcards took off and computers included readers as standard. This would not only solve strong authentication but also payments (just insert your bank card and do EMV-style payments with comparable levels of security).

supermatt2• 3 years ago

Yeah, we use them here in Lithuania - but I have never seen them used for private contracts.

I'm not even sure how i can use my signature outside the AWFUL experience that is the government esig portal.

I dont think they are accessible for non-resident entities either - i.e. i can only get lithuanian signatures through the lithuanian portal.

This likely explains why they arent used b2b as you would need a separate contract process for foreign and domestic.

_ea1k2• 3 years ago

I do wonder about that for self-hosting a service like this. But how often do actual disputes arise between parties as to whether a document was actually signed or fraudulently altered?

TBH, even a contract rests on a certain amount of trust between the involved parties.

somery29• 3 years ago

When selfhosting it - it's possible to connect AWS S3 to store the documents - AWS with S3 logs could be used as a source of trust to ensure the documents are not altered.

croes• 3 years ago

It's not about how often but about if a dispute arises. If in that case the signature can't be trusted why signing in the first place?

awinter-py• 3 years ago

I mean both parties have an email receipt (but then why not just use email)

I think the infrastructure need here is extensible messaging. There are a lot of multiparty flows with notification and recordkeeping requirements

xnx• 3 years ago

TIL that Google Docs has a built-in eSignature capability: https://support.google.com/docs/answer/12315692?hl=en

In beta though, so consider that when using.

tiahura2• 3 years ago

Adobe Acrobat also has it.

noodlesUK• 3 years ago

In order for this to be legally useful to users in the EU/UK, this would need to comply with the eIDAS regulations. I’m not sure what that entails, but it would be worth looking into.

A lot of the value of a signature provider comes from it being a neutral trusted third party. They slap a signature and a time stamp on a document, and you can get them to testify that the document existed in a particular state at a particular time.

o1y32• 3 years ago

Signing documents online is not a technical problem but a business and legal problem. DocuSign and other commercial companies have a business not necessarily because they have any unique technology or the best user experience (they often do), but because they handle all the complex stuff around signing documents.

A reality many people don't see is that many commercial companies really have the expertise in certain areas and have the resources to handle the non technical side of things, at least much better than open source communities. Similar to "open source tax filing software", I'm afraid this is another example of people thinking open source solves every problem. I for one don't see myself using any of such tools unless they are actually reliable, competitive and trusted by many corporations and individuals.

TedDoesntTalk• 3 years ago

I for one don't see myself using any of such tools unless they are actually reliable, competitive and trusted by many corporations and individuals.

People said the same in 1999 for online banking.

"According to research by Online Banking Report, at the end of 1999 less than 0.4% of households in the U.S. were using online banking. At the beginning of 2004, some 33 million U.S. households (31%) were using some form of online banking. Five years later, 47% of Americans used online banking, according to a survey by Gartner Group"

https://en.wikipedia.org/wiki/Online_banking#Internet_and_cu...

Alifatisk• 3 years ago

Can I redact text too? If not, is there any software close to Adobe Acrobats functionality?

miniBill• 3 years ago

You can try the latest version of Scribus for editing PDFs

sgc• 3 years ago

I haven't used Scribus in some years. Would the apt version be good enough, or is there some bleeding edge tech they just released?

Gasp0de• 3 years ago

How do these electronic signatures work? Is it PGP? Where does one store the secret (e.g. private key) and how can someone prove that it is really my signature?

somery29• 3 years ago

Currently the documents are signed with PKCS#1 signature, signed documents can be verified at https://demo.docuseal.co/settings/esign (to ensure that they were produced by the tool and not altered/forged by some third party). Additionally I'm planning to add a merkle-based log of documents to ensure that documents were not altered by the party that is self-hosting the tool.

rkagerer2• 3 years ago

It's great to see fresh efforts being made in this space. I categorically refuse to use DocuSign, due to objectionable clauses in their Terms and Conditions ( https://www.docusign.com/legal/terms-and-conditions or https://archive.ph/y27U4). Some examples are below. As far as I'm concerned nobody should agree to use their service.

Unfortunately DocuSign has monopolized electronic signatures in some contexts (examples from my own local experience: healthcare, real estate), to the extent that it's become exceedingly difficult to request a simple PDF to print, hand-sign, scan and return. Such friction is common at companies who outsource their paperwork to third party workflow providers. I'm fortunate that folks I do business with tend to want my signature badly enough to escalate to someone with authority who can make a procedural exception, but I doubt everyone is so lucky and suspect many users are effectively "bullied" into accepting the Terms regardless of their wishes.

Clauses I find objectionable include:

- various consents to analytics, including use of my data to feed their machine learning (might have been more palatable if they provided some insight and stronger confidentiality assurances)

- 2.1.1 waiver of jury trials and class actions

- 8 indemnification (a and e are a little broad, I'm not going to pay for your lawyers in circumstances that don't warrant it)

- 9.2 is unfair; any damages caps should be reciprocal

- confusing and possibly overly-broad intellectual property rights clause 1.1 (they should explicitely restrict their protections to only DocuSign's IP, not "all IP").

- They expressly disclaim any warranties regarding accuracy, quality, fitness for purpose or that information they provide will be error-free. That feels dangerous in the context of forming contracts. A fundamental value proposition of their business is accuracy ("Oops we made a mistake and actually your counterpart did not really sign the document..."). Liability here falls back to the parties, and as a consumer I refuse to be liable for their mistakes.

- Nor am I a fan of increasingly common clauses along the lines of "we can modify our terms at any time and you'll be deemed to accept the revisions" or "you further agree to any other notices we might choose to inject elsewhere onto our site" or vague expectations I consent to additional third party licenses not disclosed at this time (and ironically some of their preamble along these lines seems to be in conflict with 10.8). If you and I agree to something, then later you want to change your mind, you'd better come back and seek fresh consent. If you're making changes so often as to make that annoying and inconvenient, then it's a sign you have too many salaried lawyers on staff and need to replace them with a team empowered to stop wasting my time and yours and get this right the first time. Customer attention is a precious resource, and companies sending out legal updates on a frequent basis can't possibly in good faith expect consumers to keep up with reading them.

- I take offense to their Terms page making connections to Twitter, Facebook, Salesforce, Google analytics, etc. and subjecting me to cookies prompts. All this is not required to simply provide me with your terms of use, and somewhat inappropriate seeing as I haven't yet consented to anything.

These are off their current website, but I recall similarly problematic terms the last time I started (and subsequently abandoned) a signature attempt some years back.

And don't even get me started on their Privacy policy. (Among the various problems... nobody should have to "opt out" of their personal data being sold to other parties).

sandGorgon3• 3 years ago

any chance you want to include docsend functionality ? it is VERY incremental to what you are doing. And a bunch of us would totally pay for it.

somery29• 3 years ago

can you please elaborate what exactly from docsend you'd love to see available in docuseal?

sandGorgon3• 3 years ago

"who saw my document and how much time" on a page level. thats basically the only incremental value of docsend over docuseal. most other features overlap.

saqadri2• 3 years ago

Just today I was forced by Docusign to pay $45/user/mo in order to continue using the service for a single document I had to send out for signatures. Seeing this pop up on HN right after feels really nice. The cloud-hosted version seems to be very simple to use, so nice job on this.

Like some of the other comments pointed out, the key element here is trust -- in the 3rd-party platform collecting signatures, and in the confidence that it cannot be manipulated. These are solvable challenges, but calling that out explicitly in your documentation and website copy will help convert skeptics, or at least convince them to give it a try.

judge20203• 3 years ago

DocuSign is free for 3 signatures a month - did you need more or were you using more advanced features?

wintermutestwin7• 3 years ago

https://www.docusign.com/plans-and-pricing

Looks like it is $10/mo for 5. I don't see free...

saqadri2• 3 years ago

There was a free trial period that expired, and there was no free option for additional documents that required multiple signers.

tiffanyh• 3 years ago

These projects never realize that eSign tech is a commodity, the actual business you are in is creating market level Trust for your platform.

Eg if you’re a CFO, would you being willing to take the risk just to save a couple of bucks on a no-name eSign service for all your sensitive legal & vendor agreements, or use the worldwide Trusted eSign platform of DocuSign - which has gained acceptance by regulators as being an authoritative legal signature of contracts.

grokgrok• 3 years ago

If your company has a board and a CFO then sure, go with the trusted solution. If you're starting a scrappy, modern, real world business, things like this can help avoid death by a thousand cuts that is paid microservices.

FpUser3• 3 years ago

"Eg if you’re a CFO, would you being willing to take the risk just to save a couple of bucks "

Typical FUD preached by many online companies to lure customers.

Even verbal contracts are enforceable (with the caveats of course). These will be fine for the most boring cases. The others are signed with lawyers anyways.

gamblor9564• 3 years ago

"take the risk"

This is the important part you're ignoring. Yes, verbal contracts between businesses are binding, but only to the extent you can actually prove the terms in a court of law.

Using DocuSign (or similar) is about risk mitigation, specifically about being able to prove the the contents of the contract in legal proceedings.

The risk with being a business that allows for verbal contracts is that one of your vendors may be unscrupulous and truly screw you over. And that's a matter of when, not if.

guideamigo2• 3 years ago

You are right.

Alternative to eSign is to just send PDF documents. And as the person to add their signature to it.

bob10293• 3 years ago

eSign tech is a commodity

We learned this pretty quickly with our banking products. Having your own bundled, first-party e-sign features can help differentiate your product from other vendors, but if the only thing you are selling is e-sign, they probably won't look at you. We do have an in-house e-sign feature in our product now. We evaluated integration with Adobe & DocuSign, but their APIs were so far away from what we needed that we decided to DIY.

Consider this - what is a bank going to do with raw access to something approximating docusign APIs? They outsource everything. Their vendors are the ones who would be consuming something like this and then reselling it. Getting onto the QVL for a US financial institution (and staying there) is usually a monster battle if you are a new kid on the block.

If you still wanted to market this solution towards US financial institutions, I'd start with the vendors of those institutions. Companies like Jack Henry & Associates, FiServ, CSi, FIS, Harland Clarke, et. al.

somery29• 3 years ago

That's interesting that you ended up developing an in-house document e-signing feature for your product. I'm curious, would it be possible for you to choose a self-hosted and open-source solution like Docuseal, integrated with your product to outsource the complexity and speed up the development? (if such an option existed back then?)

hgs3• 3 years ago

Competition is a good thing and a core tenet of capitalism. If we don't have competition and regulators are wedding themselves to one particular business then that means we have a government sanctioned monopoly.

trallnag• 3 years ago

Last time I wanted to sign a document with the reputation of a third party I used PandaDocs free tier. Worked fine enough

guideamigo2• 3 years ago

Ruby backend in 2023!

victor90002• 3 years ago

Oof, unfortunately the Alfredo license kills a lot of use-cases for this project.

somery29• 3 years ago

can you please elaborate which use-cases? - maybe that's something that actually can be possible by splitting some parts of the project into MIT licensed dependencies?

victor90002• 3 years ago

I'm thinking of cases where the pdf is accessed over a network. Like integrations with systems that do billing, invoicing, taxes, tickets to a game, rent receipts, pulling pdfs from your email, pulling pdfs from S3, almost everything?

sizzle• 3 years ago

Docusign legal team is probably foaming at the mouth after seeing this. Godspeed OP

xvilka• 3 years ago

Such software works best when there's integration/plugins with most popular PDF viewers and editors: Okular, Evince, LibreOfice.

ensocode• 3 years ago

Thanks for this. An open source solution is so necessary in this space. There is a need for some common trusted party who hosts that thing, as self-hosting doens't make sense I think.

sandGorgon3• 3 years ago

one more point i want to mention - if u intend this to be used for genuine document signing, you may want to switch to a .com domain and do a registry lock[1]. I mean these are legal documents at the end of the day.

If u ever want to do enterprise contracts, they will insist on this. Might as well do it now, while ur still early.

registry lock is only possible for a limited set of TLD AFAIK.

https://www.nameshield.com/en/cybersecurity/registry-lock/

Docuseal: Open-source DocuSign alternative

Related Stories