Self-hosted e-signature in 2026: revisit Documenso, DocuSeal and OpenSign before you send another contract through DocuSign

Most companies sign more documents than they realise. Offer letters, NDAs with vendors, rental agreements for branch offices, dealer agreements, consent forms and purchase orders all need a signature from someone. Over the last few years many teams moved this work to a hosted e-signature service such as DocuSign. It works, but every contract now passes through a third party, pricing is per seat or per envelope, and the signed copies and audit trails live in somebody else’s system.

Self-hosted e-signature tools try to give that control back. You run the server, documents and audit logs stay in your database and storage, and the final PDF is sealed with a certificate you control. In 2026 there are three open source projects that are actively maintained and worth a serious look: Documenso, DocuSeal and OpenSign. All three are licensed under AGPL-3.0 (with some details we will explain), all three ship Docker images, and all three released new versions in the last few weeks.

This post revisits them calmly. We look at where each project came from, how they are built, licences and editions, features, security, backups, migration and, most importantly, the legal side: what an electronic signature means under India’s Information Technology Act, 2000 and under the EU eIDAS regulation, and what a self-hosted tool can and cannot promise. We did not run a hands-on drill for this post; the facts below come from official repositories, release notes, licences and documentation, read on 3 November 2026.

A short note before we start: this is an engineering post, not legal advice. For contracts that matter, involve your legal team or counsel.

A scenario to keep us honest

To keep the discussion practical, we use an invented company. This company is illustrative only; any resemblance to a real firm is accidental.

Madurai Meenakshi Agro Logistics (invented) runs cold storage and transport for fruit and vegetable traders in Tamil Nadu and Kerala. It has about 220 employees, eleven warehouses and a small IT team of four led by Karthikeyan. Today:

• HR sends offer letters and NDAs through a DocuSign business plan with six sender seats. The finance head wants to cut this cost but not at the price of legal risk.
• Warehouse lease renewals and transporter agreements are printed, signed, scanned and emailed. Original copies sit in a cupboard at the head office.
• Customer onboarding needs a signed service agreement and a KYC consent form. Sales staff collect these on paper during site visits.
• The company already runs PostgreSQL, a Nextcloud server for files and a Keycloak instance for staff sign-in.

The triggers for a review are simple: the DocuSign renewal is due in March, an auditor asked where signed contracts are stored and who can access them, and the sales team wants customers to sign on a phone during visits.

The short version

• Documenso is the closest to a direct DocuSign alternative with a clear self-hosting story, PostgreSQL only, a mandatory signing certificate you must provide, and documented options to route signing through a trust service provider for advanced or qualified signatures. Some features need a paid licence key.
• DocuSeal is the simplest to run (one container, SQLite by default, PostgreSQL or MySQL for production) and is strong at PDF form filling and templates. Several team features such as user roles, reminders, SSO and bulk send are in the paid Pro edition. Its AGPL licence carries an extra term that requires keeping DocuSeal attribution in the interface.
• OpenSign has a generous feature list in the open source edition (sequential signing, OTP for guest signers, templates, expiry) and added qualified electronic signature support in v3.0.0, but it runs on MongoDB and the default compose file needs hardening before production.
• None of them makes a signature legally valid on its own. In India, a plain click or drawn signature is an “electronic record” with evidence value, but it is not the same as an Aadhaar eSign or a DSC based digital signature recognised under Sections 3 and 3A of the IT Act. Decide which documents need which level before choosing a tool.

Where things stand on 3 November 2026

Documenso

• Repository: documenso/documenso on GitHub, created March 2023, about 15,600 stars when we checked.
• Licence: AGPL-3.0.
• Recent releases: v2.19.0 (29 September 2026), v2.20.0 (8 October), v2.21.0 (19 October) and v2.21.1 (22 October). The 2.20 release added recipient grouping; 2.21.0 added a feature to disable reported accounts and stored SSO client secrets as placeholders; 2.21.1 persists signatures for embedded signers without accounts and stops passkeys being removed when a user is disabled.
• Security: a high severity advisory (GHSA-3494-9j87-fj64) published on 2 October 2026 describes an admin dashboard data loader that returned user names and email addresses without authentication. The advisory lists versions up to 2.17.0 as affected. If you run an older instance, upgrade first.

DocuSeal

• Repository: docusealco/docuseal on GitHub, created July 2023, about 19,000 stars when we checked.
• Licence: AGPL-3.0 with additional terms under Section 7(b): a covered work must retain the original DocuSeal attribution in interactive user interfaces.
• Recent releases: 3.3.2 (12 October 2026), 3.3.3 (19 October, DOCX upload in the open source app), 3.3.4 (26 October, updated trusted CA certificates and a long running database migration; the project recommends all self-hosted users update) and 3.3.5 (2 November, JSON log format through LOG_FORMATTER=json). Mobile apps for iOS and Android were announced alongside these releases for both cloud and self-hosted users.
• Security: no repository security advisories were listed on GitHub when we checked. That is not proof of no issues; it only means none were published there.

OpenSign

• Repository: OpenSignLabs/OpenSign on GitHub, created October 2023, about 7,200 stars when we checked.
• Licence: AGPL-3.0 for most of the code. The LICENSE file says content under one server directory (apps/OpenSignServer/cloud/customRoute), if present, is under its own licence, and third party components keep their own licences. GitHub therefore shows the licence as “other”.
• Recent releases: v2.41.3 (21 August 2026), v3.0.0 (21 October, qualified electronic signature support with country-specific qualified signing methods, a redesigned interface, API token status and decline reasons in document APIs), v3.0.1 (26 October, dependency updates) and v3.1.0 (30 October, undo and redo plus multiple widget selection in the editor).
• Security: the advisories listed on GitHub are from 2024 and concern dependencies (PDF.js and react-pdf script execution with malicious PDFs, webpack-dev-middleware path traversal, tar parsing and ejs). They are a reminder that a signing tool is mostly a PDF processing tool, and PDF libraries need patching.

The first questions to ask

Before comparing features, answer these for your own company:

1. Which documents need which kind of signature? An internal leave approval, an NDA, an employment contract and a property lease are not the same. Make a list.
2. Who signs? Only staff, or customers, vendors and the public too? External signers change your email, OTP and identity verification needs.
3. What evidence do you need later? Audit trail, IP addresses, timestamps, email verification, a certificate on the final PDF, or a government recognised signature.
4. Where must data live? Some contracts carry personal data. India’s Digital Personal Data Protection Act, 2023 and your customer contracts may matter here.
5. Who will run the server? Patching, backups, certificate renewal and SMTP deliverability do not go away just because the licence is free.

How each one works

Documenso

Documenso is a TypeScript application. The README lists Prisma as the ORM and PostgreSQL as the database, with Docker optional. The self-hosting docs list four needs: a signing certificate, PostgreSQL 14 or newer, an SMTP server (or Resend or MailChannels) and a reverse proxy for TLS. It uses two connection strings, one pooled and one direct for migrations; without PgBouncer both can point to the same database.

The signing certificate is central. The docs say plainly that Documenso does not ship with one, the application will start without it, but all document signing will fail. Options are:

• A local .p12 file (self-signed or bought from a CA).
• Google Cloud HSM through Cloud KMS, so the private key never leaves the HSM.
• CSC (Cloud Signature Consortium API) to route signing through a third-party trust service provider for advanced and qualified electronic signatures.
• A timestamp server for trusted timestamps.

The docs are honest about self-signed certificates: they are free and guarantee integrity, but Adobe Acrobat will not show a green tick and recipients will see that the signature cannot be verified.

DocuSeal

DocuSeal is a Ruby on Rails application with background jobs. Its production database config chooses SQLite when no DATABASE_URL is set, and PostgreSQL or MySQL otherwise. The official docker-compose file runs the app, PostgreSQL 18 and Caddy for automatic HTTPS. Files can be stored on local disk, AWS S3, Google Cloud Storage or Azure.

The open source edition includes a WYSIWYG PDF form builder with 12 field types, multiple submitters, SMTP emails, automatic PDF eSignature, PDF signature verification, user management, API and webhooks, and signing in 14 languages. The Pro edition adds company logo and white label, user roles, automated reminders, SMS invitation and identity verification, conditional fields and formulas, bulk send from CSV or XLSX, SSO and SAML, template APIs and embedded signing and builder components.

OpenSign

OpenSign is a JavaScript stack: a React client and a Node server built on Parse Server, with MongoDB as the database. The official docker-compose file runs four containers: the server, MongoDB, the client and Caddy. The README warns that the default MongoDB instance in some deployments is not persistent and asks you to supply your own MongoDB connection URL to keep data.

Open source features listed in the README include multiple signers with sequential signing, email OTP for guest signers, document expiry and rejection with a reason, templates, OpenSign Drive for storing documents, an audit trail with a completion certificate (timestamps, IP addresses, email IDs and phone numbers), customisable email templates and an API.

Features that matter for contracts

Preparing documents

• Documenso: upload a PDF, place fields for each recipient, set signing order, use templates and direct links. Recipient grouping arrived in 2.20.0.
• DocuSeal: strongest PDF form builder of the three; DOCX upload is now in the open source app (3.3.3). Template creation by HTML or field tags through API is Pro.
• OpenSign: drag and drop widgets, templates, auto-detection of PDF fields, and undo and redo since 3.1.0.

Signer experience

• All three work in a mobile browser. DocuSeal now also has iOS and Android apps.
• OpenSign has email OTP for guest signers in the open source edition. DocuSeal’s SMS verification is Pro. Check Documenso’s current edition page for which authentication options need a licence.

Evidence

• All three produce an audit trail and a completion record and apply a digital signature to the final PDF.
• The value of that signature depends on the certificate. A self-signed certificate proves the file has not changed since sealing; it does not prove to Adobe or a court who the signer is.

Integrations

• All three have an API and webhooks. Documenso and DocuSeal offer embedding; in DocuSeal embedding is a Pro feature.

Security, sign-in and identity

Server security

• Put the app behind a reverse proxy with TLS, and expose only the signing pages that external signers need if your proxy allows path rules.
• In OpenSign’s default compose file, MongoDB is published on host port 27018 and the images use the main tag. Before production, remove the published database port, pin image versions and set a strong application master key in the environment file.
• In DocuSeal’s compose file, the PostgreSQL password is the default “postgres” and the image tag is latest. Change both.
• Documenso’s 2026 advisory shows that admin pages can leak data. Keep the admin account count small and patch quickly.

Staff sign-in

• SSO through SAML or OIDC is a common need. DocuSeal lists SSO and SAML as Pro. Documenso supports SSO configuration (2.21.0 touched how SSO secrets are stored); check which tier you need. OpenSign documents several integrations; verify SSO support for your edition before you plan around it.

Keys and certificates

• The signing key is the crown jewel. Store the .p12 outside the container image, restrict who can read it, and keep its password in a secret store, not in a compose file in Git.
• If you buy a document signing certificate from a CA, plan its renewal date like a TLS certificate. A signing certificate that expires quietly will stop signing or produce weaker signatures.
• Prefer an HSM or a trust service provider when the documents are high value.

Legal validity: India, the EU and the rest

This is the part that most comparisons skip. Please read it as background, not advice.

India: Information Technology Act, 2000

• Section 3 recognises a digital signature made with an asymmetric crypto system and hash function. In practice this means a Digital Signature Certificate (DSC) issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA).
• Section 3A, added by the 2008 amendment, recognises electronic signatures using techniques listed in the Second Schedule. The best known is eSign, an online electronic signature service based on Aadhaar e-KYC, offered through licensed eSign service providers.
• Section 5 gives legal recognition to such signatures where a law requires a signature, and Section 10A says a contract is not unenforceable only because it was formed electronically.
• The First Schedule excludes some documents from the Act: negotiable instruments other than cheques, powers of attorney, trusts, wills and contracts for sale or conveyance of immovable property. These generally still need wet signatures or other formalities, and some need stamping and registration under state law.
• A typed, drawn or click to sign signature from a self-hosted tool is not a Section 3 digital signature or a Second Schedule electronic signature. It can still be evidence that someone agreed, as an electronic record, and many companies use such signatures for NDAs and routine agreements. In a dispute, you may need to prove who signed and that the record is intact; the audit trail, email verification and the sealed PDF help, along with the certificate for electronic records under the Bharatiya Sakshya Adhiniyam, 2023 (which replaced the Indian Evidence Act from 1 July 2024).
• Stamp duty is a separate matter. An e-signed agreement may still need e-stamping depending on the state and document type.

European Union: eIDAS

• Regulation (EU) No 910/2014, amended by Regulation (EU) 2024/1183, defines three levels: simple electronic signature, advanced electronic signature (AES) and qualified electronic signature (QES).
• An electronic signature cannot be denied legal effect only because it is electronic. A QES, made with a qualified certificate and a qualified signature creation device, has the same legal effect as a handwritten signature across member states.
• Documenso’s CSC option and OpenSign’s v3.0.0 QES support both depend on a qualified trust service provider. The open source tool provides the workflow; the provider provides the qualification.

Elsewhere

• In the United States, the ESIGN Act of 2000 and state UETA laws generally accept electronic signatures with consent and record keeping requirements.
• For any other country, check the local law before you assume the same rules.

What this means for tool choice

• For NDAs, offer letters and routine vendor agreements, many Indian companies accept a simple electronic signature with a good audit trail. Confirm with your legal team.
• For documents where you want Section 3A recognition, plan an integration with a licensed eSign provider or a DSC workflow. None of the three tools ships an Aadhaar eSign integration in its open source edition as far as we could find, so treat this as integration work or a separate tool.
• For EU counterparties needing QES, look at Documenso’s CSC route or OpenSign’s QES feature, and confirm the edition and provider costs.

Performance and capacity

None of the three projects publishes formal sizing benchmarks that we could find. E-signature workloads are light compared with most business apps: the heavy parts are PDF rendering, PDF signing and email. A small virtual machine with 2 to 4 vCPU and 4 to 8 GiB of RAM is a reasonable starting point for a pilot in our judgement, not a vendor figure. DocuSeal’s 3.3.4 release note gives one useful data point: its database migration takes 1 to 2 minutes on a database with about 500,000 submissions and a few seconds under 10,000. Watch disk growth, because every completed document and its certificate are stored.

Licences and editions

What AGPL means here

• AGPL-3.0 lets you run, study and modify the software. If you modify it and let users interact with it over a network, you must offer those users the source of your modified version.
• For an internal deployment without code changes, this is rarely a burden. For a product that embeds a modified signing tool for customers, it matters a lot; talk to the vendor about a commercial licence.

Project specifics

• Documenso: AGPL-3.0 repository. Contributors sign a CLA. The docs include an “Apply your licence key” page for paid features on self-hosted instances. Anonymous telemetry (app version, installation ID and node ID) is on by default and can be disabled; the docs say document contents and user details are not collected.
• DocuSeal: AGPL-3.0 with the Section 7(b) attribution term. Pro features need a paid plan.
• OpenSign: AGPL-3.0 for most code, with a carve-out for one server directory and third party components. A hosted free and paid service exists; check which features need a paid plan.

Operations and day two

Install

• Documenso: Docker image on Docker Hub and GHCR; docs cover Docker, Docker Compose, Kubernetes, Railway and manual install. Prepare PostgreSQL, SMTP and the .p12 first.
• DocuSeal: one container is enough for a test (SQLite on a volume). For production, use PostgreSQL and pin the image tag instead of latest.
• OpenSign: compose file with server, client, MongoDB and Caddy. Use a persistent MongoDB with authentication and backups.

Upgrades

• All three release often, sometimes weekly. Pin versions, read release notes, and upgrade in a test copy first.
• DocuSeal 3.3.4 contains a long running migration; plan a short window on large databases.

Email

• Signing depends on email reaching people. Use a proper SMTP relay with SPF, DKIM and DMARC set for your domain. Many failed pilots are really email deliverability problems.

Backups

A signed contract you cannot produce later is worse than no e-signature tool. Back up all of these together:

• The database (PostgreSQL for Documenso and DocuSeal, MongoDB for OpenSign), with point in time recovery if you can.
• File storage: local volume or object storage bucket where PDFs live. Turn on versioning in object storage.
• The signing certificate and its password, kept separately and securely.
• Environment files and secrets (encryption keys, app keys). Without these, a restored database may be unreadable.

Test a restore at least once per quarter: restore into a separate server, open a few completed documents and verify the PDF signature in a PDF reader.

Retention

• Decide how long you keep signed documents and audit logs. Employment and tax records often have legal retention periods. Export completed PDFs to your document store as a second copy.

Migration from DocuSign

• Export completed envelopes and their certificates of completion from DocuSign before the contract ends. Keep them as PDFs in your archive; there is no reason to import them into the new tool.
• Rebuild templates manually in the new tool. Field placement rarely transfers cleanly.
• Run both systems in parallel for a month. New documents go to the new tool; in-flight envelopes finish in DocuSign.
• Update any integrations (HR system, CRM) to the new API and webhooks.
• Tell external signers that emails will now come from your domain, so they do not treat them as phishing.

Side by side

Best fit

• Documenso: companies that want a DocuSign style workflow, PostgreSQL, and a path to stronger signatures through HSM or a trust service provider.
• DocuSeal: teams that need PDF forms filled and signed, quick setup and a small footprint, and accept Pro for team features.
• OpenSign: teams that want many workflow features in the free edition and are comfortable running MongoDB.

Database and stack

• Documenso: TypeScript, PostgreSQL 14 or newer only.
• DocuSeal: Ruby on Rails, SQLite, PostgreSQL or MySQL.
• OpenSign: Node and Parse Server, MongoDB.

Licence

• Documenso: AGPL-3.0, paid licence key for some features.
• DocuSeal: AGPL-3.0 plus attribution term, Pro edition.
• OpenSign: AGPL-3.0 with stated exceptions.

Stronger signatures

• Documenso: HSM, CSC for AES and QES, timestamp server.
• DocuSeal: automatic PDF signing and signature verification; check docs for CA certificates.
• OpenSign: QES support since v3.0.0 with country-specific methods.

A worked plan for Madurai Meenakshi Agro Logistics

This plan is illustrative, like the company.

Month 1: classify and prepare

• With the legal team, sort documents into three groups: simple signature acceptable (NDAs, offer letters, transporter agreements), needs Aadhaar eSign or DSC (selected customer agreements), and must stay on paper (lease and property documents, powers of attorney).
• Export all completed DocuSign envelopes and certificates to the Nextcloud archive with restricted access.
• Set up a mail relay with SPF, DKIM and DMARC for a subdomain such as sign.example.in.

Months 2 and 3: pilot Documenso, test DocuSeal in parallel

• Install a pinned Documenso v2.21.x on a small VM with the company PostgreSQL, behind the existing reverse proxy. Start with a self-signed .p12 for the pilot only; buy a document signing certificate before go-live.
• Connect staff sign-in to Keycloak if the needed tier allows it; otherwise use strong passwords and passkeys.
• HR moves NDAs and offer letters. Sales tests customer service agreements on phones.
• In parallel, the IT team runs DocuSeal on one container with SQLite for the KYC consent form, since it is a fill and sign PDF form.
• Disable Documenso telemetry if the security team prefers.

Month 4: decide

• If Documenso handles HR and sales well, standardise on it. If PDF forms are the main need and the Pro price is acceptable, choose DocuSeal instead.
• For documents in the eSign group, ask two licensed eSign providers for an API quote and integrate later.

Months 5 and 6: go live and harden

• Production certificate, daily database and storage backups, a tested restore, and a written retention policy.
• Let the DocuSign contract end after in-flight envelopes complete.

What we do not recommend

• Moving property and lease documents to any e-signature tool without legal advice.
• Running OpenSign or DocuSeal compose files unchanged in production.
• Keeping the signing .p12 inside a Git repository or container image.
• Using latest image tags.

When not to adopt each

• Skip Documenso if you cannot run PostgreSQL or need SQLite simplicity.
• Skip DocuSeal if you need roles, reminders and SSO but cannot pay for Pro, or if the attribution term conflicts with white labelling needs.
• Skip OpenSign if your team has no MongoDB experience.
• Do not self-host at all if you lack someone to patch, back up and watch email delivery. A hosted service, even a hosted version of these tools, may be safer.

A short history

• Documenso started in 2023 with a public goal of being an open source DocuSign alternative; the README frames it as building trust by letting you self-host and inspect the code. Version 2 brought organisations, teams and the current self-hosting docs.
• DocuSeal began in mid 2023 as an open source document filling and signing platform and grew quickly, then added a Pro tier, mobile apps and embedding libraries.
• OpenSign appeared in October 2023 from OpenSign Labs and reached v3.0.0 in October 2026 with QES.
• Older options exist, such as LibreSign for Nextcloud, but we kept to the three most active standalone projects.

A simple decision guide

• Need DocuSign style envelopes with PostgreSQL and a QES path: Documenso.
• Need PDF forms and fastest setup: DocuSeal.
• Need sequential signing, OTP and expiry free of cost and run MongoDB already: OpenSign.
• Need Aadhaar eSign: plan a licensed provider integration whatever you choose.

Checklist before go-live

• Document classification signed off by legal.
• Pinned image versions and a tested upgrade path.
• Production signing certificate, stored securely, renewal date in the calendar.
• TLS, reverse proxy, no database ports exposed.
• SMTP with SPF, DKIM and DMARC.
• Admin accounts limited, SSO or strong authentication on.
• Backups of database, files, certificate and secrets, with a restore test done.
• Retention policy and export to the archive.

Common mistakes

• Assuming “open source e-signature” means “legally equal to Aadhaar eSign”.
• Going live with a self-signed certificate and confusing external signers with warnings.
• Forgetting the encryption keys in backups.
• Ignoring stamp duty for agreements that need it.
• Leaving default database passwords from sample compose files.

Hands-on check: what we ran and what we did not

We did not run a hands-on drill for this post. No tool was installed, and no signing, backup or restore was tested. All statements come from official repositories, licences, release notes and documentation read on 3 November 2026. Please run your own pilot before deciding.

Unlearn and re-learn

• Unlearn: an e-signature is just a picture of a signature on a PDF. Re-learn: the value is in identity checks, the audit trail and the cryptographic seal.
• Unlearn: self-hosting means free. Re-learn: you pay in certificates, email setup, backups and patching.
• Unlearn: one signature type fits all. Re-learn: match the signature level to the document and the law.

Sources

• Documenso repository and releases: https://github.com/documenso/documenso
• Documenso security advisory GHSA-3494-9j87-fj64: https://github.com/documenso/documenso/security/advisories/GHSA-3494-9j87-fj64
• Documenso self-hosting requirements: https://docs.documenso.com/docs/self-hosting/getting-started/requirements
• Documenso signing certificate docs: https://docs.documenso.com/docs/self-hosting/configuration/signing-certificate
• Documenso telemetry docs: https://docs.documenso.com/docs/self-hosting/configuration/telemetry
• DocuSeal repository and releases: https://github.com/docusealco/docuseal
• DocuSeal additional licence terms: https://github.com/docusealco/docuseal/blob/master/LICENSE_ADDITIONAL_TERMS
• OpenSign repository and releases: https://github.com/OpenSignLabs/OpenSign
• OpenSign licence: https://github.com/OpenSignLabs/OpenSign/blob/main/LICENSE
• Information Technology Act, 2000 (India Code): https://www.indiacode.nic.in/handle/123456789/1999
• Controller of Certifying Authorities: https://cca.gov.in/
• eIDAS Regulation (EU) No 910/2014: https://eur-lex.europa.eu/eli/reg/2014/910/oj
• Regulation (EU) 2024/1183: https://eur-lex.europa.eu/eli/reg/2024/1183/oj

Related on Revisit.Tech

• Self-hosted file sync and share in 2026
• Keycloak and its alternatives
• Self-hosted email in 2026
• TLS certificate automation in 2026
• PostgreSQL backups in 2026
• Reverse proxies in 2026
• Secret scanning in 2026
• Self-hosted helpdesk and ticketing in 2026
• Self-hosted wikis in 2026
• No-code databases in 2026