dalao.ai

Documenso

Open-source document signingOpen source

About Documenso

Documenso is an open-source e-signature platform from Documenso, Inc., pitched as the open DocuSign alternative: upload a PDF, place fields, send it out, and the finished file is sealed with an X.509 signature. As of 2026-10-25 it has 15,555 GitHub stars; v2.21.1 shipped at 2026-10-22 16:28 (UTC+8). The AGPL-3.0 edition self-hosts free; cloud plans run from free (5 docs/month) to $25 and $40/month billed yearly.

EditorialUpdated 9 min read

The Documenso interface

What it is

Documenso is open-source document signing software; its GitHub description reads "The Open Source DocuSign Alternative". The flow matches familiar e-signature services: upload a PDF, place signature, name and date fields for each recipient, send by email or link, and once everyone has signed the system produces a digitally signed final file plus a signing certificate. Users can use the hosted service or run the whole system on their own servers.

The README frames the project around trust: every e-signature adds a new party, the signing tool provider, and Documenso wants to become the most trusted signing tool by letting people self-host and inspect how it works. MANIFEST.md in the repo root describes the project as a commercial open source company and calls signing a basic right.

The project is maintained by Documenso, Inc. under AGPL-3.0. As of 2026-10-25 the repo has 15,555 stars, 3,403 forks and 4,223 commits on main, the latest at 2026-10-22 16:26 (UTC+8); v2.21.1, released the same day, is the current version.

Technically it is a TypeScript monorepo. The apps folder holds the main remix app, the docs site and openpage-api; packages include api, auth, email, lib, prisma, signing, trpc, ui and the enterprise code in ee. The README lists React Router v7, Hono, Prisma, Tailwind CSS, tRPC and Lingui, with @libpdf/core for PDF signatures and pdf.js for viewing. It needs Node.js 24 or later and a PostgreSQL database.

Documenso aims to be the world's most trusted document-signing tool.

Documenso README

Core capabilities

First, the signing flow. The website shows multiple recipients, signing order and CC roles; templates can produce a "direct link" that lets anyone holding it start a signing on their own. v1.13.0 introduced envelopes, which bundle several files into one signing task; v2.0.0 polished the envelope editor and added an envelopes API. Releases in 2026 added signing reminders, recipient grouping, a team document analytics dashboard, inbox filters and naming rules for documents created from templates.

Second, digital signatures. When a document completes, the system signs the PDF with an X.509 certificate to prove where it came from and expose later edits. Self-hosters supply their own certificate: a local .p12 file, a CA-issued certificate, Google Cloud HSM, or a third-party trust service provider over CSC for advanced or qualified electronic signatures, plus an optional timestamp server. v2.18.0 fixed the default when no signing transport is set and enlarged the signature placeholder when a timestamp authority is configured.

Third, developer interfaces. The website calls Documenso a "signing backend": the public API creates documents, templates and recipients and triggers workflows, with webhooks and Zapier alongside, and the signing UI can be embedded in React, Vue and other frameworks. On the cloud, embedded signing starts at the Teams plan and white-label embedding sits in Platform; embed authoring and its white-label version are on the enterprise feature list.

Fourth, teams and organisations. The cloud Teams plan includes 5 users, shared templates and separation of personal and team documents. The enterprise feature list adds an organisation authentication portal, re-authentication for document actions (passkeys and 2FA), email domains and the Stripe billing module.

Fifth, compliance material. The docs certifications page lists SOC 2 as compliant, 21 CFR Part 11 and HIPAA as compliant (Enterprise), and ISO 27001 as planned. These statuses are as reported by the vendor.

Who it's for / Not for

Good fit: organisations that want signing data on their own infrastructure. The Community Edition self-hosts for free, the self-hosting licenses page lists no usage limits for any edition, and the database, file storage and mail channel all stay under the operator's control.

Good fit: product teams adding signing to their own software. The API, webhooks and embedded signing let Documenso act as a backend; the Platform plan, $250/month billed yearly, offers unlimited documents, users and API calls with white-label embedding.

Good fit: high-volume teams. The cloud Individual and Teams plans list unlimited documents under a fair use policy; for contrast, DocuSign Standard and Business Pro include 100 envelopes per user per year.

Not a fit: setups that use a self-signed certificate yet need recipients to see a green check in Adobe Acrobat. The docs say self-signed certificates are not on Adobe's trust list and recipients see a warning that the signature cannot be confirmed; the self-hosting licenses page lists an AATL-recognised certificate only for Enterprise.

Not a fit: companies that cannot accept AGPL-3.0 yet plan to modify the code and serve it to others. Per the official use-case table, that calls for a commercial Enterprise license.

Not a fit: outside developers who want to push code upstream. Since 2026-06-18 the project no longer merges external pull requests and asks for detailed issues instead.

How it compares

Against DocuSign. As of 2026-10-25, DocuSign's annual-billing prices: Personal at $11/month with 5 envelopes a month; Standard at $30/user/month; Business Pro at $45/user/month, the latter two with 100 envelopes per user per year. Documenso's cloud Individual plan is $25/month billed yearly with unlimited documents; Teams is $40/month billed yearly with 5 users and $8/month per extra user.

Against DocuSeal. DocuSeal also calls itself an open-source DocuSign alternative; as of 2026-10-25 its repo has 18,789 stars, the same AGPL-3.0 license, and was created at 2023-07-04 03:54 (UTC+8).

Against OpenSign. OpenSignLabs/OpenSign also describes itself as a free, open-source DocuSign alternative and has 7,169 GitHub stars as of 2026-10-25.

Getting started

The free cloud tier allows 5 documents a month, up to 10 recipients each, and sign-up needs no credit card.

Self-hosting has several routes. The README and docs list Docker, Docker Compose, Railway, Kubernetes and manual deployment, and the README carries one-click buttons for Railway and Render; official images are on Docker Hub and GitHub Container Registry, and the production compose file is in docker/production. The docs quick start is four steps: clone the repo, copy .env.example, start the development compose file, and open local port 3000 in a browser.

Two pre-launch items. First, the signing certificate: Documenso ships without one, and without it the app starts normally but signing fails; the docs that SIGNING.md points to cover a local .p12, Google Cloud HSM and other options. Second, network security: the docs say outbound requests such as webhooks get only best-effort, non-exhaustive SSRF checks that fail open, a self-hosted instance can reach internal addresses, and egress filtering plus blocking cloud metadata endpoints is the operator's job through firewall and network configuration.

A deployment also needs PostgreSQL, SMTP mail and S3-compatible storage. Enterprise features (SSO, embed editor white label, 21 CFR Part 11) are switched on in a self-hosted instance with a license key. Local development needs Node.js 24 or later; npm run dx starts the database and mail test service, then npm run dev.

Pricing & license

The cloud has four tiers (prices as of 2026-10-25). Free is $0 with 5 documents a month and up to 10 recipients each. Individual is $300/year, or $25/month, with unlimited documents and API access for personal use. Teams is $480/year, or $40/month, with 5 users, $8/month per extra user, API access for automation and embedded signing. Platform is $3,000/year, or $250/month, with unlimited documents, users and API, white-label embedded signing and integration support over Slack. "Unlimited" is subject to the fair use policy, and enterprise deals are quoted separately.

Self-hosting comes in three editions. Community (CE) is free with no usage limits and community support only; Business (BE) is a fixed yearly license with the enterprise feature set and support; Enterprise (EE) is custom-priced and adds SLAs, roadmap priority, tailored terms and an AATL-recognised certificate. None of the three includes infrastructure support. The Enterprise docs say pricing depends on deployment type, user count, monthly signing volume, support level and contract term, with a 4 to 8 business hour target response for standard support.

The code is dual-licensed. The root LICENSE is AGPL-3.0; packages/ee carries the Documenso Commercial License, which allows production use of that code only with a valid Enterprise subscription while permitting free copying and modification for development and testing. The FEATURES file lists what falls under it: the Stripe billing module, organisation authentication portal, document action re-authentication, 21 CFR, email domains, and embed authoring with its white label. The official use-case table says internal use without modifications and SaaS products that only call the API can use the Community Edition; internal use with private modifications, SaaS products with modified code and white-label products need Enterprise.

Contributors sign a CLA granting Documenso, Inc. a sublicensable license. When evaluating, keep the two layers apart: AGPL governs the community code, and the commercial license in ee governs the enterprise features.

Risks & limits

The advisory trailed the fix. GitHub lists one published advisory, GHSA-3494-9j87-fj64, rated high: the admin panel data loader discloses user information without authentication, published at 2026-10-03 07:56 (UTC+8). It lists affected versions as 2.17.0 and earlier and the patched field as "> 2.18.0"; v2.18.0 shipped at 2026-09-09 09:35 (UTC+8) and v2.19.0 at 2026-09-29 12:39 (UTC+8), both before the advisory.

Security policy scope. SECURITY.md entered the repo at 2026-06-25 21:59 (UTC+8). It accepts private GitHub vulnerability reports and email to security@documenso.com, handled as the team has availability; the codebase has already been through Codex security analysis and duplicates are closed. SSRF, DNS rebinding, rate limiting and denial of service, TLS and headers, and self-hosting misconfiguration are out of scope, and fixes land only in the latest release.

Contributions are narrower. On 2026-06-18 the official blog announced that external pull requests will no longer be merged, citing npm supply chain attacks that are increasingly hard to catch in review; the README gained the same note at 2026-06-25 21:59 (UTC+8). The blog says pull requests already in flight may still be merged, which is why v2.18.0 and v2.19.0 still credit fixes from outside accounts. As of 2026-10-25 the repo has 924 issues in total with 148 open, and 2,384 pull requests with 1,690 merged and 89 open.

Contributors. The GitHub contributors API shows the top two accounts with 1,181 and 1,000 contributions (as of 2026-10-25).

Compliance is tiered. The certifications page marks ISO 27001 as planned, and 21 CFR Part 11 and HIPAA are Enterprise-only.

How it got here

The first commit in git history is "Create LICENSE" by Timur Ercan at 2022-11-14 22:58 (UTC+8); the license has been AGPL-3.0 from the start and LICENSE has not changed since. The GitHub repo was created at 2023-03-13 00:28 (UTC+8), and the first preview, 0.9-developer-preview, shipped at 2023-03-14 00:53 (UTC+8). The Open Startup page lists Timur Ercan as co-founder and CEO and Lucas Smith, who joined in April 2023, as co-founder and CTO; funding is listed as $288,000 in May 2023 and $1,538,999 in July 2023.

In the second half of 2023 the company scaffolding arrived: MANIFEST.md at 2023-07-13 17:10 (UTC+8), CLA.md at 2023-08-05 15:44 (UTC+8), and the commercial license in ee at 2023-08-30 14:36 (UTC+8). v0.9 shipped at 2023-08-01 22:16 (UTC+8) and v1.0 at 2023-11-14 16:02 (UTC+8).

The enterprise FEATURES list was added at 2024-07-22 19:34 (UTC+8). In 2025 the framework moved: the commit replacing Next.js with React Router 7 was written at 2025-01-02 12:33 (UTC+8) and shipped in v1.10.0 at 2025-05-02 10:06 (UTC+8). v1.13.0 introduced envelopes at 2025-10-24 07:52 (UTC+8), and v2.0.0 followed at 2025-11-07 12:44 (UTC+8).

Security and governance changes in 2026 follow. On 2026-06-18 the blog announced the pause on external pull requests, and a repo maintenance commit at 2026-06-25 21:59 (UTC+8) added SECURITY.md and updated the README. v2.18.0 then blocked SSRF via IPv4-mapped IPv6 webhook URLs, and v2.21.0 added account disabling on report. The first GitHub security advisory was published at 2026-10-03 07:56 (UTC+8), and v2.21.1 shipped at 2026-10-22 16:28 (UTC+8), the latest release as of 2026-10-25.

Our verdict

Documenso has signing flows, digital signatures, API and embedding, and team management, and both cloud and self-hosting have public pricing or licensing terms. Its source code is public and it can be self-hosted.

The free cloud tier allows 5 documents a month; Individual and Teams differ in user count and API use. The Community Edition can be self-hosted, with the trusted signing certificate and outbound network limits handled by the operator. Embedding signing in a product with modified code needs an Enterprise license under the official use-case table.

Three limits: trusted certificates and compliance such as 21 CFR Part 11 and HIPAA sit in paid editions; security fixes ship before advisories and only on the latest release; and with external pull requests paused, outside contributions are limited to issues.

Why it stands out

Documenso is an open source alternative to DocuSign that takes the legal and cryptographic parts seriously. Signatures are embedded properly into PDFs, audit trails are complete, ISO 27001 certification is planned, and HIPAA compliance is offered on the enterprise plan.

Timur Ercan and Lucas Smith built it in public, and the product has grown from a weekend prototype into something companies rely on for real contracts.

It is an open source alternative to DocuSign that embeds signatures in the PDF and keeps a complete audit trail.

Sources

Official

  1. documenso/documenso on GitHubGitHub · Accessed Oct 25, 2026
  2. Documenso READMEGitHub · Accessed Oct 25, 2026
  3. Documenso LICENSEGitHub · Accessed Oct 25, 2026
  4. Documenso packages/ee/LICENSE (Commercial License)GitHub · Accessed Oct 25, 2026
  5. Documenso packages/ee/FEATURESGitHub · Accessed Oct 25, 2026
  6. Documenso SECURITY.mdGitHub · Accessed Oct 25, 2026
  7. Documenso Contributor License AgreementGitHub · Accessed Oct 25, 2026
  8. Documenso commit 7b08d40: Create LICENSEGitHub · Accessed Oct 25, 2026

Updates & reading