“"IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available." — somery (creator), https://news.ycombinator.com/item?id=36798593”
You know that feeling when you need to send a contract to 50 customers and DocuSign's per-envelope fee turns a $0 workflow into a $50 line item? Every API call costs money, every embedded form requires a paid plan, and you have no control over the third-party UI injected into your product. Teams running SaaS products that generate documents automatically — onboarding agreements, NDAs, healthcare consent forms — pay a recurring per-user tax for infrastructure that could run on a $10 VPS.
You upload a PDF or DOCX to DocuSeal's WYSIWYG builder and drag 12 field types — signature, date, checkbox, file upload, stamp, and others — onto the document pages, assigning each field to a named submitter. DocuSeal emails each submitter a unique signing link with no account required on their end. When they complete their fields, the platform embeds a PKCS#7 certificate into the PDF and stores the signed file on your disk, S3, Google Cloud Storage, or Azure. IP address and browser user-agent are logged per submission as the audit trail. The whole system runs as a single Rails monolith you start with one Docker command.
If you're a backend engineer whose product generates PDFs — onboarding agreements, healthcare consent forms, vendor NDAs — and you're paying per-envelope fees to DocuSign or PandaDoc, DocuSeal is worth evaluating. Also strong for teams that need to embed a signing flow directly in their product without a third-party redirect. Not the right tool if you need third-party-certified legal custody of signatures — the non-repudiation limitations documented in the HN launch thread are structural and not addressable with configuration alone.
DocuSeal has 151 verified releases at weekly cadence, an active issue tracker, and claimed production use by 162,100 users with enterprise logos from Intuit, UC San Diego, and Fullscript on the homepage. For internal workflows, developer embedding, and low-stakes document workflows, it's production-ready. Two hard limits remain: the AGPL + Section 7(b) Additional Terms require a legal audit before embedding in any commercial product, and self-hosted instances carry a structural non-repudiation weakness for contracts where a signing dispute is plausible.
Deep-dive insight, Easy and Pro modes, plus action playbooks — the full breakdown is one tap away.