e-sig — full site digest for LLMs and agents Generated by scripts/ops/gen-llms-full.mjs from the live page HTML — do not edit by hand. Brief: https://e-sig.org/llms.txt · Source: https://github.com/vmvtech/esig-suite ======================================================== Homepage — https://e-sig.org/ ======================================================== e-sig How it works Post-quantum Pricing Why e-sig Verify Docs GitHub ↗ ◑ MIT-licensed · no per-document fees · self-hosted # Own your signatures. A batteries-included PDF e-signature SDK you embed in your own product. Render, cryptographically sign, timestamp, verify, and audit — entirely inside your infrastructure. Your certs, your database, your storage. No SaaS required in the signing path. See pricing Quickstart View on GitHub npm ↗ ## The whole pipeline, in your process One call takes an HTML document to a signed, tamper-evident PDF and an append-only attribution record — no external service ever touches the document. renderHtmlToPdf→ signPdf (PKCS#7)→ RFC-3161 timestamp→ verifyPdfSignature→ store + audit ### 🔏Real cryptography PKCS#7 detached signatures under the ETSI.CAdES.detached subfilter, with the ESS signing-certificate-v2 binding. Verification recomputes the document digest and checks the RSA signature — a single altered byte fails. ### ⏱️Trusted timestamps Optional RFC-3161 timestamps upgrade a signature to CAdES-T. The package performs no egress — the TSA only ever receives a SHA-256 hash, never your document. ### ✉️Multi-signer envelopes N ordered signers over one document, each addressed by a single-use tokenized signing link — only token hashes are ever stored. Equal order signs in parallel; a decline voids the envelope. ### 🧩Bring your own stack Pluggable CertStore / AuditLogStore / storage / EnvelopeStore interfaces. Supabase reference adapters ship in the box — or run the whole pipeline on a bare directory with the built-in filesystem adapters. ### 🖊️Drop-in signing UI React components — a draw-to-sign canvas, a consent-gated sign flow, a signed receipt, and a verification panel — with no framework coupling. ### 🏥Zero PHI egress Everything runs inside your boundary. Nothing but a hash leaves your servers, so no signing-vendor BAA is needed and the whole thing sits inside your own SOC 2 scope. ### 📜ESIGN / UETA-oriented Intent (recorded consent), attribution (append-only, hash-chained audit log — actor, IP, UA, cert fingerprint), and integrity (cryptographic signature + optional timestamp). Tampering with any audit row breaks the chain. ### ✅Verify in CI A CLI (npx -y -p @e-sig/core esig verify --json) and a GitHub Action check a signed PDF on every push. See /agents. ### 🤖Agent-driven signing The @e-sig/mcp MCP server lets an agent create envelopes, send reminders, and react to lifecycle webhooks, while a human keeps cryptographic control of signing. See /agents. NEW · post-quantum ready · FIPS 204 ## Signatures built to outlast the quantum threat Attach a hybrid Ed25519 + ML-DSA-65 seal — NIST's FIPS 204 post-quantum signature standard — underneath the classical signature. The PDF still validates in Adobe Acrobat today, and it's protected against a "harvest-now, decrypt-later" adversary with a quantum computer tomorrow. Alter one byte and both layers fail. classicalPAdES · PKCS#7 RSAOpens valid in every PDF reader, including Adobe Acrobat.✓ valid post-quantumML-DSA-65 · FIPS 204Quantum-resistant hybrid seal — Ed25519 + ML-DSA-65.✓ verified ### 🛡️Hybrid, not either-or Both a classical Ed25519 and a post-quantum ML-DSA-65 signature must verify — the NIST / CNSA 2.0 migration path. Breaking the seal means breaking both schemes at once. ### 📄Still opens in Acrobat No reader validates ML-DSA in PAdES yet, so the seal rides under the RSA signature the reader already trusts. Zero disruption for the people signing and receiving your documents. ### 🆔Standards-shaped identity Publish a self-signed ML-DSA-65 X.509 certificate (RFC 9881) — it parses and verifies in OpenSSL 3.5+. Pin the signer in-band, or require post-quantum protection outright. ### 🔑Managed keys, rotatable Per-tenant hybrid key bundles, AES-256-GCM-wrapped at rest, generated on first use and rotatable on demand. Documents already sealed keep verifying under their embedded key. ## Sign a document in a few lines Compose your HTML, hand it to the orchestrator over your three stores, get back a stored URL, an audit id, and a cert fingerprint. ⏱️ 60 seconds · zero services · one command $ npm install && npm run build && npm run quickstart issue cert→ render html→pdf→ sign (+timestamp)→ verify→ reject tamper That's the entire quickstart — no signup, no API keys, no external calls. Copy examples/quickstart ↗ into your own project and run it yourself. Here's the API underneath: // one call: render → issue/rotate cert → sign (+timestamp) → store → audit import { signDocument } from "@e-sig/core"; const result = await signDocument({ html, signatureImage, tenantId, subjectName: tenantName, passphrase: process.env.ESIG_CERT_PASSPHRASE, signer: { name, email }, certStore, auditStore, storage, // your adapters pathPrefix: `${tenantId}/${documentId}`, }); // → { signedPdfUrl, auditLogId, certFingerprint, timestamped } const ok = verifyPdfSignature(signedPdf).ok; // true — cryptographically ## The per-signature meter, deleted Every incumbent re-introduces a fee at exactly the moment you embed signing into your product. e-sig doesn't — it runs in your process, on your infrastructure, forever, for free. Model · Per-document cost · Runs in your app · Own your certs & data · e-sig · $0 — no meter · Yes (in-process SDK) · Yes · DocuSign API · ~$1.88–7.20 / envelope · No (SaaS) · No · Dropbox Sign / Anvil · ~$1.50 / doc · No · No · DocuSeal (self-hosted) · $0.20 / doc — even on-prem · Beside your app · Its own · Documenso · $250/mo embed license → · Beside your app (AGPL) · Its own · Pricing figures are indicative public rates as of 2026 and vary by plan and volume; check each vendor for current terms. See our legal notices. ## Open source, self-hosted, yours The full engine, adapters, and UI are MIT-licensed. Clone it, read every line of the signing path, run it inside your own walls. GitHub repository ↗ Docs ↗ e-sig Pricing Why e-sig Verify For agents Press Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. Self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Why e-sig — https://e-sig.org/why-esig ======================================================== e-sig How it works Pricing Why e-sig Docs GitHub ↗ ◑ # Own your signatures. Verify your vendor. Every other e-signature vendor asks you to trust them. We ship an MIT-licensed signing SDK, a continuous assurance layer any auditor can inspect, and standards housed at an independent public foundation. If our company disappears tomorrow, your evidence still verifies. GitHub ↗ DSalvus Assurance ↗ ## The four layers of the e-sig trust stack Two neutral public-interest institutions on top; two commercial products below. Trust and continuity do not depend on any single company remaining in business. Public trust ### UUAID Foundation Constitutional charter, custodian of decentralized continuity for autonomous agents. Parent of IAASO. Nonprofit incorporation in attorney review. Neutral · Independent Standards ### UUAID + IAASO Identity registry + standards. Every agent gets a durable UUAID, Ed25519-signed credentials from AAUA, and a Polygon-anchored ledger. Public · Neutral Assurance ### DSalvus Agent Trust Infrastructure. Fail-CLOSED policy kernel, runtime posture, continuous evidence, monthly signed Assurance Packages. Commercial · e-sig Signing ### e-sig / esig-suite MIT-licensed PDF signing SDK. PKCS#7 + RFC-3161 timestamps + tamper- evident hash chain, plus an optional post-quantum hybrid seal (ML-DSA-65, FIPS 204). UUAID-aware audit; optional eIDAS QES via QTSP partners. Commercial · e-sig ## Why the vendor architecture matters Every enterprise-buyer conversation eventually hits the same six questions. Nobody else in the e-signature market has our answer to all six. What buyers want to know · Incumbents (DocuSign, Adobe, PandaDoc) · e-sig stack · Can I read the signing code? · No — closed source · Yes — MIT on GitHub · Can I self-host on my own infra? · No · Yes — free forever · Continuous evidence between audits? · No — annual SOC 2 report · Yes — monthly signed Assurance Package · Public verifiability of every agent action? · No — vendor-scoped audit log · Yes — Polygon-anchored via UUAID · Standards owned by a neutral body? · No — vendor spec · Yes — UUAID Foundation + IAASO · Trust survives vendor going away? · No · Yes — Foundation is independent · eIDAS Qualified Electronic Signature? · Yes — via QTSPs · Yes — via QTSP partners · Comparison reflects publicly available offerings as of 2026 and is intended as guidance for procurement conversations, not a marketing claim about named competitors. Check each vendor for current terms. See our legal notices. Every other e-signature vendor asks you to trust them. We ask you to verify us. Every deployment ships with DSalvus continuous assurance, every agent action is anchored to the public UUAID registry, and the standards themselves live at the independent UUAID Foundation. If our company disappears tomorrow, your evidence still verifies. ## How enterprises actually buy this Business and Dedicated Cloud engagements can include the DSalvus Assurance Package as a bundled add-on ($1,500–$4,000/mo per tenant). It ships as a signed monthly PDF into your compliance drive with everything a SOC 2 or HIPAA auditor needs: control results, runtime posture, agent-action attestations tied to public UUAID identities, evidence manifest with hashes, and dispute-ready envelopes. For regulated verticals (healthcare, finance, life sciences) we ship the same package with the appropriate compliance overlay — HIPAA BAA, 21 CFR Part 11, PCI DSS — and route qualified signatures via an EU Trusted-List QTSP for eIDAS QES -grade documents. See esig-suite pricing Book an enterprise briefing ## Common questions ### Is the SDK really MIT and staying that way? Yes. No AGPL relicense, no rug-pulls. The commercial products (DSalvus, Cloud, Business, Dedicated) fund e-sig — the SDK is not something we can take away. ### Does the UUAID Foundation actually exist? Yes — uuaid.foundation. Constitutional Charter adopted as founding doctrine; formal nonprofit incorporation in attorney review. Registry live at registry.uuaid.org, API at api.uuaid.org, SDK on npm. ### What if e-sig is acquired? The UUAID Foundation is legally independent from e-sig's commercial operator. Its identifier scheme, Trust Registry, and IAASO standards continue independently. Existing esig-suite MIT code continues to work forever, while commercial obligations transfer to the acquirer. ### Can I run this air-gapped? Yes. UUAID identity verification degrades to periodic Trusted-List snapshots with no outbound connectivity; the DSalvus policy kernel is fully local; esig-suite runs standalone on the built-in filesystem adapters. e-sig Pricing Why e-sig Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite & DSalvus are products of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Public verifier — https://e-sig.org/verify ======================================================== e-sig How it works Pricing Why e-sig Verify Docs GitHub ↗ ◑ # Verify a signed PDF. Right here, offline. Drop a PDF signed with esig-suite (or any PKCS#7 / CAdES signer) to check its integrity, authenticity, and trusted timestamp. Everything runs in your browser — your file never leaves your device, no API calls, no uploads. Drop a signed PDF here or click to choose a file · .pdf · processed locally with the same verifier that ships in @e-sig/core ## What this checks The exact same static-verification logic that ships in @e-sig/core, compiled for the browser. Check · What it proves · Byte-range coverage · The signature's /ByteRange tiles the whole file — nothing was appended or patched around the signed region. · Integrity (SHA-256) · The signed messageDigest attribute matches the hash of the covered bytes — the document was not modified after signing. · Authenticity (RSA) · The RSA signature verifies against the embedded signer certificate over the signed attributes. · RFC 3161 timestamp · If present (CAdES-T), the timestamp token's messageImprint binds to the signature — proving when it was signed. · What this does not check: whether you should trust the signer certificate itself. esig-suite issues self-signed, per-tenant certs, so trust is established out-of-band (compare the cert fingerprint against the issuer's audit log — see verifyPdfSignature in the repo). Structural and cryptographic verification here is exact. e-sig Pricing Why e-sig Verify Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite & DSalvus are products of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Pricing — https://e-sig.org/pricing ======================================================== e-sig How it works Pricing Why e-sig Docs GitHub ↗ ◑ MIT-licensed SDK · free forever · pay only for hosting # Pricing. The SDK is MIT-licensed and free forever. Managed Cloud is in private preview while we finish automatic account and workspace provisioning. No checkout yet. Join the Cloud waitlist and tell us what you need. We will not take payment until your account can be provisioned and used end to end. Shared prices below are support-backed planning estimates; invitation-only 90-day founding previews may be offered at a lower, best-effort rate. Monthly Yearlysave ~17% Open Source $0/ forever MIT SDK. Self-host anything, anywhere. - @e-sig/core, React UI, Supabase adapters - @e-sig/mcp — MCP server for agent-driven signing (in-repo at packages/esig-mcp) - PKCS#7 + RFC-3161 + PAdES - Post-quantum seal — ML-DSA-65 (FIPS 204) - Multi-signer envelopes - Tamper-evident audit hash-chain - Filesystem adapters — zero services - Community support (GitHub Discussions) - No warranty, no SLA Clone on GitHub Shared Cloud Starter · private preview $79/ mo RLS-isolated managed hosting for individuals. - 100 envelopes/mo · 1 user - Managed Postgres audit chain - S3 storage + verify page - Postmark email (at cost) - REST API + TypeScript SDK - Webhooks, tokenized links - $0.20/envelope overage - Email support · 2-business-day response - Founding preview may start at $19/mo for 90 days · best effort Join Starter waitlist Shared Cloud Team · private preview $199/ mo RLS-isolated managed hosting for growing teams. - 500 envelopes/mo · 5 users - Everything in Starter - Higher rate limits (300 req/min) - Custom subdomain - $0.20/envelope overage - Priority email · 1-business-day response - Founding preview may start at $49/mo for 90 days · best effort Join Team waitlist Shared Cloud Scale · private preview $499/ mo RLS-isolated managed hosting at volume. - 1,500 envelopes/mo · 15 users - Everything in Team - 1,000 req/min rate limit - Priority queue on signing - $0.20/envelope overage - Priority email · 8-business-hour response - Founding preview may start at $79/mo for 90 days · best effort Join Scale waitlist Business (self-hosted) $299/ mo per production deployment Self-host the OSS SDK with a real vendor relationship. - Priority email + Slack Connect · 8-business-hour response - Signed commercial invoice + W-9 + insurance certificate - Security questionnaire responses, DPA, W-9, and insurance certificate on request - Quarterly security patches · 90-day breaking-change notice - DPA and BAA available - Published MIT adapters — @e-sig/hsm-pkcs11 (PKCS#11 / CloudHSM / YubiHSM) and @e-sig/worm (S3 Object-Lock archival) - SSO/SAML and LDAP audit sink available on request - Named contact — a founder, not a queue Talk to us Dedicated Cloud · private preview from $30k/ yr + $5k setup A separate Supabase project and AWS data-plane stack for one customer. - Dedicated Postgres, auth, storage namespace, and API credentials - Customer-specific KMS key, private versioned S3, queue + DLQ - Deterministic, resumable infrastructure provisioning - Signed order form, DPA, and scoped support policy - SSO, HIPAA, HSM, WORM, private networking, and enhanced SLA quoted separately - Custom integrations and usage above contract limits are not included Join Dedicated waitlist Private preview intake ## Tell us what you need. Choose an offer, share the shape of your rollout, and we will follow up when the right provisioning path is ready. This is a request for access—not checkout. Choose an offer in the form. No card details. No subscription. No promise of access. Offer Choose an offer Shared Cloud Starter — $79/mo planning estimate Shared Cloud Team — $199/mo planning estimate Shared Cloud Scale — $499/mo planning estimate Business — self-hosted support Dedicated Cloud — from $30k/yr + setup Add-on — HIPAA BAA + Healthcare Runbook Add-on — HSM Signer (PKCS#11) Add-on — eIDAS QES Integration Add-on — 21 CFR Part 11 Add-on — UUAID Enterprise Add-on — WORM Archival (Object-Lock) Work email Name optional Company optional Expected monthly envelopes optional What are you building? optional Do not include documents, signer data, health information, or other sensitive personal data. Website I authorize e-sig to contact me at the email I entered about this specific preview or commercial-offer request. This is not consent to unrelated marketing. See the Privacy Policy. Request preview access If the form still fails, email sales@e-sig.org. MIT-licensed. No AGPL, no rug-pulls, ever. $0.20 / envelope planned Cloud overage — vs Dropbox Sign $1+, BoldSign $0.75, DocuSign $2–$4. Or self-host for $0. The planned Cloud tier exists because operations aren't free — not because the SDK is crippled. ## Vertical add-ons Available on Business and Dedicated Cloud. Priced separately so they never inflate the base — turn on the ones you need, leave the rest off. Add-on · Monthly · Who buys it · · HIPAA BAA + Healthcare Runbook · $500 / mo · Clinical trials, EHR, telehealth · Contact sales → · HSM Signer (PKCS#11) · $800 / mo · Regulated finance, notary, government · Contact sales → · eIDAS QES Integration · $1,500 / mo · EU legal, real-estate, insurance · Contact sales → · 21 CFR Part 11 · $1,200 / mo · Pharma, medical devices · Contact sales → · UUAID Enterprise (agent-signed docs) · $500 / mo · AI agent platforms · Contact sales → · WORM Archival (Object-Lock) · $300 / mo · SEC / FINRA, legal discovery · Contact sales → · ## How we price vs the market Provider · Entry paid · Volume plan · Overage / env · Self-host? · License · e-sig Cloud (preview) · planned $79/mo (100 env) · planned $499/mo (1,500 env) · target $0.20 · Yes, free · MIT · DocuSign · $10/mo (5 env) · $40/user/mo · $2.00–$4.00 · No · Closed · Dropbox Sign · $15/mo · $300/mo API · $1.00–$1.20 · No · Closed · BoldSign · $5/user/mo · $30/mo API (40 env) · $0.75 · No · Closed · PandaDoc API · $40/mo (40 docs) · Custom · $2.00–$4.00 · No · Closed · DocuSeal · $20/user/mo · Pro only · — · Yes · AGPL-3.0 · Documenso Cloud · $30/user/mo · $30/user/mo · — · Yes · AGPL-3.0 · Comparison reflects publicly available offerings as of 2026 and is intended as guidance for procurement conversations. Check each vendor for current terms. See our legal notices. ## Common questions ### Why is the SDK free but the Cloud isn't? The SDK is MIT and always will be. You pay us when you don't want to run Postgres, rotate certs, chase deliverability, and respond to auditors yourself. ### Do I need Business if I self-host? No. Business exists for teams whose procurement needs an invoice, a DPA, and a named contact. If you're a solo developer, self-host free. ### What counts as an envelope? One document, any number of signers. Same definition as DocuSign, BoldSign, Dropbox Sign. Verifications, downloads, and reminders are free. ### What about SSO / SAML? Available on Business and Dedicated Cloud. We don't put SSO behind a $50k+ tax — it's a $299/mo Business feature. ### Is signing legally binding? The signing path targets ESIGN and UETA in the US: intent (explicit consent), attribution (actor, IP, UA, cert fingerprint), integrity (PKCS#7 + optional RFC-3161 timestamp). You remain responsible for your own compliance review. ### What are your uptime commitments? Cloud is in private preview and has no paid SLA yet. Any uptime commitment will be published before checkout opens. Business and Dedicated Cloud commitments are defined in their signed agreements. e-sig Pricing Why e-sig Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== vs DocuSign — https://e-sig.org/vs/docusign ======================================================== e-sig How it works Pricing Verify Docs GitHub ↗ ◑ # esig-suite vs DocuSign This one isn't really a feature comparison — it's a business-model comparison. DocuSign rents you signing capacity and meters it. esig-suite is software you own outright. Different cost curves, different data ownership, different trust model. ## The one-sentence version DocuSign is a metered SaaS: per-envelope fees, documents on their infrastructure, trust anchored to their brand. esig-suite is a self-hosted MIT SDK: sign unlimited documents on your own infrastructure, no per-document fees, ever. · esig-suite · DocuSign · Model · Open-source SDK (MIT) + optional managed cloud · Proprietary SaaS · Cost shape · Flat: your infra + optional support. Zero per-envelope fees · Per-seat + per-envelope tiers; overages metered · Where documents live · Your storage, your database · Their cloud (data-residency options on higher tiers) · Certificates · You own and issue per-tenant certs · Their managed trust infrastructure · Audit trail · Append-only, hash-chained, in your database · Their hosted Certificate of Completion · Recipient trust recognition · None — new name · Industry standard; recipients know the flow · Vendor lock-in · None — MIT, standard PKCS#7 / CAdES output verifiable anywhere · High — workflows, templates, and evidence live in their system · ## The cost math at volume Per-envelope pricing is convenient at low volume and punishing at high volume — it's a tax that scales with your success. With esig-suite, the marginal cost of the millionth signed PDF is the same as the first: whatever your storage and compute already cost. If signing is core to your product rather than an occasional back-office task, the flat curve wins early and keeps winning. ## Where DocuSign is genuinely ahead Brand trust at the signing ceremony (recipients recognize the flow and complete it), AATL/EUTL trust-list anchoring out of the box, identity-verification add-ons, notarization products, CLM, and a compliance org bigger than most companies. Regulated enterprises buying assurance, not software, should keep buying DocuSign. esig-suite's signatures are cryptographically standard — but the trust in your self-issued certs is established out-of-band, and that burden is yours. ## Where esig-suite is different Ownership. The certs are yours, the PDFs never leave your storage, the audit log is a hash-chained table in your database, and the signatures are bog-standard PKCS#7 / CAdES that any verifier on earth can check — including the in-browser verifier on this site. No metering, no renewal negotiation, no sunset risk, no copyleft (MIT). You trade DocuSign's brand trust for complete control; for product-embedded signing, that's usually the right trade. This page is a summary, not legal advice. Competitor facts reflect public pricing/docs as of July 2026 — tell us if we've gotten something wrong: open an issue. e-sig Pricing Why e-sig Verify vs Documenso vs DocuSeal GitHub Terms of Use Privacy Policy Legal MIT-licensed SDK © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). ======================================================== vs Documenso — https://e-sig.org/vs/documenso ======================================================== e-sig How it works Pricing Verify Docs GitHub ↗ ◑ # esig-suite vs Documenso Documenso is a good product — a full signing application you host. esig-suite is a different thing: a library you embed inside the app you already have. The choice turns on license and architecture, not feature checklists. ## The one-sentence version Documenso is an AGPL-3.0 application you deploy. esig-suite is an MIT-licensed SDK you embed. If you want a standalone signing portal, Documenso is the more complete product today. If you want signing inside your own SaaS, agency deliverable, or closed-source product, the AGPL is the reason you're reading this page. · esig-suite · Documenso · License · MIT · AGPL-3.0 · What it is · Embeddable SDK (engine + adapters + React UI) · Hosted signing application (Next.js monolith) · Embedding in closed-source SaaS · Unrestricted · AGPL network-use clause triggers source-disclosure obligations for the whole offering; most teams route around it with a commercial license · Your UI · Yours — headless core, optional React components · Documenso's — themable, but it's their app · Signature format · PKCS#7 / CAdES, optional RFC-3161 (CAdES-T) · PAdES via its own stack · Audit model · Append-only, hash-chained log you store · Application database · Self-hosted · Both · Both · ## Why the AGPL question decides it for embedders AGPL-3.0 extends copyleft to network use: offer the software (or a derivative) as a service and you must offer the corresponding source — for many legal teams, of the offering as a whole. SaaS teams, agencies shipping client work, and closed-source products typically can't accept that without a commercial agreement. MIT imposes no such obligation: embed, modify, ship, keep your code yours. If you already know you need MIT-permissive, the comparison ends here. ## Where Documenso is ahead — honestly A polished end-user signing experience out of the box, team/template management UI, a larger community, and years of production hardening as a complete product. If you were going to run a standalone signing portal and can live with AGPL (or their commercial license), use Documenso — don't rebuild their app on top of our SDK unless embedding is the actual requirement. ## Where esig-suite is different MIT and library-first: renderHtmlToPdf → signPdf (+TSA) → verifyPdfSignature, self-issued per-tenant certs, tokenized multi-signer envelopes, and a hash-chained audit log — all as npm install, not a deployment. You own the certs, the PDFs, and the trail, with no application surface to adopt and no copyleft review to schedule. License texts govern; this page is a summary, not legal advice. Competitor facts reflect their public repositories/licenses as of July 2026 — tell us if we've gotten something wrong: open an issue. e-sig Pricing Why e-sig Verify vs DocuSeal vs DocuSign GitHub Terms of Use Privacy Policy Legal MIT-licensed SDK © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). ======================================================== vs DocuSeal — https://e-sig.org/vs/docuseal ======================================================== e-sig How it works Pricing Verify Docs GitHub ↗ ◑ # esig-suite vs DocuSeal DocuSeal is one of the most-deployed open-source signing apps — a complete Rails product. esig-suite isn't an app at all: it's the signing engine you put inside yours. The choice turns on license and stack, not feature checklists. ## The one-sentence version DocuSeal is an AGPL-3.0 Rails application you deploy. esig-suite is an MIT-licensed TypeScript SDK you embed. If you want a turnkey signing portal, DocuSeal is battle-tested. If your product is a Node/TypeScript codebase that needs signing as a feature, embedding an MIT library beats adopting a Rails monolith. · esig-suite · DocuSeal · License · MIT · AGPL-3.0 · What it is · Embeddable SDK (engine + adapters + React UI) · Hosted signing application (Rails monolith) · Stack · TypeScript / Node — same process as your app · Ruby on Rails — separate service to run and learn · Embedding in closed-source SaaS · Unrestricted · AGPL network-use clause triggers source-disclosure obligations; typically requires their commercial license · Signature format · PKCS#7 / CAdES, optional RFC-3161 (CAdES-T) · PDF signatures via its own stack · Audit model · Append-only, hash-chained log you store · Application database · Self-hosted · Both · Both · ## The stack argument DocuSeal's API-first design means you can drive it from a TypeScript app — over HTTP, as a second service you deploy, monitor, upgrade, and secure. esig-suite's engine runs in-process: npm install @e-sig/core, call signDocument(), done. No second runtime, no Rails expertise required, no network hop between your app and its signatures. ## Where DocuSeal is ahead — honestly A mature form-builder and signing UI, broad deployment docs (Docker, Heroku, one-click hosts), a big user base, and an API surface refined by years of integrations. If a standalone portal fits and AGPL is acceptable (or you'd buy their commercial license), DocuSeal is the lower-risk path. ## Where esig-suite is different MIT and library-first, in your language: render → sign (PKCS#7 / CAdES) → RFC-3161 timestamp → verify → hash-chained audit, with self-issued per-tenant certs and tokenized multi-signer envelopes. Your database, your storage, your certs — no service to operate and no copyleft review to schedule. License texts govern; this page is a summary, not legal advice. Competitor facts reflect their public repositories/licenses as of July 2026 — tell us if we've gotten something wrong: open an issue. e-sig Pricing Why e-sig Verify vs Documenso vs DocuSign GitHub Terms of Use Privacy Policy Legal MIT-licensed SDK © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). ======================================================== For agents — https://e-sig.org/agents ======================================================== e-sig How it works Pricing Verify Docs GitHub ↗ ◑ machine-readable · llms.txt · agent.json # Agents, welcome. e-sig is an MIT-licensed SDK for PDF e-signatures that runs entirely inside the integrator's infrastructure. This page is the machine-oriented brief: exact capabilities, exact API names, exact commands — nothing to scrape around. AI agents are explicitly allowed in robots.txt. ## Machine-readable entry points ### /llms.txt The brief: what e-sig is and where everything lives, in the llms.txt markdown format. ### /llms-full.txt Every public page of this site as plain text, regenerated from the live HTML. ### /agent.json JSON manifest: packages, roles, quickstart commands, endpoints, and contacts. ### /sitemap.xml All public pages. docs.e-sig.org hosts guides and API reference. ### /verify Client-side verifier: a signed PDF can be checked in the browser with no upload and no account. ### npm registry ↗ Packages are published to the public npm registry under the @e-sig scope. ## Capabilities, with exact API names - renderHtmlToPdf — HTML → PDF rendering via puppeteer-core - signPdf — PKCS#7 detached signature, ETSI.CAdES.detached subfilter, ESS signing-certificate-v2 - verifyPdfSignature — recomputes the document digest and checks the signature; one altered byte fails - RFC-3161 timestamping — upgrades a signature to CAdES-T; only a SHA-256 hash ever leaves the process - @e-sig/core/pq-seal — hybrid Ed25519 + ML-DSA-65 (FIPS 204) post-quantum seal attached beneath the classical signature - createEnvelope — N ordered signers over one document, single-use tokenized signing links - signDocument — one-call orchestrator: render → cert → sign → store → audit - Pluggable CertStore / AuditLogStore / PdfStorageStore / EnvelopeStore — Supabase and filesystem adapters included - esig verify — CLI verification of a signed PDF (npx -y -p @e-sig/core esig verify --json) - GitHub Action — verify signed PDFs in CI (action.yml; docs/verify-in-ci.md) - @e-sig/pillar-bridge — agent-to-agent signing delivery + identity proofs over UUAID's Pillar substrate (published, 0.1.0) ## The exact quickstart Node.js ≥ 20. No signup, no API keys, no external services — it issues a cert, signs, verifies, then rejects a tampered copy. Need a document to start from? examples/templates ↗ has six ready-to-sign HTML documents. # from a clone of https://github.com/vmvtech/esig-suite $ npm install $ npm run build $ npm run quickstart # issue cert → render → sign (+timestamp) → verify → reject tamper // the API underneath import { signDocument, verifyPdfSignature } from "@e-sig/core"; const result = await signDocument({ html, tenantId, subjectName, passphrase: process.env.ESIG_CERT_PASSPHRASE, signer: { name, email }, certStore, auditStore, storage, // your adapters pathPrefix: `${tenantId}/${documentId}`, }); // → { signedPdfUrl, auditLogId, certFingerprint, timestamped } const ok = verifyPdfSignature(signedPdf).ok; // cryptographic check ## @e-sig/mcp — agent-driven signing An MCP server that lets an agent drive the whole envelope lifecycle — create a PDF envelope, track its signers, poll status, and confirm the sealed result — while cryptographic control of signing stays with a human by default. Two commands to try it: npx @e-sig/mcp demo --auto for a scripted end-to-end run, or npx @e-sig/mcp init to wire it into Claude Desktop or a project's .mcp.json. Published to npm at 0.5.0 — npm ↗. Source: packages/esig-mcp ↗. Full reference: docs.e-sig.org. ### Tool surface (11 tools) Tool · Purpose · esig_create_envelope · Create an envelope from HTML or a PDF docId + signers; dispatches links through the configured delivery channel. · esig_envelope_status · One envelope's status, phase, per-signer state, seal state, sealed PDF path. · esig_identity_challenge · Issue the sole-control challenge a signer's key must sign. · esig_ingest_document · Store PDF bytes; returns a docId for a Chrome-free PDF envelope, or for verification. · esig_list_envelopes · List envelopes for this server's tenant, optionally by status. · esig_list_events · An envelope's lifecycle events, oldest first. · esig_reseal · Retry the sealed-PDF step after a seal failure. · esig_send_reminder · Resend a signing reminder, on demand. · esig_verify_document · Verify a PDF's classical signature and, if present, its post-quantum seal. · esig_void_envelope · Cancel a pending or partially-signed envelope. · esig_whoami · Tenant, enabled modes, caps, seal readiness, cert/PQ fingerprints — never key material. · No tool signs. Modes A/C (agent-signs-as-itself; dual-key co-sign) are v0.2, gated behind a RedTeam review — ESIG_MCP_MODES refuses to even start a server configured for them. Full tool contracts: docs.e-sig.org/#mcp. ### Delivery and lifecycle events Delivery channels: a file outbox, console, webhook, email (SMTP or SES, with reminders), and pillar — reaching a signer that is itself an agent, over UUAID's Pillar substrate via the published bridge @e-sig/pillar-bridge ↗ (0.1.0). Every state change appends one of 12 lifecycle event types (envelope.created … signer.identity_rejected) to a signed, at-least-once webhook queue with exponential backoff. Full event catalog: docs.e-sig.org/#mcp-events. ### Signer identity Level · What's proven · none · Nothing (default). · L0 · Self-asserted uuaid — no cryptographic proof. · L1 · Sole control of a key (Ed25519 DataIntegrityProof) — identity itself still self-asserted. · L1p · Key↔uuaid binding by construction — a Pillar agent identity, no registry needed. · L2 · Key↔uuaid binding verified against the UUAID registry's signed badge. · Full ladder, refusal codes, and pre-verified identity via Pillar: docs.e-sig.org/#mcp-identity. Agent-to-agent delivery detail: docs.e-sig.org/#mcp-pillar. ## When the signer is an agent If your AI agent signs documents on someone's behalf, attribution is the whole problem. The opt-in @e-sig/uuaid ↗ adapter stamps the acting agent's UUAID into the signature's audit log and anchors the audit hash-chain, so the record says which agent acted — not just which account. Hosted support for agent-signed workflows (UUAID Enterprise) is on the Cloud waitlist. Trust semantics, stated plainly: the verifier proves the embedded PKCS#7/PAdES signature matches the document bytes (and, where present, the hybrid PQ seal verifies). Self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers. No PDF reader natively validates ML-DSA-65 in PAdES yet — that is why the post-quantum seal rides beneath the classical signature. e-sig provides technical controls supporting ESIGN/UETA; compliance posture remains the integrator's responsibility. e-sig Pricing Why e-sig Verify For agents Press Docs GitHub npm Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. Self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Press kit — https://e-sig.org/press ======================================================== e-sig How it works Pricing Verify Docs GitHub ↗ ◑ press kit · facts over hype # Press & media Everything here is verifiable: every claim links to source code, a test, or a fixture. If you find a statement on this site that doesn't match the implementation, we want to know — corrections go to legal@e-sig.org. ## Boilerplate e-sig (esig-suite) is an MIT-licensed, self-hosted PDF e-signature SDK for Node.js and TypeScript. It renders documents, signs them with PKCS#7/PAdES cryptography, optionally applies RFC-3161 trusted timestamps, verifies signatures, and keeps an append-only, hash-chained audit log — entirely inside the integrator's own infrastructure, with no per-document fees and no required SaaS. An optional hybrid seal pairs Ed25519 with ML-DSA-65 (NIST FIPS 204) to protect signed documents against future quantum-computer attacks. e-sig is developed by VMVTech, Ltd. (US). ## Key facts Product · e-sig (esig-suite) — PDF e-signature SDK · License · MIT (full engine, adapters, and UI) · Source · github.com/vmvtech/esig-suite · Packages · @e-sig/core on npm, plus supabase / react / uuaid / hsm-pkcs11 / worm adapters · Agent SDK · @e-sig/mcp — MCP server for agent-driven signing (repo carries 0.5.0; npm currently serves 0.3.0) · Runtime · Node.js ≥ 20, TypeScript, in-process (no signing-path network calls required) · Standards · PKCS#7 / CAdES (ETSI.CAdES.detached), RFC-3161 timestamps, FIPS 204 (ML-DSA-65) hybrid seal · Business model · SDK free forever; hosted e-sig Cloud is in waitlist-only private preview — pricing · Operator · VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US) · Website · e-sig.org · docs.e-sig.org · ## Assets ### Logomark (SVG) The e-sig mark. Please don't stretch or recolor it. ### Social image (PNG, 1200×630) The share card used across the site — safe to reuse in coverage. ### Quickstart demo (GIF) Cert → render → sign → verify → tamper rejection, ~60 seconds, no services. ## Story angles (each with a source link) - Post-quantum signatures ship before readers are readye-sig attaches a hybrid Ed25519 + ML-DSA-65 (FIPS 204) seal beneath the classical PAdES signature, so PDFs validate in Acrobat today and resist harvest-now-decrypt-later tomorrow. The honest limit: no PDF reader natively validates ML-DSA in PAdES yet. Source: pq-seal.ts and its tests. - The per-signature meter, deletedIncumbent e-signature APIs meter every envelope; e-sig runs in the integrator's own process with no per-document fee. Cost-model comparison with sourcing: vs DocuSign, vs Documenso, vs DocuSeal. - A 1-in-256 cryptographic bug, found by experimentOur verifier failed CI ~6% of the time — not a platform bug, but DER zero-padding meeting signatures whose last byte was 0x00. Full postmortem: der-length-bug.md. - Verify without trusting usThe public verifier checks an e-sig-signed PDF entirely client-side — no upload, no account, no vendor trust required: e-sig.org/verify. - When AI agents sign documentsThe opt-in @e-sig/uuaid adapter stamps the acting agent's identity into the audit log, addressing attribution for agent-signed paperwork. - An agent that can prepare a signature but not fake oneThe @e-sig/mcp MCP server lets an agent create envelopes, send reminders, and react to lifecycle webhooks — while cryptographic control of signing stays with a human by default, and signer identity is checked at one of four levels (L0/L1/L1p/L2). ## Contact Press & business · sales@e-sig.org · Legal & corrections · legal@e-sig.org · Security reports · security@e-sig.org (see SECURITY.md) · Technical questions · GitHub issues & discussions — we convert repeated questions into docs within a week · Stated limitations we'd rather you hear from us: self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers; no PDF reader natively validates ML-DSA-65 in PAdES yet; e-sig supplies technical controls that support ESIGN/UETA, and compliance posture remains the integrator's responsibility. The site carries no analytics, cookies, or trackers. e-sig Pricing Why e-sig Verify For agents Press Docs GitHub npm Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. Self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Legal notices — https://e-sig.org/legal ======================================================== e-sig How it works Pricing Why e-sig Docs GitHub ↗ ◑ # Legal Notices Effective date: July 5, 2026 This page identifies who operates e-sig.org and gathers the notices that apply to the site and to the esig-suite software: licensing, trademarks, disclaimers, copyright procedures, and how to reach us. This paragraph is a plain-English summary only and is not a substitute for the full text of the sections below or for our Terms of Use and Privacy Notice. - Site operator - Software licensing - Trademarks - Comparative information disclaimer - Electronic signatures and no legal advice - Cryptography and export notice - Copyright and DMCA procedure - Security vulnerability disclosure - Forward-looking statements - Relationship of our legal documents - Contact ## 1. Site operator The website at https://e-sig.org (the "Site") is operated by VMVTech, Ltd., a company organized in the United States and a subsidiary of VMVCorporation (US). The products esig-suite and DSalvus are products of VMVTech, Ltd. The UUAID Foundation and IAASO are independent public-interest institutions. They are not assets of VMVTech, Ltd. or VMVCorporation, and references to them on this Site do not imply that VMVTech owns, controls, or speaks for them. The Site is a static informational website hosted on Amazon Web Services (S3 and CloudFront) in the United States (us-east-1 region). It has no user accounts, no login, and no forms, and it sets no cookies of its own. Details of the limited data involved in serving the Site are in the Privacy Notice. ## 2. Software licensing esig-suite is open-source software released under the MIT License. The full license text is available in the repository at github.com/vmvtech/esig-suite/blob/main/LICENSE. The MIT License is the only license VMVTech grants to the code, including the npm packages @e-sig/core, @e-sig/react, and @e-sig/supabase; your use remains subject to applicable law (see Section 6). The license includes its own disclaimer of warranty and limitation of liability, which apply to the software as published. Paid offerings described on /pricing (e-sig Cloud, Business self-hosted support, and Enterprise) are governed by their own separate agreements, such as order forms, a master services agreement, and, where applicable, a data processing addendum or business associate agreement. They are not governed by this page or by the website Terms of Use. Nothing on this Site is a binding offer, and pricing may change. ## 3. Trademarks e-sig, esig-suite, DSalvus, VMVTech, and the associated logos are marks of VMVTech, Ltd. No right or license to use these marks is granted by making this Site or the open-source software available; the MIT License covers the code, not the marks. All third-party names and marks that appear on this Site, including DocuSign, Dropbox Sign, Adobe, PandaDoc, BoldSign, DocuSeal, Documenso, Anvil, Stripe, AWS, GitHub, and npm, are the property of their respective owners. They are used solely to identify those companies and their products for comparison and integration purposes. Their appearance does not imply any affiliation with, sponsorship by, or endorsement from those companies, and none should be inferred. The names UUAID Foundation and IAASO belong to those independent institutions and are not marks of VMVTech, Ltd. Links to third-party websites are provided for convenience only; VMVTech, Ltd. does not control and is not responsible for their content, terms, or privacy practices. ## 4. Comparative information disclaimer The Site contains comparative pricing and feature tables naming third-party products, including DocuSign, Dropbox Sign, Adobe, PandaDoc, BoldSign, DocuSeal, Documenso, and Anvil. These tables reflect indicative public rates and published information as of 2026 and are provided for general informational purposes only; they are not procurement, purchasing, financial, or legal advice, and you should not rely on them as the basis for any purchasing decision. - Vendors change their plans, prices, features, and terms at any time and without notice. Always verify current terms directly with the vendor before making a purchasing decision. - The tables are not an endorsement of, or by, any vendor listed. - If you believe any figure or statement is inaccurate or out of date, we welcome corrections at legal@e-sig.org. We review reported inaccuracies and correct them where warranted. ## 5. Electronic signatures and no legal advice The esig-suite software implements PKCS#7/PAdES digital signatures, RFC 3161 trusted timestamps, and hash-chained audit logs. We describe these as technical controls that support requirements commonly associated with the U.S. ESIGN Act and UETA, in particular evidence of intent, attribution, and document integrity. Technical controls alone do not make a signature legally valid or enforceable. - The legal validity and enforceability of any electronic signature depend on the jurisdiction, the type of document, and the facts of the specific transaction. - Self-issued (self-signed) certificates produce cryptographically valid signatures, but they are not trusted by default in stock PDF readers, which may display a trust warning until the certificate is manually trusted. - eIDAS qualified electronic signatures (QES) are available only through qualified trust service provider (QTSP) partners, not from the software alone. Nothing on this Site, in the documentation, or in the software is legal advice, and no attorney-client relationship is created by using either. For questions about whether an electronic signature meets your requirements, consult qualified legal counsel in the relevant jurisdiction. ## 6. Cryptography and export notice The esig-suite software contains cryptographic functionality and may be subject to the U.S. Export Administration Regulations (EAR) and to import, export, or use restrictions in other jurisdictions. By downloading or using the software, you represent that you are not prohibited from receiving it under applicable law. You are solely responsible for compliance with the export, import, and cryptography laws and regulations that apply to you in your jurisdiction. ## 7. Copyright and DMCA procedure Except for the open-source code licensed under the MIT License and third-party materials identified as such, the content of this Site is the copyright of VMVTech, Ltd. We respond to notices of alleged copyright infringement consistent with the Digital Millennium Copyright Act (17 U.S.C. § 512). If you believe material on this Site infringes your copyright, send a written notice to legal@e-sig.org that includes all of the following: - Identification of the copyrighted work you claim has been infringed. - Identification of the material you claim is infringing, with enough information for us to locate it (for example, the URL). - Your name, mailing address, telephone number, and email address. - A statement that you have a good-faith belief that the use of the material is not authorized by the copyright owner, its agent, or the law. - A statement that the information in the notice is accurate and, under penalty of perjury, that you are the copyright owner or authorized to act on the owner's behalf. - Your physical or electronic signature. Counter-notices. This Site contains only VMVTech's own content and identified third-party material; it hosts no user-submitted content. For content in the GitHub repository (for example, third-party contributions), GitHub's own DMCA process applies. Any counter-notice we receive will be handled consistent with 17 U.S.C. § 512. Please be aware that knowingly submitting a materially false notice or counter-notice can expose you to liability. ## 8. Security vulnerability disclosure If you believe you have found a security vulnerability in esig-suite or in any VMVTech service, please report it to security@e-sig.org. Our disclosure policy and reporting guidance are published in SECURITY.md in the GitHub repository. - We ask that you give us a reasonable opportunity to investigate and remediate before public disclosure, following the process and timelines in SECURITY.md. - Include enough detail for us to reproduce the issue where possible. - We ask that reports be sent privately by email rather than filed as public GitHub issues. ## 9. Forward-looking statements Statements on this Site about future plans are forward-looking. This includes roadmap items, planned features and integrations, planned partnerships, and future pricing. Forward-looking items may change, be delayed, or be cancelled without notice, and they do not create any commitment by VMVTech, Ltd. Please make purchasing decisions based on features and terms that are currently available, not on roadmap statements. ## 10. Relationship of our legal documents Three documents describe the legal framework for this Site, and each has a distinct role: - Terms of Use: governs your use of the Site itself, including the governing-law and dispute provisions (State of Delaware, USA). - Privacy Notice: describes the limited data involved in operating the Site and how data is handled in the products. - Legal Notices (this page): identifies the operator and collects licensing, trademark, disclaimer, copyright, and contact notices. Paid services are governed by their own separate agreements, which control over the website Terms of Use for those services. The MIT License governs the open-source code. We may update this page from time to time; the effective date above reflects the current version. ## 11. Contact VMVTech, Ltd. (United States) can be reached by email: - Legal, privacy, and copyright/DMCA: legal@e-sig.org - Sales: sales@e-sig.org - Security vulnerability reports: security@e-sig.org e-sig Pricing Why e-sig Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Terms of Use — https://e-sig.org/terms ======================================================== e-sig How it works Pricing Why e-sig Docs GitHub ↗ ◑ # Terms of Use Effective date: August 6, 2026 These Terms of Use govern your use of the e-sig.org website. In short: this site is informational; the open-source esig-suite software is governed by its MIT license, not by these terms; and paid offerings are governed by their own separate agreements. This paragraph is only a summary and is not a substitute for the full text below. - Acceptance of these Terms; who we are - What these Terms cover, and what they do not - Eligibility - License to use the Site; acceptable use - Intellectual property; feedback - Third-party sites and services - No legal, compliance, or professional advice - Accuracy of information; forward-looking statements - Disclaimer of warranties - Limitation of liability - Indemnification - Changes to the Site and to these Terms - Suspension and termination - Governing law; venue; jury and class action waivers - Export controls - Copyright complaints - General provisions - Contact ## 1. Acceptance of these Terms; who we are These Terms of Use (these "Terms") are an agreement between you and VMVTech, Ltd., a United States company and a subsidiary of VMVCorporation ("VMVTech", "we", "us", or "our"). They govern your access to and use of the website located at https://e-sig.org, including the pages at /, /pricing, /why-esig, /terms, /privacy, and /legal (collectively, the "Site"). By accessing or using the Site, you accept these Terms and agree to be bound by them. If you do not agree to these Terms, do not use the Site. Our Privacy Policy and Legal Notices also contain important information about the Site; please review them. ## 2. What these Terms cover, and what they do not VMVTech makes three distinct things available, and each is governed differently. Understanding this separation is the most important part of these Terms. ### (a) The Site The Site is an informational marketing website with no user accounts or login. Its pricing page includes a first-party waitlist form for requesting information about private-preview and commercial offers. Submitting that form is an inquiry only: it does not create an account, subscription, payment obligation, promise of access, or contract for any product or service. Everything else published on the Site, including the pricing shown at /pricing, is provided for general information only and does not constitute a binding offer by VMVTech. ### (b) The open-source software esig-suite is an open-source, self-hosted PDF e-signature SDK published under the MIT License, including the npm packages @e-sig/core, @e-sig/react, and @e-sig/supabase, with source code at github.com/vmvtech/esig-suite. Your use of the software is governed by the MIT License, not by these Terms. The MIT License is available at https://github.com/vmvtech/esig-suite/blob/main/LICENSE. Nothing in these Terms limits, conditions, or modifies the rights granted to you under the MIT License. The software runs entirely within your own infrastructure; downloading or running it does not create a service relationship with VMVTech, and VMVTech receives no documents, signer data, or telemetry from it. ### (c) Paid offerings The Cloud plans shown on the Site are a private preview with a waitlist only; paid checkout is not currently available, preview prices may change, and joining the waitlist creates no account, subscription, payment obligation, or promise of access. Any paid offering, including a Cloud private preview, Business plan, or Enterprise arrangement, is governed exclusively by its own separate agreement, such as an order form, a master services agreement (MSA), and, where applicable, a data processing agreement (DPA) or business associate agreement (BAA). Those agreements, not these Terms, govern any paid relationship with VMVTech. ## 3. Eligibility The Site is intended for adults with the legal capacity to enter into contracts. You must be at least 18 years old to accept these Terms. The Site is not directed at children under 16. ## 4. License to use the Site; acceptable use Subject to these Terms, VMVTech grants you a limited, revocable, non-exclusive, non-transferable license to access the Site and view its content for lawful, informational purposes. In connection with your use of the Site, you agree that you will not: - use automated means to scrape, harvest, or bulk-download Site content, including for use in training machine-learning or artificial-intelligence models, other than ordinary, good-faith search engine indexing; - interfere with or disrupt the Site or the infrastructure that serves it, including by flooding, overloading, or attempting to degrade its availability; - misrepresent your identity or affiliation, or state or imply that VMVTech endorses you or your products; - use the Site for any unlawful purpose or in violation of any applicable law or regulation; or - circumvent, disable, probe, or test the security of the Site or of the infrastructure serving it. If you are a security researcher acting in good faith, please follow the coordinated disclosure process described in the SECURITY.md file of the esig-suite GitHub repository and contact security@e-sig.org. We may investigate suspected violations and take any technical or legal measures we consider appropriate, including blocking access as described in Section 13. ## 5. Intellectual property; feedback The Site and its content, including text, graphics, page designs, logos, and comparative materials, are owned by VMVTech or its licensors and are protected by copyright, trademark, and other intellectual property laws. Except for the limited license in Section 4, no right, title, or interest in the Site or its content is transferred to you. For the avoidance of doubt, this section applies to the Site's content; the esig-suite source code is separately licensed to you under the MIT License described in Section 2(b). VMVTech, esig-suite, and DSalvus, together with associated names and logos, are trademarks or trade names of VMVTech, Ltd. Third-party names and marks that appear on the Site, including those listed in our comparison tables, belong to their respective owners; their appearance does not imply any affiliation with, sponsorship of, or endorsement by those owners. If you choose to send us feedback, suggestions, or ideas about the Site, the software, or our offerings, you grant VMVTech a perpetual, irrevocable, worldwide, royalty-free, sublicensable, and transferable license to use, reproduce, modify, and incorporate that feedback for any purpose, without compensation or obligation to you. Do not send us feedback that is confidential or that you do not have the right to share. ## 6. Third-party sites and services The Site links to and references third-party sites and services, including GitHub (source code hosting), npm (package distribution), and the UUAID Foundation. The first-party waitlist form is hosted using Amazon Web Services and is covered by our Privacy Policy. The UUAID Foundation and IAASO are independent public-interest institutions; they are not owned or controlled by VMVTech. DSalvus is a separate VMVTech product; your use of DSalvus is governed by its own terms, not by these Terms. When you leave the Site or use a third-party service, that third party's own terms and privacy practices apply, not ours. We do not control third-party sites or services, we are not responsible for their content, availability, or practices, and a link or reference does not imply our endorsement of them or theirs of us. The Site does not currently route visitors to a paid Cloud checkout. ## 7. No legal, compliance, or professional advice Nothing on the Site is legal, compliance, tax, or other professional advice, and no attorney-client or advisory relationship is created by your use of the Site. In particular: - Statements on the Site about ESIGN, UETA, and eIDAS are technical descriptions of controls implemented by the software (such as PKCS#7/PAdES signatures, RFC-3161 timestamps, and hash-chained audit logs) that can support requirements like intent, attribution, and integrity. They are not representations that any particular signature is legally valid or enforceable. - The legal validity and enforceability of an electronic signature depend on the jurisdiction, the type of document, and the facts of each transaction. - Self-issued certificates are cryptographically valid but are not trusted by default in stock PDF readers, and eIDAS qualified electronic signatures (QES) are available only through qualified trust service provider (QTSP) partners. You are responsible for your own legal and regulatory compliance. Consult qualified counsel in your jurisdiction before relying on electronic signatures for any transaction that matters to you. ## 8. Accuracy of information; forward-looking statements We try to keep the Site accurate, but we do not promise that it is complete, current, or error-free. Roadmap items and other forward-looking statements describe intentions, not commitments; they may change or may never ship. Comparative pricing and feature tables reflect indicative public rates and publicly available information as of 2026, may be outdated, and should be verified directly with the relevant vendor before you rely on them. We may correct, update, supplement, or remove any Site content at any time without notice, and we assume no obligation to update forward-looking statements. ## 9. Disclaimer of warranties TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE SITE AND ALL CONTENT ON IT ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NONINFRINGEMENT, ACCURACY, AND UNINTERRUPTED OR ERROR-FREE OPERATION. VMVTECH DOES NOT WARRANT THAT THE SITE WILL BE AVAILABLE, SECURE, OR FREE OF HARMFUL COMPONENTS, OR THAT ANY INFORMATION ON IT IS CORRECT OR CURRENT. CONSISTENT WITH THE MIT LICENSE, THE ESIG-SUITE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Some jurisdictions do not allow the exclusion of certain warranties, so some of the above exclusions may not apply to you. In that case, they apply to the fullest extent permitted by law. ## 10. Limitation of liability TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT WILL VMVTECH, ITS PARENT VMVCORPORATION, OR THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATING TO THE SITE OR THESE TERMS, WHETHER BASED ON WARRANTY, CONTRACT, TORT (INCLUDING NEGLIGENCE), STATUTE, OR ANY OTHER LEGAL THEORY, AND WHETHER OR NOT WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE AGGREGATE LIABILITY OF VMVTECH, ITS PARENT VMVCORPORATION, AND THEIR RESPECTIVE OFFICERS, DIRECTORS, EMPLOYEES, CONTRACTORS, AND AGENTS FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THE SITE OR THESE TERMS WILL NOT EXCEED THE GREATER OF (A) ONE HUNDRED UNITED STATES DOLLARS (USD 100) OR (B) THE AMOUNTS YOU PAID TO VMVTECH FOR USE OF THE SITE IN THE TWELVE (12) MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. Because the Site is free of charge, this amount will ordinarily be USD 100. This section does not limit any liability that cannot be limited under applicable law, and liability arising under a separate agreement for a paid offering, whether signed or accepted electronically, is governed by that agreement, not by this section. Some jurisdictions do not allow the exclusion or limitation of certain damages, so some of the above limitations may not apply to you. In that case, they apply to the fullest extent permitted by law. ## 11. Indemnification You agree to defend, indemnify, and hold harmless VMVTech, its parent VMVCorporation, and their respective officers, directors, employees, contractors, and agents from and against any claims, damages, liabilities, losses, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to (a) your misuse of the Site, (b) your violation of these Terms, or (c) your violation of any applicable law or of the rights of any third party in connection with your use of the Site. We may, at our own expense, assume the exclusive defense and control of any matter subject to indemnification by you, in which case you agree to cooperate with our defense. ## 12. Changes to the Site and to these Terms We may change, suspend, or discontinue any part of the Site at any time, without notice and without liability to you. We may also revise these Terms from time to time. When we do, we will post the revised Terms on this page and update the effective date shown at the top. Your continued use of the Site after a revision takes effect constitutes your acceptance of the revised Terms. If you do not agree to the revised Terms, your only remedy is to stop using the Site. Please check this page periodically. ## 13. Suspension and termination Because the Site has no user accounts, there is nothing to close; however, we may restrict, suspend, or block your access to the Site (including through technical measures at the network or CDN level) at any time, with or without notice, if we believe you have violated these Terms or applicable law, or to protect the Site, our infrastructure, or other visitors. You may stop using the Site at any time. Sections of these Terms that by their nature should survive (including Sections 5, 7, 8, 9, 10, 11, 14, 15, and 17) survive any termination of your access. ## 14. Governing law; venue; jury and class action waivers These Terms and any dispute arising out of or relating to them or the Site are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-laws rules. You and VMVTech agree that the state and federal courts located in the State of Delaware will have exclusive jurisdiction and will be the exclusive venue for any such dispute, and each party consents to personal jurisdiction in those courts. To the fullest extent permitted by applicable law, you and VMVTech each waive the right to a trial by jury and the right to bring or participate in any class, collective, consolidated, or representative action. Disputes may be brought only on an individual basis. If a court of competent jurisdiction finds the jury trial waiver or the class action waiver unenforceable as to a particular claim, that waiver will be severed as to that claim only, that claim will proceed on an individual basis to the extent the law allows, and the remainder of this section will continue to apply in full. ## 15. Export controls The esig-suite software implements cryptographic functionality and may be subject to United States export control laws, including the Export Administration Regulations (EAR), and to import or use restrictions in other jurisdictions. You are solely responsible for complying with all applicable export, re-export, sanctions, and import laws, and you may not download or use the software in violation of those laws or if you are a person or entity to whom such export is prohibited. ## 16. Copyright complaints We respect intellectual property rights. If you believe that content on the Site infringes your copyright, send a notice to legal@e-sig.org that includes: (a) identification of the copyrighted work you claim has been infringed; (b) identification of the material on the Site you claim is infringing, with enough detail for us to locate it (for example, the URL); (c) your name and contact information; (d) a statement that you have a good-faith belief that the use is not authorized by the copyright owner, its agent, or the law; (e) a statement, made under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorized to act on the owner's behalf; and (f) your physical or electronic signature. We will review complete notices and remove or disable access to infringing material where appropriate. ## 17. General provisions - Severability. If any provision of these Terms is held invalid or unenforceable, that provision will be enforced to the maximum extent permissible and the remaining provisions will remain in full force and effect. - No waiver. Our failure to enforce any provision of these Terms is not a waiver of that provision or of our right to enforce it later. - Assignment. You may not assign or transfer these Terms or any rights under them without our prior written consent. We may assign these Terms, including in connection with a merger, acquisition, or sale of assets. - Entire agreement. These Terms are the entire agreement between you and VMVTech regarding your use of the Site. The Privacy Policy and the Legal Notices describe our practices and provide important notices; they are referenced for your information and are not incorporated into these Terms as contractual obligations. These Terms do not supersede or modify the MIT License governing the software or any separate agreement governing a paid offering (whether signed or accepted electronically). - No third-party beneficiaries. These Terms do not create any rights in favor of anyone other than you and VMVTech, except that VMVCorporation and the other persons identified in Sections 10 and 11 are intended third-party beneficiaries of those sections and may enforce them. - International use. We operate the Site from the United States and make no representation that the Site or its content is appropriate or available in other locations. If you access the Site from outside the United States, you do so on your own initiative and are responsible for compliance with local laws. - Headings. Section headings are for convenience only and have no legal effect. ## 18. Contact Questions about these Terms, privacy, or copyright should be directed to legal@e-sig.org. For sales inquiries, contact sales@e-sig.org. To report a security vulnerability, contact security@e-sig.org and see the SECURITY.md file in the esig-suite GitHub repository. e-sig Pricing Why e-sig Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions. ======================================================== Privacy Policy — https://e-sig.org/privacy ======================================================== e-sig How it works Pricing Why e-sig Docs GitHub ↗ ◑ # Privacy Policy Effective date: August 6, 2026 This page explains what information VMVTech, Ltd. collects through the e-sig.org website and its services, why we collect it, who we share it with, and the rights you have. This paragraph is only a plain-English summary and is not a substitute for the full policy below. The short version: this website has no accounts, no trackers, no advertising, and sets no cookies, and our self-hosted software sends us nothing. - Who we are and what this policy covers - The short version: what we do not do - What we actually collect on this website - The self-hosted SDK sends us nothing - The e-sig Cloud private preview - How we use information - Legal bases for processing (EEA and UK) - How long we keep information - When we share information - International data transfers - Security - Your rights in the EEA, the UK, and similar jurisdictions - California privacy rights - Children - Third-party sites and services - Changes to this policy - How to contact us ## 1. Who we are and what this policy covers This Privacy Policy is issued by VMVTech, Ltd., a United States company and a subsidiary of VMVCorporation ("VMVTech," "we," "us," or "our"). VMVTech operates the website at https://e-sig.org (the "Site") and offers the products described on it, including the open-source esig-suite SDK and the paid offerings listed on /pricing. For personal information collected through the Site itself, VMVTech, Ltd. is the data controller. For content processed through the e-sig Cloud service on behalf of our customers, VMVTech acts as a processor or service provider, as explained in Section 5. Paid offerings are governed by their own separate agreements (order forms, master services agreements, data processing addenda); where those agreements address data handling, they control for the services they cover. This policy should be read together with our Terms of Use and Legal Notices. ## 2. The short version: what we do not do Before the detail, here is what does not happen on this Site, stated plainly: - No accounts. The Site has no user accounts, no login, and no account-registration forms. The pricing page has a contact form for Cloud and commercial-offer waitlist requests. - No analytics trackers. We run no analytics scripts and no visitor-measurement pixels. - No advertising. We show no ads, embed no ad networks, and place no advertising trackers. - No cookies set by this Site. The Site itself sets no cookies of any kind, first-party or third-party. - No selling of personal information, and no "sharing" for advertising. We do not sell personal information and do not share it for cross-context behavioral advertising within the meaning of California law. We do disclose limited information to the service providers and in the circumstances described in Section 9. - No telemetry from the self-hosted SDK. The open-source esig-suite software sends us no documents, no signer data, and no usage telemetry (see Section 4). Everything we do collect is described in Sections 3 through 5. We do not engage in data practices materially different from those described in this policy. ## 3. What we actually collect on this website The public Site pages are hosted on Amazon Web Services (AWS S3 and CloudFront), and the waitlist form sends submissions to an AWS-hosted API. The information connected with your visit is limited to the following: - Server and CDN access logs. Like almost every website, our AWS hosting infrastructure automatically generates access logs when you request a page. These logs contain your IP address, browser user agent string, timestamps, and the URLs requested. We use them for security (detecting abuse, denial-of-service attempts, and scanning) and operations (diagnosing availability and performance problems). They are not used to build visitor profiles. - Email correspondence. If you email us (for example at legal@e-sig.org, sales@e-sig.org, or security@e-sig.org), we receive your email address, anything you choose to include in your message, and routine email metadata. We use it to respond to you and to keep a record of the correspondence. - Cloud and commercial-offer waitlist. The Site does not currently offer paid Cloud checkout. If you submit the waitlist form, we collect the email address and selected offer you enter, your checkbox assertion authorizing one-to-one follow-up about that specific request, and any optional name, company, use case, and expected monthly volume you provide. AWS also processes routine request metadata needed to deliver and secure the form. Intake does not verify email ownership, and we do not send a verification email: email ownership is recorded as unverified, and contact permission is stored as asserted and unverified. The submitted email and checkbox values are not proof of identity, email ownership, or consent to unrelated marketing. We use the submission to record your interest, understand your use case, and respond about the requested private-preview or commercial access. Joining the waitlist does not create an account, subscription, payment obligation, or promise of access. That is the complete list of what we intentionally collect through the Site. We do not collect precise location data, biometric data, or your browsing history on other websites, and we do not currently enrich Site data with information purchased from data brokers. ## 4. The self-hosted SDK sends us nothing Our open-source product, esig-suite (the npm packages @e-sig/core, @e-sig/react, and @e-sig/supabase, published at https://github.com/vmvtech/esig-suite), is an MIT-licensed, self-hosted PDF e-signature SDK. It runs entirely inside your own infrastructure. - VMVTech receives no documents, no signer data, and no telemetry from the SDK. There is no phone-home, no usage reporting, and no error reporting to us. - The SDK's only optional network egress is to an RFC-3161 timestamp authority that you configure yourself. If you enable timestamping, that authority receives only a SHA-256 hash of the signed data, never the document itself. Your chosen timestamp authority's own terms and privacy practices apply to that request. Because the SDK operates entirely under your control, you (not VMVTech) are responsible for the personal data your deployment processes and for your own compliance obligations as its controller or processor. ## 5. The e-sig Cloud private preview Paid Cloud checkout is not currently available. If we invite a waitlisted organization into the private preview under a separate written agreement, VMVTech will host and operate the signing infrastructure on that customer's behalf. In doing so we may process customer content, which can include: - documents uploaded for signature; - signer names and email addresses; - signer IP addresses and user agent strings; - signature images; and - append-only audit records (a hash-chained audit log of signing events). For this customer content, the Cloud customer is the data controller (or "business" under California law) and VMVTech acts as a processor or service provider, handling the data only on the customer's documented instructions and as needed to provide the service. A data processing addendum (DPA) is available for our paid offerings; contact legal@e-sig.org to request one. If you are a signer: if you received a document for signature through the e-sig Cloud service, the organization that sent you the document controls that data. Please direct requests to access, correct, or delete your data to that organization. If you contact us instead, we will refer your request to the relevant customer and assist as their processor where required by law or by our agreement with them. ## 6. How we use information We use the limited information described above only for the following purposes: - to operate, secure, and troubleshoot the Site and our services (access logs); - to record and respond to waitlist requests, inquiries, sales questions, legal requests, and security reports (waitlist form submissions and email correspondence); - to provide, bill for, and support paid services you purchase (order and billing information, customer content as instructed); - to comply with legal obligations, including tax, accounting, and lawful requests from authorities; and - to establish, exercise, or defend legal claims. We do not use personal information for advertising or profiling, we do not currently use automated decision-making that produces legal or similarly significant effects, and we do not currently use customer content to train machine-learning models. ## 7. Legal bases for processing (EEA and UK) Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: - Legitimate interests (Article 6(1)(f)): maintaining access logs to secure and operate the Site, preventing abuse, and defending legal claims. Our interest in keeping the Site available and secure is balanced against the minimal intrusiveness of standard access logs. - Performance of a contract or steps requested before a contract (Article 6(1)(b)): providing separately agreed services and responding to your waitlist or other pre-contract inquiries. - Legal obligation (Article 6(1)(c)): retaining records and disclosing information where the law requires it. For customer content processed through e-sig Cloud, the legal basis is determined by the customer as controller; we process on the customer's instructions. ## 8. How long we keep information - Access logs are kept only as long as needed for security and operational purposes and are then deleted or rotated out in the ordinary course. - Waitlist form submissions are automatically deleted by time-to-live (TTL) within 180 days. If a legal obligation requires us to retain a business record for longer, that record is retained separately rather than extending the waitlist record's TTL. Smoke-test submissions using an @example.com address are automatically deleted by TTL within 24 hours. - Email correspondence is kept as long as needed to handle the matter it relates to and to maintain a reasonable business record, after which it may be deleted. - Billing and transaction records are kept for as long as tax, accounting, and other legal obligations require. - e-sig Cloud private-preview customer content, if any, is retained according to the customer's instructions and the applicable service agreement, and is deleted or returned as that agreement provides. ## 9. When we share information We never sell personal information. We share it only in these circumstances: - Service providers and subprocessors. We use a small number of providers to run our business, including Amazon Web Services for hosting, content delivery, and waitlist-form processing and storage, and our email provider for correspondence. They may process personal information only to provide their services to us and are bound by their own contractual and legal obligations. - Legal compulsion. We may disclose information where required by law, regulation, subpoena, court order, or other lawful process, or where reasonably necessary to protect the rights, safety, or property of VMVTech, our customers, or others. - Corporate transactions. If VMVTech is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this policy or successor terms that provide comparable protection. For e-sig Cloud, a current list of subprocessors is available on request via legal@e-sig.org and is addressed in the DPA. ## 10. International data transfers VMVTech is a United States company, and our infrastructure is hosted with AWS in the United States (us-east-1). Information described in this policy is processed in the United States, which may have data protection laws different from those of your jurisdiction. Where required for transfers of EEA, UK, or Swiss personal data, we rely on appropriate safeguards, such as standard contractual clauses where applicable; transfer mechanisms for paid services are addressed in our DPA. You can request more information about transfer safeguards via legal@e-sig.org. ## 11. Security We apply technical and organizational measures appropriate to the limited data we handle, including: - Encryption in transit. The Site and our services are served over TLS. - Restricted access. Access to logs, correspondence, and service infrastructure is limited to personnel who need it. - Tamper-evidence by design. The product itself is built around integrity controls: PKCS#7/PAdES signatures, RFC-3161 timestamps, and hash-chained, append-only audit logs, designed so that alterations to signed material and audit records can be detected. No system is perfectly secure, and we cannot guarantee absolute security. If you believe you have found a security vulnerability, please report it to security@e-sig.org as described in the SECURITY.md file in our GitHub repository. ## 12. Your rights in the EEA, the UK, and similar jurisdictions If the GDPR or UK GDPR applies to you, you have the following rights with respect to personal data for which VMVTech is the controller: - the right of access to your personal data; - the right to rectification of inaccurate data; - the right to erasure ("right to be forgotten") in certain circumstances; - the right to restriction of processing in certain circumstances; - the right to data portability for data you provided to us that we process by automated means on the basis of contract or consent; - the right to object to processing based on legitimate interests; - the right to withdraw consent at any time, where processing is based on consent, without affecting prior processing; and - the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, email legal@e-sig.org. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law. If your request concerns data processed through e-sig Cloud on behalf of one of our customers, we will refer you to that customer, who is the controller (see Section 5). If you reside in a jurisdiction with a similar privacy law (including other US states), you may exercise the corresponding rights by emailing legal@e-sig.org. Where the law of your state gives you a right to appeal our decision on a request, our response will explain how to appeal. ## 13. California privacy rights If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you rights over your personal information, including the rights to know what we collect, to access it, to correct it, to delete it, and to be free from discrimination for exercising these rights. You may exercise them by emailing legal@e-sig.org; we will verify your identity and respond as the law requires. You may use an authorized agent, subject to verification. Notice of no sale or sharing: we do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months. Because there is no sale or sharing to opt out of, we do not provide a "Do Not Sell or Share" link. Global Privacy Control: we honor the Global Privacy Control (GPC) signal in the most direct way possible: we do not track visitors in the first place. With no cookies, no trackers, and no sale or sharing of personal information, a GPC-enabled browser receives exactly the same treatment as any other, which is the treatment GPC is designed to secure. For the same reason, our response to browser "Do Not Track" signals is uniform: we do not track visitors, so no signal changes how the Site treats you. Acting as a business (rather than as a service provider processing customer content under Section 5), we do not collect the categories of sensitive personal information that trigger a right to limit use, and we do not use or disclose personal information for purposes beyond those described in this policy. The categories of personal information we collect, the purposes, and the recipients are set out in Sections 3, 6, and 9. ## 14. Children The Site and our services are not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us personal information, contact legal@e-sig.org and we will delete it. Entering into contracts through our services requires legal capacity, as described in our Terms of Use. ## 15. Third-party sites and services The Site links to third-party sites and services we do not control, including GitHub, npm, and the websites of other vendors named in our comparison tables. Those third parties have their own privacy practices and policies, and this policy does not apply to them. The waitlist form is a first-party e-sig form hosted on AWS and is governed by this policy. We encourage you to review the policies of any third-party service before providing it your information. ## 16. Changes to this policy We may update this Privacy Policy from time to time, for example to reflect changes in our practices, services, or applicable law. When we do, we will post the revised policy at /privacy and update the effective date at the top of this page. Material changes will be indicated by that new effective date; we encourage you to review this page periodically. ## 17. How to contact us Questions, concerns, or requests about privacy and this policy should be directed to: - Privacy and legal: legal@e-sig.org - Security vulnerability reports: security@e-sig.org - Sales: sales@e-sig.org VMVTech, Ltd. is a United States company. Our postal address is available on request via legal@e-sig.org. Related documents: Terms of Use and Legal Notices. e-sig Pricing Why e-sig Docs GitHub npm UUAID Foundation DSalvus Terms of Use Privacy Policy Legal MIT-licensed SDK e-sig is signing-infrastructure software, not legal advice. It provides technical controls that support ESIGN/UETA (intent, attribution, integrity); your compliance posture, certificate trust, and record-retention remain your responsibility. © 2026 VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US). esig-suite is a product of VMVTech, Ltd. (US). UUAID Foundation and IAASO are independent public-interest institutions.