press kit · facts over hype

Press & media

Everything here is verifiable: every claim links to source code, a test, or a fixture. If you find a statement on this site that doesn't match the implementation, we want to know — corrections go to legal@e-sig.org.

Boilerplate

e-sig (esig-suite) is an MIT-licensed, self-hosted PDF e-signature SDK for Node.js and TypeScript. It renders documents, signs them with PKCS#7/PAdES cryptography, optionally applies RFC-3161 trusted timestamps, verifies signatures, and keeps an append-only, hash-chained audit log — entirely inside the integrator's own infrastructure, with no per-document fees and no required SaaS. An optional hybrid seal pairs Ed25519 with ML-DSA-65 (NIST FIPS 204) to protect signed documents against future quantum-computer attacks. e-sig is developed by VMVTech, Ltd. (US).

Key facts

Product	e-sig (esig-suite) — PDF e-signature SDK
License	MIT (full engine, adapters, and UI)
Source	github.com/vmvtech/esig-suite
Packages	@e-sig/core on npm, plus supabase / react / uuaid / hsm-pkcs11 / worm adapters
Agent SDK	@e-sig/mcp — MCP server for agent-driven signing (repo carries 0.5.0; npm currently serves 0.3.0)
Runtime	Node.js ≥ 20, TypeScript, in-process (no signing-path network calls required)
Standards	PKCS#7 / CAdES (ETSI.CAdES.detached), RFC-3161 timestamps, FIPS 204 (ML-DSA-65) hybrid seal
Business model	SDK free forever; hosted e-sig Cloud is in waitlist-only private preview — pricing
Operator	VMVTech, Ltd. (US), a subsidiary of VMVCorporation (US)
Website	e-sig.org · docs.e-sig.org

Assets

Logomark (SVG)

The e-sig mark. Please don't stretch or recolor it.

Social image (PNG, 1200×630)

The share card used across the site — safe to reuse in coverage.

Quickstart demo (GIF)

Cert → render → sign → verify → tamper rejection, ~60 seconds, no services.

Story angles (each with a source link)

Post-quantum signatures ship before readers are ready
e-sig attaches a hybrid Ed25519 + ML-DSA-65 (FIPS 204) seal beneath the classical PAdES signature, so PDFs validate in Acrobat today and resist harvest-now-decrypt-later tomorrow. The honest limit: no PDF reader natively validates ML-DSA in PAdES yet. Source: pq-seal.ts and its tests.
The per-signature meter, deleted
Incumbent e-signature APIs meter every envelope; e-sig runs in the integrator's own process with no per-document fee. Cost-model comparison with sourcing: vs DocuSign, vs Documenso, vs DocuSeal.
A 1-in-256 cryptographic bug, found by experiment
Our verifier failed CI ~6% of the time — not a platform bug, but DER zero-padding meeting signatures whose last byte was 0x00. Full postmortem: der-length-bug.md.
Verify without trusting us
The public verifier checks an e-sig-signed PDF entirely client-side — no upload, no account, no vendor trust required: e-sig.org/verify.
When AI agents sign documents
The opt-in @e-sig/uuaid adapter stamps the acting agent's identity into the audit log, addressing attribution for agent-signed paperwork.
An agent that can prepare a signature but not fake one
The @e-sig/mcp MCP server lets an agent create envelopes, send reminders, and react to lifecycle webhooks — while cryptographic control of signing stays with a human by default, and signer identity is checked at one of four levels (L0/L1/L1p/L2).

Contact

Press & business	sales@e-sig.org
Legal & corrections	legal@e-sig.org
Security reports	security@e-sig.org (see SECURITY.md)
Technical questions	GitHub issues & discussions — we convert repeated questions into docs within a week

Stated limitations we'd rather you hear from us: self-issued certificates are cryptographically valid but not trusted by default in stock PDF readers; no PDF reader natively validates ML-DSA-65 in PAdES yet; e-sig supplies technical controls that support ESIGN/UETA, and compliance posture remains the integrator's responsibility. The site carries no analytics, cookies, or trackers.