SignDroid
Get documents signed — on your infrastructure, under your brand, with evidence that holds up.
Upload a PDF, place the fields, and send tokenised links. Signees sign in the browser with no account, behind an emailed access code and an identity check. What comes back is a completed document carrying an addendum, a consent record, a disclaimer, a full audit certificate, trusted timestamps and a cryptographic seal over the exact archived bytes.
327Endpoints
57Audit action types
5Mail providers
89%Line coverage
The problem
Signing is solved. Signing on your own terms is not.
Established signature services work well and cost per envelope, per user, per year — and every contract you send passes through infrastructure you do not control, in a jurisdiction you did not choose, under a brand that is not yours. For a firm whose documents are commercially sensitive, both of those are the problem rather than a detail.
01
Per-envelope pricing
A cost that scales with the thing you want more of, and a renewal conversation every year.
02
Someone else's tenancy
Contracts, mandates and personnel files processed and stored outside your control.
03
Someone else's brand
Your client signs on a page carrying a vendor's name, not yours.
04
Thin evidence
A certificate of completion that proves far less than a dispute will ask of it.
The solution
Your servers, your domain, your logo — and a deeper evidence file than the envelope price buys.
01
White-label to the domain
Branding resolves from the host the visitor arrived on — a signee on your client's own domain sees your client's logo, colours and name, on the login page and the signing page alike, before anyone has logged in.
02
Evidence, not just a tick
Every completed document carries a generated addendum, consent, disclaimer and audit pages, embedded trusted timestamps, per-signee snapshots, and a detached cryptographic seal over the final bytes.
03
Every entity, its own identity
Tenants, organisations, per-tenant branding, per-organisation mail providers and payment credentials — so every company, brand or department in your group signs under its own name, from one installation.
Capabilities
01Document preparation & signing
- Upload one PDF, or merge several into one document in a chosen order.
- A visual field editor: click to place, drag to move, resize by handle, with zoom and a thumbnail rail.
- Five field types — signature, text, date, checkbox and dropdown — each with label, instructions, validation and length limits.
- No account required: a single tokenised link is the whole entry path.
- A layered, fully audited gate: emailed six-digit access code, identity check, consent and disclaimer acknowledgement.
- Sign by drawing on canvas or typing a name, with sequential or all-at-once signing order, and a ‘refuse to sign’ option that returns the document to the sender.
- Templates with pre-placed fields and abstract signee roles, translatable per locale.
02Evidence & identity
- Every completed document carries generated addendum, consent, disclaimer and audit-certificate pages, produced in the document's own language.
- The audit certificate lists the history timeline, access log, signature details, entered field data and the verbatim consent wording.
- RFC 3161 trusted timestamps taken per signature and per document, embedded into the file as attachments.
- Per-signee snapshots capture the chain of custody as the document passes between parties.
- A detached 4096-bit cryptographic seal over the exact archived bytes, with the organisation's public key downloadable for verification.
- An optional stricter mode adds an out-of-band SMS one-time passcode — six digits, ten-minute life, hashed storage, lockout after five attempts, and a per-signee key binding signee, document, field and time.
03White-label & multilingual
- Three-level tenancy — tenant, organisation, user — with organisation types for customer, internal, partner and trial.
- Custom domains resolve branding — logo, colours and name — before login and on the signing page itself.
- The platform's own name is replaced end to end; a signee never sees the vendor behind it.
- Three shipped languages (English, French, Dutch) at over 3,000 keys each, with a translation console and built-in machine translation.
- Audit certificates, consent pages and emails are all generated in the document's own language.
04Communications & administration
- Six notification types with independent per-organisation switches, plus reminders on demand or in bulk.
- Five mail providers per organisation — Microsoft Graph, Gmail, Zoho, plain SMTP and Outboundly — with encrypted credentials and automatic token refresh.
- Fifty-seven audit action types recording actor, address, agent and before-and-after values, plus a separate per-signature forensic record.
- Document lifecycle controls: archive, cancel with reason, copy, and deletion blocked once signing is under way.
- An hourly expiry sweep and a nightly housekeeping run that purges expired tokens and reconciles orphaned files.
- A log viewer with live tail, download and runtime log-level changes, plus a memory console.
- Per-user, per-table sort preferences and a full dark theme.
05Security & governance
- Three roles with method-level authorisation; organisation access asserted at 134 call sites
- AES-256-GCM at rest for every configuration secret, with keys derived at 65 536 iterations and start-up refusing a placeholder key
- bcrypt passwords; five failures in fifteen minutes blocks for fifteen minutes, by address and by name
- Access tokens held in memory only and re-minted from a hardened cookie; refresh tokens and passcodes stored only as hashes
- A strict content security policy with no inline scripting, and a no-referrer policy specifically so a signing link cannot leak
- Forwarded headers trusted only when explicitly enabled, guarding host injection and open redirect
- Single sign-on through Google, configurable per organisation
- Fifty-seven audit action types plus a per-signature forensic record with verbatim consent text
- Dependency vulnerability scanning gated at severity seven
■Runtime: Java 21 on Spring Boot 4.
■Database: PostgreSQL, 42 tables, 26 versioned migrations.
■API: 327 endpoints across 37 controllers.
■Cryptography: 4096-bit keys, RFC 3161 timestamping, SHA-256 file hashing.
■Storage: versioned local filesystem, tenant- and organisation-scoped.
■Quality: 2,974 tests, 89% line coverage against a 70% gate.
Industries
Who it works for
Accountancy & bookkeeping
Engagement letters and mandates at seasonal volume, where per-envelope pricing punishes exactly the months you are busiest.
Human resources & staffing
Employment contracts and onboarding packs built from templates with named signee roles and an enforced signing order.
Real estate
Leases and mandates signed by parties who will never create an account, with an evidence file that survives a dispute.
Legal practice
Client documents that must not pass through a third-party service, with a verbatim consent record and a full audit certificate.
Insurance & intermediaries
Proposals and mandates with an out-of-band SMS passcode step where the value at risk justifies stronger identity proofing.
Public sector & non-profit
Self-hosted on-premise, with no per-signature vendor cost and data that never leaves the organisation.
Multilingual organisations
English, French and Dutch shipped, a translation console for more, and the audit certificate produced in the document's own language.
Groups with several entities
One installation, several isolated organisations, each signing on its own domain with its own logo, colours and mail provider.
Use cases
Example scenarios
01 · Accountancy & bookkeeping
Year-end engagement letters without a per-envelope bill
- Challenge
- An accounting firm sends engagement letters and mandates to its whole client base in the same few weeks, in Dutch and French. Clients print, sign and scan, or the firm pays a signing service per envelope at exactly its busiest time.
- Approach
- The firm keeps a template per letter type with pre-placed fields and signee roles, translated per locale, and sends each client a tokenised link protected by an emailed six-digit code. Outstanding documents are chased with bulk reminders, and SignDroid is licensed per installation rather than per envelope.
- Result
- A busy season no longer raises the signing cost, and every returned letter carries an audit certificate in the client's own language.
02 · Human resources & staffing
Employment contracts signed in the right order
- Challenge
- HR emails a contract, a policy acknowledgement and a data-processing notice as separate PDFs. New hires return them one by one, the manager's countersignature is chased by mail, and nobody is sure which version was signed.
- Approach
- The documents are merged into one onboarding pack from a template with an employee role and a manager role, and sequential signing order makes the manager sign only after the employee. Expiry is set per document, and a signee who disagrees can refuse to sign, which returns the pack to HR.
- Result
- HR receives one sealed, timestamped pack per hire and can see at each step who still has to sign.
03 · Real estate
Leases signed by tenants who will never create an account
- Challenge
- A property manager needs signatures from landlords and tenants, some of them abroad, on leases and mandates. Signing services that require an account put people off, and a basic certificate of completion says little if the lease is later disputed.
- Approach
- Each party receives a link on the manager's own domain and branding, enters an emailed access code, passes the identity check and signs without an account, with the optional SMS passcode for higher-value mandates. The completed lease carries consent and audit-certificate pages, RFC 3161 trusted timestamps and a cryptographic seal over the archived file.
- Result
- Signing takes a link and a code for every party, and if the lease is ever contested the evidence travels with the document itself.
Licence
Per deployment. Never per seat.
Licensed per installation, on your own annual turnover, ex VAT — never per envelope. Pricing is marginal, like income tax: each slice of turnover is charged at its own rate, with a €900 minimum and any yearly increase capped at 25%. Every tranche includes unlimited users, projects and organisations in one tenant, self-hosting, and support that rises with the tranche.
Annual licence by turnover, ex VAT
| Turnover | Per year |
|---|
| Up to €500k | €900 |
|---|
| €1M | €1,500 |
|---|
| €5M | €2,500 |
|---|
| €25M | €5,500 |
|---|
| €100M | €13,000 |
|---|
| €500M | €37,000 |
|---|
| €1B | €52,000 |
|---|
Illustrative: a per-envelope vendor at €2 an envelope bills ten thousand signatures €20,000 a year; at €5M turnover this is €2,500.
What it does
- 01Signed on your own domain, under your own brand — a signee never sees a vendor's name.
- 02Every completed document carries a full audit certificate, trusted timestamps and a cryptographic seal.
- 03Licensed per installation, never per envelope — ten documents or ten thousand cost the same.
At a glance
CategoryElectronic Signature
LicencePer deployment, unlimited users, from €900 a year
For whomHR · Accountancy · Real estate · Legal
Send yourself a contract.
On your domain, with your logo. Then open the completed file and read the audit certificate that came back with it.Start the conversation →