DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-11-03
- 📦 Latest release: v3.1.0 (2026-10-30)
- 🐞 Open issues: 211
- 🌟 Stars: 7.2k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: opensignlabs.com
- Source: github.com/OpenSignLabs/OpenSign
- License: AGPL-3.0-only (core; paid edition under its own terms)
- Deployment: Docker Container
- Jurisdiction: Undisclosed 🌐 (Qik Innovations Private Limited)
- Compliance (SaaS): app.opensignlabs.com: none published
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Moderate (3/5) - Four services in the shipped Compose file: the backend, a frontend server, MongoDB and a Caddy proxy that also terminates TLS
- Maintenance: Moderate (3/5) - Updates are image pulls and the server runs database migrations at each start; the Compose file tracks MongoDB's latest image, while MongoDB upgrades one major version at a time
- User Management: Moderate (3/5) - Admin, OrgAdmin, Editor and User roles and HTTPS through the bundled Caddy in the free build; single sign-on is paid; audit trails per document only; no SCIM
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? OpenSign is an e-signature platform: a sender sends a PDF to one or more signers, in a set order if needed, from reusable templates, and guest signers sign after entering a code sent to their email. Each completed document is sealed with a certificate against tampering and gets an audit trail and a completion certificate. It serves organisations that want document signing on their own servers. The paid self-hosted plan adds API access, bulk sending from a CSV file and qualified electronic signatures.
The Strategic Verdict:
- 🔴 For teams without someone to secure the database: Caution. The default setup runs MongoDB without authentication on a host port, and single sign-on is a paid feature (The Compliance Shift, User Management).
- 🟢 For organisations that want document signing on their own servers: Strong Buy. The free build carries no license fee, so nothing is charged per document or signer, and each document keeps its audit trail (Cost of Ownership, What is it?).
2. Cost of Ownership
| Cost Component | OpenSign (Self-Hosted) |
|---|---|
| Pricing Model | No license fee for the core; paid edition for some features |
| Operations | Single VM, several services (frontend, backend, MongoDB, Caddy), grows with stored documents; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the maintainers: app.opensignlabs.com, a managed service; for self-hosted installs, community support or a paid service provider |
| Exit | Download per document (signed PDF and completion certificate) |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: The project names no controlling legal entity with a disclosed domicile, so which law applies to whoever controls it cannot be assessed. The project runs app.opensignlabs.com, a hosted service where your data can live, and does not disclose who hosts it.
- The Compliance Shift: The default setup runs MongoDB without authentication and publishes its port on the host, so the operator must close the port or turn authentication on. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist).
- License Risk: OpenSign is under AGPL-3.0-only, an OSI-approved network copyleft license (what it allows and requires). Contributors keep the rights to their code and no agreement transfers them, so moving future versions to terms without copyleft would need every holder's consent. The licence file places the server's custom-route code, which converts documents and deletes accounts, under a licence of its own that the directory does not define.
4. Market Landscape
🏢 Proprietary Incumbents
- Docusign eSignature: Docusign eSignature is a cloud service for sending and signing agreements electronically.
Data held by: Docusign, Inc., United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Its single sign-on and data residency come only on its top plan.
Exit: Envelope download in the web app, ZIP archives with certificates through the eSignature REST API, bulk export only in a higher tier
With OpenSign: Documents and their audit trails stay on servers you run, with no plan tier needed for it (Deployment, What is it?). - Adobe Acrobat Sign: Adobe Acrobat Sign is Adobe's cloud service for electronic signatures.
Data held by: Adobe Inc., United States 🇺🇸, subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: Encryption with its customers' own keys comes only on its top plan.
Exit: PDF and audit report per agreement in the web app; combined PDF and form data through the REST API, bulk export only in a higher tier
🤝 Open-Source Alternatives
—