DocuSeal - Open-Source Document Signing Platform

DocuSeal is “an open source platform that provides secure and efficient digital document signing and processing” — a WYSIWYG PDF form-field builder, automatic PDF eSignature, signature verification, and a deployment that genuinely is one command:

docker run --name docuseal -p 3000:3000 -v.:/data docuseal/docuseal

SQLite by default, Postgres or MySQL by setting DATABASE_URL. For a tool replacing a per-signature SaaS subscription, that is a remarkably low barrier.

The licence line is six words long and it is the one to read twice.

“AGPLv3 with Section 7(b) Additional Terms”

That is how the README states it: “Distributed under the AGPLv3 License with Section 7(b) Additional Terms.”

AGPLv3 on its own is a known quantity: strong copyleft, and the network clause means that if you modify DocuSeal and let others use it over a network, you must offer them your modified source.

Section 7(b) is the part most readers will not recognise. It is the clause of the GPL family that permits a licensor to add a requirement to preserve specified legal notices or author attributions. In plain terms: the project has reserved the right to require that its attribution stays visible, and removing it is a licence violation rather than a cosmetic change.

Now read that next to the Pro features list, which includes “Company logo and white-label.”

The two fit together exactly. White-labelling — removing DocuSeal’s branding — is simultaneously the paid feature and the thing the additional terms protect. That is a coherent, legitimate design: self-host the whole product for free with attribution intact, or pay to remove the attribution. It is also the single most common misunderstanding waiting to happen, because “it’s AGPL, I’ll just edit the template” is both the obvious move and the prohibited one.

Also behind Pro, per the README: “User roles” and “Automated reminders.”

What that leaves in the free tier, and it is a lot

The free self-hosted product includes the things that actually make signing work: the form-field builder, automatic eSignature, and signature verification. For a single-person or single-role workflow — you prepare documents, counterparties sign them — the Pro list is largely irrelevant.

Two gaps worth planning for:

User roles are a Pro feature. If more than one person on your side needs differentiated access, that is the line you will cross first, well before white-labelling matters.

Automated reminders are a Pro feature. This one is easy to underestimate. Chasing unsigned documents is the actual labour in a signing workflow, and doing it manually is the cost you were trying to remove. You can rebuild it — a scheduled job against the API plus a notification sink like ntfy — but be honest with yourself about whether you will.

On the legal question, be careful

This is where a signing tool deserves more scepticism than its feature list invites, so here is precisely what the project claims and what it does not.

The README’s one compliance statement is that DocuSeal helps in “ensuring security and compliance with local electronic document laws.”

What it does not claim, anywhere on that page: eIDAS conformance, ESIGN or UETA compliance, qualified or advanced electronic signatures, tamper-evident audit logs, or signing with a trusted PDF certificate. Those are the terms that determine whether a signature survives a dispute in a given jurisdiction, and their absence is not an accusation — it is simply the limit of what the project asserts.

The practical guidance: DocuSeal is well suited to agreements where both parties are cooperative and a clear record of intent is sufficient — contractor agreements, NDAs, internal approvals, client sign-offs. For anything where the signature itself might be contested, or where a regulator specifies a signature standard, verify against that standard rather than against a README. Ask specifically what cryptographic material signs the PDF and what the audit trail records.

That is not a criticism of DocuSeal. It is the question you should ask of any signing product, including the expensive ones.

Running it in practice

SQLite in a mounted volume is fine for low volume and makes your backup exactly one directory. Switch to Postgres before you have signed documents you cannot regenerate, and back up the volume either way — signed PDFs are the definition of data you cannot recreate.

For HTTPS the README offers sudo HOST=your-domain-name.com docker compose up, which is the right instinct: a signing portal on plain HTTP undermines the premise. If you already run a reverse proxy, let it terminate TLS instead — a platform like Coolify handles certificates and rebuilds without hand-rolling that step.

The project looks healthy on the numbers: 2.5 million image pulls, last pushed in early October.

Who should use it

Anyone paying per signature for a volume that does not justify it, whose workflow is one-sided and whose documents are not legally contested. Pair it with the rest of a self-hosted back office — Libredesk covers the support side with the same AGPL licensing — and the savings are real.

The finding: DocuSeal’s AGPLv3 carries Section 7(b) additional terms, which means the attribution is legally protected and white-labelling is both the paid feature and the one modification you may not make yourself. Add user roles and automated reminders to the Pro column, and the free tier is still genuinely useful — just map those three gaps against your workflow before you migrate to it.