Introduction

What NoSign is and isn't.

NoSign is a self-hosted, single-tenant, API-first electronic signature service (SES). It is a small, focused signature motor: feed it a PDF and a list of signers, and it drives the entire signing ceremony — email verification, explicit consent, a visible hand-drawn signature, a complete tamper-evident audit trail, a cryptographically sealed output PDF — then hands the result back to your backend over a signed webhook and hard-deletes everything afterwards.

It is not a SaaS, not multi-tenant, and has no public user accounts. You run it on your own infrastructure, it talks to exactly one client (your platform or central API), and it serves the signer-facing pages directly to signers over the open internet.

One sentence: A signing request (PDF + signer list) becomes a legally sound, provable, signed and sealed PDF with a full audit trail — delivered by webhook, then fully erased.

NoSign is free and open source, released under the GNU AGPLv3. Every feature is included — there is no paid tier, no premium edition, and no hosted SaaS. Download it, run it, it’s yours.

That includes the features other open-source e-sign tools paywall: five field types and reusable templates, a full signing lifecycle (decline, expire, remind), an embedded evidence layer with an offline /verify portal, rotation-safe webhooks, and a public developer sandbox.

Who it’s for

• You want to own your signature flow end-to-end on your own servers — no third-party signing SaaS, no data leaving your infrastructure.
• You need an API-first building block that your existing backend drives programmatically. NoSign is a motor, not an app your end-users log into.
• You need a simple electronic signature (SES) with a strong, provable audit trail: intent, email-verified identity, verbatim consent, and a visible signature.
• You care about data minimization by design: documents and personal data are hard-deleted as soon as your backend confirms receipt.
• You want a self-hostable, Docker-deployable system with single-binary-of-responsibility simplicity.

Who it’s not for

• QES / AES — qualified or advanced electronic signatures under an eIDAS trust service. NoSign is deliberately SES. The document seal is an organizational integrity seal, not the qualified identity of the signer.
• Multi-tenant SaaS with public sign-ups, billing, and dashboards for many customers.
• Parallel multi-signing or a drag-and-drop field placement UI — those are out of scope. Field types and reusable templates ship in the box, but your platform still resolves where fields go and sends the coordinates.
• Full long-term validation (PAdES-LTV) or an AATL/commercially-trusted certificate out of the box. The seal is self-signed by default; an embedded evidence layer and offline /verify ship today, but full LTV and a trusted .p12 are a later drop-in with no code change.
• A multi-tenant surface — the developer sandbox is opt-in for testing, not a multi-tenant SaaS.