What level of signatures are you looking for?

[ElTimuro]

👋 Welcome!

In this discussion, we are trying to learn about the needs of the Documenso Community. What are your needs as a user/ hoster?

• Simple Electronic Signature
• Advanced Electronic Signature
• Qualified Electronic Signature
• Do you care at all?
• "What the hell are signatures level?"
• What else do you need in terms of compliance or similar, to use Documenso in production?

[arpadgabor]

Love the initiative! To answer your question briefly - in my case, qualified signatures would be a must. I already have a signature that I paid for and is expiring this year and I use it for signing stuff for the government.

Now, what I'm wondering, how would other entities trust my signature? I know how certificates and CA's work for SSL/TLS, I'm not sure how it works in the case of self-hosted qualified signatures.

[ElTimuro]

Great to have you🙏 Documenso supports qualified signatures out of the box. So you could use your own certificate on your instance. So far there are no plans to import certs to the hosted version, would that be interesting? The plan so far is to offer a hosted version with an "expensive", bought trusted certificate. Sadly so far there is no way to make your cert trusted by the authorities if it's not on the EU trust list or adobe trust list or similar, depending on who it's for. Doesn't change the cryptography, more the acceptance.

[arpadgabor]

Doesn't change the cryptography, more the acceptance.

Yep exactly what I was thinking.

So far there are no plans to import certs to the hosted version, would that be interesting?

Can't speak for others, but at least in my case I don't think so. The stuff I need to sign for the govt are (unfortunately) some javascript powered PDFs that have a special "box" made for the signature and they also do some validation in the background, not sure if they also validate where exactly the visible signature watermark is placed (but I wouldn't exclude that).

Another problem that is really annoying with digital signatures is the dongle, or in my case a digital "token", to be able to sign through Adobe reader (others don't work), or access specific websites in the same way (firefox doesn't work either with the custom certificate), and the ceritificate is injected automagically by that token into the trusted authorities in the browser/operating system. I'm not sure how/if these token based ceritificates could be somehow added to Documenso.

Now, I know this is probably out of scope for Documenso, but these are some real problems that I think you also know pretty well. What I think Documenso should really do in the initial stages is to educate people about how all this stuff works (kind of related to questions 4 and 5) behind the scenes.

[ElTimuro]

True, that's far reaching. Still, longterm I would like Documenso to support every case. Short term that's out of scope.

Good point about the education. I'm planning a series about the levels and signing types. Would love your input if you want to give feedback.

[ElTimuro]

If you can want want, sent me a example of the docs you sign so I can test them a bit (if you can send them without Confidential data of course)

[arpadgabor]

Sure, would love to help for the education part :)

About the document, sure, this is the public form, it's in Romanian, would fill in some data for testing but stuck with some stuff at work atm: https://static.anaf.ro/static/10/Anaf/Declaratii_R/AplicatiiDec/dclUnica_2023-v1.0.2_07032023.pdf

[dosandco]

For us, one of the key drawbacks to most signing solutions is the ability for the signer to nominate a witness - in the UK, deeds (a certain type of contract) usually require a signature to be witnessed by someone else.
Some of the big platforms offer a clever e-witness solution while others charge per signature - if Documenso can do this, you will capture the love of an entire little island just off the coast of Europe...!

[david-loe]

Love this Project!

I know that a Qualified Electronic Signature is what we need. I found this list of qualified trust service providers in the EU, but I dont really know which type of certificate we would need to buy as a company to get the Qualified Electronic Signatures with Documenso.

EDIT: Found this FAQ very helpful

PS: Any Update on the education series? @ElTimuro

[drscream]

To use your (awesome) application as a service I would looking for the possibility to use a Advanced Electronic Signature. If my understanding is correct the Advanced Electronic Signature provides a bit more authenticity than the Simple Electronic Signature.

I would like to use your application to send customers / users documents which they should sign which is already possible at the moment with the Simple Electronic Signature. For the Advanced Electronic Signature I think it only need to be possible to track down if the signature is owned by the user and the document could not be modified. I assume this could be a implementation which is "easily" possible with some kind of audit trail, customer registration / verification process.

The possibility to use Qualified Electronic Signature would be awesome, but somehow I do not expect that much users use them because it would require additional hardware (card, card reader, token, whatever). Which would also not suitable for my customers / users because they would not buy such equipment.

[daallgeier]

I want to be able to use my Estonian (E-)Residency card to sign documents from my side.

Would love to be able to configure what (minimum) level of signature i need from my signers too.

[KyooMario]

Hello Team,

Like your solution so far.
Can you tell me if embedding is on the roadmap and when?

Cheers Mario

[ElTimuro]

@KyooMario Hey Mario, yes it is! We don't give out timelines, since that's always a pain, but it is "up next" on the things we will work on: documen.so/live

Could share more about what you would ideally want?

[KyooMario]

Our case:

• We use Salesforce to generate PDFs.
• We will send the PDFs for signing to Documenso
• We get returned the signing URLs
• We send a mail to the signer which points to our Portal
• The signer logs in an is presented with all the documents to be signed
• And as requested can sign the document without leaving the Portal

Makes sense?
Cheers Mario

[ElTimuro]

yes totally, but you can already do that with the current API, I thought you were talking about embedding components

[KyooMario]

"And as requested can sign the document without leaving the Portal"

When clicking the signing Url the signer will be directed to the Documenso Portal. And will return back with the redirect Url. But I don't want the signer to leave our Portal. Hence using your "embedded" component in our Portal.

Am I right? Or do I miss information.

Cheers Mario

[ElTimuro]

• @KyooMario, if you want the user never to leave the site, yes, you need the components since that's what they are for. We will start work on those soon 🙌
• The other flow is already available, that's why I mentioned it

[KyooMario]

Hello Timur, OK. Thanks. Please keep me posted when it is available. OK?! Cheers Mario From: Timur Ercan ***@***.***> Sent: Tuesday, 16 April 2024 12:08 To: documenso/documenso ***@***.***> Cc: Mario Kyoo ***@***.***>; Mention ***@***.***> Subject: Re: [documenso/documenso] What level of signatures are you looking for? (Discussion #1) * @KyooMario<https://github.com/KyooMario>, if you want the user never to leave the site, yes, you need the components since that's what they are for. We will start work on those soon 🙌 * The other flow is already available, that's why I mentioned it — Reply to this email directly, view it on GitHub<#1 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJJLSXXWB45EXDJBB3HFJFTY5TZ6ZAVCNFSM6AAAAAAVZGHBNSVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TCMRYGM4TG>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[ElTimuro]

• sure
• You can also follow along here: documen.so/live

[PhilippvH1]

For us, the simple electronic signature is all we need, however in significant quantities (currently burning through >500 / month at Yousign).

As discussed already on DIscord with @ElTimuro, we however have to force the users to draw their signature each time instead of using a pre-drawn signature or uploading an image of their signature (regulatory requirement in our field).

I know how complicated Advanced and especially Qualified Electronic Signatures are. From my experience, I need 3-5 of these each year while the Simple Signature is sufficient in all other cases (at least in Germany) - see also this overview.

[ElTimuro]

• That overview is neat
• We plan to offer AES/ QES later this year, but no timeline yet