How it works
Nothing here is magic and nothing here is inferred. Every step below is something the server does, and every fact in the record is something it saw.
A public https PDF URL, raw base64 bytes, or markdown we typeset. Exactly one — supplying two is refused rather than resolved by precedence, because silently ignoring a field is how the wrong document gets signed. Up to 8 MB, or 60,000 characters of markdown.
A URL is fetched over https only, never through a redirect, and refused outright if it resolves to a private or link-local address. Magic bytes decide whether it is a PDF — a server that labels a ZIP as application/pdf does not get its ZIP signed.
Whatever arrives is hashed with sha256 the moment it lands, and those bytes are never rewritten for the life of the envelope.
That hash is printed on the certificate, recorded against every signer, shown on the signing page above the button, and included in the invitation email. It is the answer to “is this the document they signed?”.
Up to 10 signers. Give them an order and a higher group is only invited once every lower group has signed; leave it off and everyone is invited at once.
A link is 256 bits of CSPRNG entropy in the URL and a sha256 digest in the database — so a database read can neither sign anything nor open anybody's page. It is never logged and never indexed.
The signing page is a zero-JS route handler. No sign-up, no app, no cookie. They open the document, type their full name, tick the consent box, and that is the signature.
Before the button, the page states what this produces and what gets recorded about them — timestamp, IP, user agent, typed name, document hash. An audit trail somebody only discovers afterwards is surveillance with a nicer name.
The instant the last signature lands the envelope is executed. The 10-credit charge builds the executed PDF and the audit trail; polling and downloading them are free forever.
The executed copy COPIES the original pages into a new document and appends a certificate of completion. If your wallet is short at that moment the signatures still stand — the copy is produced as soon as the charge clears.
What ends up in the record
Observed, on a real request
And therefore not claimed
Before you route anything important through this
Signature produces an executed record with an audit trail. It is not legal advice and makes no claim of ESIGN, UETA or eIDAS qualification. Signer identity is not verified.
Every envelope carries a window — 14 days by default, up to 90. Expiry is derived from the clock on every read, so nothing depends on a background job having run.
Void an envelope and every link is dead on the next request. The signing page is served no-store precisely so a cache cannot serve a document you already pulled.
An envelope where not one invitation could be delivered refunds the 15 in full, pool-exact. On the keyless rail it is refused before the payment settles, because there is no refund on chain.