Signet
Scheduled Sep 22, 2026E-signature with an audit trail you can prove.
Replaces
- DocuSign eSignature · Docusign, Inc. — $45 per seat per month (Business Pro), about $216,000/yr at 400 seats
- Adobe Acrobat Sign · Adobe Inc. — $23.99 per seat per month (Acrobat Pro for teams), about $115,152/yr at 400 seats
Rented, per year
$216,000
DocuSign eSignature list price at 400 seats.
Owned, per year
$4,080
AWS infrastructure only. Azure is $4,560.
Build
9 weeks
2 engineers. To parity on the core features above, including migration of templates and export of executed envelopes with their audit certificates from DocuSign.
Difficulty
4/5
Substantial. Compliance or realtime depth involved.
Reference organisation: 200 senders, 24,000 envelopes a year, 400 GB of executed documents under a 10-year retention policy, single region, prod + non-prod. 3-year Compute Savings Plan on Fargate / 3-year reservation on Container Apps. Aurora minimum 0.5 ACU. Documents on S3 Standard for 90 days then Glacier Instant Retrieval; equivalent Blob cool tier on Azure. Key Vault Premium on Azure, not Managed HSM. Excludes any third-party identity-verification provider, RFC 3161 timestamp authority fees and vendor support plans. Figures are infrastructure only and exclude the build.
What it is
Signet is an e-signature system: reusable templates, ordered and parallel routing, field placement, in-person and remote signing, and a tamper-evident audit trail anchored in immutable storage. It is aimed at organisations sending more than about twenty thousand envelopes a year, where per-seat pricing with a hundred-envelope cap has turned a piece of infrastructure into a procurement conversation. Signet is deliberately narrow. It signs documents, records exactly what happened, and proves later that the record has not changed.
Why this one stops making sense
- DocuSign Business Pro lists at $45 per user per month and includes 100 envelopes per user per year. Two hundred senders is $108,000 a year for 20,000 envelopes — about $5.40 per signature.
- The envelope allowance means the pricing model punishes the department that uses the tool most, and the usual response is envelope rationing, shared accounts and spreadsheets.
- Executed contracts are the documents you are most likely to need in five years and least likely to be able to retrieve, because they live in a vendor's object store under a vendor's retention policy.
- The audit certificate is the product. If you cannot show how it is generated, you are asking a court to trust a vendor's PDF rather than a hash chain you can recompute.
- Every integration — CRM, HR, procurement — is built against an API whose rate limits and envelope quotas are commercial levers, not technical ones.
What ships
- Templates with reusable field layouts, roles and conditional recipient routing
- Sequential, parallel and hybrid routing with reminders, expiry and delegation
- Field types: signature, initials, date, text, checkbox, radio, dropdown, attachment, formula
- Signer authentication by email, access code, SMS one-time code or IdP challenge
- Tamper-evident audit trail: an append-only hash chain per envelope, anchored into immutable storage
- PDF/A output with an embedded audit certificate and a long-term validation timestamp
- Bulk send from a list, and API-driven envelope creation from Relay or your ERP
- In-person signing on a shared device with a separate identity capture step
- Retention and legal hold rules per document class, enforced at the storage layer
- Full re-verification tooling: recompute the chain for any envelope and prove it matches the anchor
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind + PDF.js for rendering and field placement
- backend
- NestJS on Node 22, with a separate signing service that holds no HTTP surface of its own
- database
- PostgreSQL 16; audit entries in an append-only table with no UPDATE or DELETE grant
- cache
- Redis 7 for signing-session state and one-time-code issuance
- queue
- BullMQ for rendering, notification, anchoring and certificate generation
- auth
- OIDC for staff via the customer IdP; single-use signed links plus step-up challenge for signers
- search
- PostgreSQL tsvector over envelope metadata and extracted document text
- ai
- Optional clause extraction and obligation summarisation, off by default on executed documents
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought DocuSign eSignature, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | DocuSign eSignature | Ours | Note |
|---|---|---|---|
| Templates, field placement and reusable roles | Yes | Yes | — |
| Sequential and parallel routing with reminders | Yes | Yes | — |
| Tamper-evident audit trail and certificate | Yes | Yes | Ours is a published hash-chain scheme you or your counterparty can recompute independently. |
| Signer authentication (email, access code, SMS OTP) | Yes | Yes | — |
| Unlimited envelopes without a per-user cap | No | Yes | The cost of an envelope becomes storage and a few cents of compute. |
| Bulk send and API envelope creation | Yes | Yes | No envelope quota and no API rate tier. |
| Twenty years of case law testing the audit record in court | Yes | No | This is the one that should stop you. DocuSign's certificate has been examined and accepted by courts in many jurisdictions across two decades. Signet's is cryptographically sound and, for now, untested. For an NDA that is fine. For an eight-figure lease, opposing counsel recognising the format has real settlement value. |
| eIDAS Qualified Electronic Signature via a listed trust service provider | Yes | No | A QES requires a Qualified Trust Service Provider on an EU member state's trusted list. That is an accreditation, not a feature — we cannot build it and neither can you. If you need QES, keep a vendor for those documents. Signet can route to one for that subset and handle everything else. |
| 21 CFR Part 11 validated e-signature for regulated life sciences | Yes | No | DocuSign and Adobe sell validation packages and IQ/OQ documentation for FDA-regulated processes. Building and maintaining a validated system is a programme in its own right, not a fortnight of work. |
| Government-ID and bank-ID identity verification | Yes | Partial | Signet integrates a verification provider such as Onfido or Persona if you want it. DocuSign bundles this with an established identity network; we are reselling someone else's. |
| Notary and witnessed signing sessions | Yes | No | Remote online notarisation is jurisdictionally licensed. Not something to self-build. |
| Mobile signing on any device | Yes | Yes | Responsive signing surface, no application to install for the signer. |
| Long-term validation timestamps (RFC 3161) | Yes | Yes | Against a public timestamp authority of your choosing, recorded per envelope. |
| SOC 2 Type II and ISO 27001 attestation on the signing service | Yes | No | Signet inherits your cloud posture. If a counterparty's procurement demands the vendor's certificate, that is a reason to keep buying. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate (api, render, signer, worker) behind an ALB; the signer service is reachable only from the API's security group
- Data
- Aurora Serverless v2 PostgreSQL with an append-only audit schema
- Storage and edge
- S3 for documents; a separate S3 bucket with Object Lock in compliance mode for chain anchors
- Identity
- Cognito federated to the customer IdP for staff; signer sessions are short-lived signed tokens
- Observability
- CloudWatch and OpenTelemetry; anchor-write failure is a paging alarm
- Infrastructure as code
- Terraform, one module per environment
Services
The decision worth arguing about
Each envelope carries an append-only hash chain — every event hashes the previous entry — and every fifteen minutes a worker writes a Merkle root over all chains advanced in that window into an S3 bucket with Object Lock in compliance mode, signed by an asymmetric KMS key whose policy grants signing to exactly one task role and to no human principal, including the account root. Compliance mode is the point: not even an administrator with full IAM can delete or shorten the retention on those objects, which is what makes the anchor worth anything. That property is also the trap, and it drove the one design decision people miss. Because the anchored objects can never be deleted, they must never contain personal data — so an anchor holds only hashes and window boundaries, and every name, email address, IP address and signature image lives in a separate, deletable object. If you anchor the audit certificate itself you have built a GDPR erasure request you are cryptographically unable to satisfy, and you will find that out from your DPO rather than from your architect. The cost of doing it this way is that proving an individual envelope requires the deletable document plus the inclusion proof, so an erasure genuinely destroys your ability to re-verify that envelope later. That is the correct behaviour, and it needs to be a written retention decision rather than an accident.
Microsoft Azure
- Compute
- Container Apps (api, render, signer, worker), signer restricted to internal ingress
- Data
- PostgreSQL Flexible Server with an append-only audit schema
- Storage and edge
- Blob Storage for documents; a separate immutable container with a time-based retention policy, locked
- Identity
- Microsoft Entra ID for staff; signer sessions as short-lived signed tokens
- Observability
- Azure Monitor and Application Insights, with anchor-write failure as an alert rule
- Infrastructure as code
- Bicep, azd-compatible layout
Services
The decision worth arguing about
The Azure equivalent of Object Lock compliance mode is a locked time-based immutability policy on a blob container, and it behaves the same way: once the policy is locked, retention can be extended but never shortened and the blobs cannot be deleted. The difference is in key custody, and this is where the Azure design deliberately diverges from the obvious answer. The obvious answer is Managed HSM — a single-tenant, FIPS 140-2 Level 3 pool where you hold the security domain and Microsoft mathematically cannot use your key. The problem is that a Managed HSM pool bills by the hour from the moment it exists, whether you sign one envelope or a million, and for a deployment of this size that single line is larger than every other Azure component combined. So we default to Key Vault Premium, which is also FIPS 140-2 Level 3 validated but multi-tenant, and we reserve Managed HSM for customers whose regulator asks specifically about single-tenant key isolation. The trade-off is honest and narrow: with Premium you are trusting Microsoft's tenancy boundary in a way that Managed HSM's security domain removes, and if that distinction matters to your auditor it is worth the fixed hourly cost. The Bicep supports both and switching is a parameter, not a rewrite.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| DocuSign eSignature | Business Pro | $45 / seat/month | 2026-09-05 | ecom.docusign.com/plans-and-pricing/esignatu Billed annually and capped at 100 envelopes per user per year. Standard lists at $30 per user per month on the same envelope allowance; higher volumes move to Enhanced Plans, which are quoted by sales. |
| Adobe Acrobat Sign | Acrobat Pro for teams | $23.99 / seat/month | 2026-09-05 | www.adobe.com/acrobat/business/pricing-plans The published team price that includes e-signature. Adobe states on the same page that Acrobat Standard and Acrobat Pro e-signature does not offer the same level of compliance as Acrobat Sign Solutions, which is the enterprise product and is quoted by sales. |
Should you still be paying for DocuSign eSignature?
Two weeks, fixed price. We audit what you actually use, map it against Signet, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.