Every time I upload a contract to a cloud signing service, I am trusting a company I cannot see with documents that might matter deeply to my business or my life. The trust is convenient, but it is not free, and it is not guaranteed. Documenso gives me a different path. It is an open-source document signing server I run on my own hardware, with my own keys, that produces the same legally binding signatures DocuSign does for about $0 per month after the first hour of setup.
I switched in late 2024 after a contract I cared about failed to load in DocuSign’s web app for two days while their status page blamed a third-party CDN. Two days of “we are working on it” for a contract that had a deadline. The fix was not DocuSign’s fault specifically, but it was the moment I realized that any cloud signing service is one outage away from being useless, and the only signing service I can fully control is the one I run myself. I have not opened the DocuSign dashboard in 18 months.
What Documenso actually does
Documenso is a self-hosted document signing platform. You run it as a Docker container (a packaged application that runs the same way on any Linux machine, like a zip file for servers) on a server you control, you and your signers open it in a web browser, and the system handles the same flow DocuSign handles: upload a PDF, drop signature fields, email the signer a link, signer draws or types a signature, both parties get a copy of the signed PDF with a cryptographic audit trail (a tamper-evident log that records when each signer touched the document and from which IP address). The signature is legally binding in the United States under ESIGN (the Electronic Signatures in Global and National Commerce Act of 2000, which makes electronic signatures equivalent to handwritten ones) and in the EU under eIDAS (the Electronic Identification, Authentication and Trust Services regulation, the EU’s electronic signature law).
The difference is where the data lives. DocuSign stores your documents on their servers, in their database, encrypted with keys they control. Documenso stores your documents on your server, in your database, encrypted with keys you control. If a hacker breaches DocuSign, your contracts are in the breach. If a hacker breaches my Documenso instance, they get my contracts and only my contracts, and I find out about it because the server is in my closet. The blast radius is smaller. The trust assumption is smaller. The legal validity is the same.
The audit trail is the part most people underestimate. When a contract is signed on Documenso, the audit trail records the signer’s email, the timestamp, the IP address, the user agent string (the browser identification string the signer’s browser sends), and a cryptographic hash (a one-way fingerprint of the document) of the PDF at the moment of signing. The hash is sealed with a signature from Documenso’s signing key, which is itself sealed with a signature from a timestamping authority. The result is a PDF that, if anyone modifies, breaks the hash chain. Courts accept this audit trail as evidence of who signed what and when, just like they accept DocuSign’s. The only difference is the audit trail lives in your database, not DocuSign’s.
The setup that took an hour
Before you start, gather the four things you will need:
- A server that runs 24/7. A Mini PC, an old desktop, a Raspberry Pi 4 or 5, a homelab server, or a cheap VPS from Hetzner or BuyVM. The hardware requirements are small (1 CPU core, 1GB RAM, 20GB disk) and almost anything from the last five years will work. If you are not sure what to use, a Beelink Mini S12 with 16GB of RAM and a 1TB SSD is $200 and runs every self-hosted app I have tried without breaking a sweat.
- A domain name you control. Documenso sends signing invitations from an email address at a domain you own, and the email has to come from that domain for the SPF/DKIM/DMARC records (the three DNS records that prove your email is legitimate) to work. A $10 per year
.comfrom Cloudflare or Namecheap is enough. The domain does not need to be the one you use for your business, but it does need to be a real domain that you can add DNS records to. - An SMTP relay with a real mail provider. Mailgun, Amazon SES, Postmark, or Resend. The free tier of any of them is enough for low-volume signing invitations. You cannot use your home ISP’s SMTP server because residential IP ranges are blocked by most receiving mail servers. The relay is what forwards outbound email through a real provider that has a clean IP reputation.
- A reverse proxy with HTTPS. Caddy, Nginx, or Traefik (all three are free open-source web servers that sit in front of your application and handle HTTPS certificate management and inbound traffic routing). The reverse proxy terminates HTTPS (handles the encrypted connection from the signer’s browser, so the application behind it can speak plain HTTP) and forwards the unencrypted traffic to the Documenso container. Caddy is the easiest because it auto-renews Let’s Encrypt certificates with no configuration. Nginx requires more setup but is more flexible.
I run Documenso on a $200 Mini PC from Beelink that I bought specifically for self-hosted apps. It has an Intel N100 processor, 16GB of RAM, and a 1TB SSD. It sits in a closet, runs 24/7, and currently hosts 14 containers: Documenso, Nextcloud, Immich, Paperless-ngx, and ten smaller services. The Mini PC draws about 15 watts at idle, which is about $20 per year in electricity. The hardware paid for itself in 2024 by replacing the DocuSign subscription I was paying for.
The install is Docker Compose, a tool that lets you describe a multi-container application in a single YAML file (a plain-text configuration format with key: value pairs) and start it with one command. The Documenso team publishes a docker-compose.yml on their GitHub that includes Documenso, Postgres (the database Documenso stores documents and users in), Redis (a fast in-memory cache that Documenso uses for session storage and background job queues), and an SMTP relay (a service that forwards outbound email through a real mail provider like Mailgun or Amazon SES, because raw SMTP from a home IP gets rejected). The file is 80 lines, the bulk of which is comments explaining what each line does.
The hard part is the SMTP relay and the domain. Documenso sends signing invitations from an email address you configure, and the email has to come from a domain you control with proper SPF, DKIM, and DMARC records (three DNS records that prove your email is legitimate and not spoofed, the email equivalent of return address + signature + notary seal). I already had a domain for the Mini PC, so I added a signing.example.com subdomain, pointed it at the Mini PC’s public IP, and configured Mailgun to relay outgoing mail through that subdomain. The DNS work took about 20 minutes, mostly waiting for records to propagate.
After the install, the rest of the hour was creating my user account, uploading a test PDF, signing it, downloading the signed PDF, and verifying the audit trail. The first signature I did for real, a contractor agreement with a freelance designer I work with, took another 5 minutes to set up because the designer had never seen Documenso before. She opened the signing link in her browser, drew her signature with the mouse, clicked confirm, and got a copy of the signed PDF by email. The total time from “I sent the contract” to “we both have a signed copy” was about 15 minutes, most of which was the designer’s first time through the UI.
What I gave up
I gave up DocuSign’s mobile app. Documenso has a web UI, not a native mobile app, and the web UI on a phone is fine for reading and signing, not fine for “I’m in a coffee shop and I need to send a contract for signature in the next 5 minutes” urgent use cases. For the urgent cases, I fall back to a different approach: I sign the PDF locally with a tool like Xournal++ (a free PDF annotation app for Linux, Mac, and Windows) and email the signed copy. The Xournal++ approach is not a real signing platform, but for a 2-page NDA (non-disclosure agreement) with someone I already have a relationship with, it works. If you live inside the DocuSign mobile app for work, the move to Documenso will be a real downgrade in your day-to-day workflow. Acknowledge that before you start.
I gave up the “DocuSign Trust Service Provider” branding. Some enterprises have procurement processes that require contracts be signed through a specific TSP (Trusted Service Provider) on a pre-approved vendor list. Documenso is not on those lists because it is not a commercial SaaS. If your customer is a Fortune 500 with a legal team that requires “DocuSign or Adobe Sign” specifically, the contract will not close on Documenso regardless of how legally valid the signature is. This is a real-world constraint that has nothing to do with the technology.
The polished first-time user experience is also gone. DocuSign’s onboarding for a signer is a five-step wizard that walks them through the signature process with a progress bar. Documenso’s onboarding for a signer is a “click here to sign” link that opens a web page with a draw-or-type-your-signature box. It works, but the user is doing more of the figuring-out. For signers who sign contracts for a living (lawyers, real estate agents, HR staff), the Documenso flow is jarring the first time. By the third time, they do not notice. The onboarding is not a permanent downgrade, but the first two signings will cost you a 5-minute phone call explaining “no, that link is the right one, just click the box.”
Trade-offs
Documenso is not free in setup time. The first weekend was real. I had to learn the SMTP relay configuration, the DNS records, the Docker Compose file, the database backup strategy, the HTTPS certificate renewal with Let’s Encrypt (a free service that issues and automatically renews SSL/TLS certificates, the encryption that puts the padlock in the browser address bar), and the reverse proxy setup that exposes the container to the internet. None of these are individually hard. Together, they are a weekend for someone who has not done them before. After the first install, maintenance is about 30 minutes per quarter, mostly updating the container images and checking the backup logs.
Documenso does not handle high-volume signing well out of the box. The default install is fine for a small business sending a few contracts a week. If you are sending 50 contracts a day, you will need to scale the Postgres database, add a job queue, and probably move the Mini PC to a real server. Documenso is built for the long tail of “I need to sign a contract occasionally” use cases, not the “we are an e-signature reseller” use cases. If you are in the second category, the math is different.
In our case, the math is easy. I was paying DocuSign $25 per user per month for a team of 3, which is $900 per year for the privilege of uploading contracts to a third party. The Mini PC cost $200, the electricity is $20 per year, and the maintenance is a Saturday morning every three months. Year one saved me $680. Year two and beyond is pure savings. The privacy dividend is real, and the legal validity is the same as DocuSign’s.
Bottom line
Anyone who signs more than one contract a month and is paying a SaaS for the privilege should look at Documenso. The setup is a weekend, the ongoing cost is electricity, and the legal validity is the same as the SaaS you are replacing. The trade-offs are real (no mobile app, no enterprise TSP branding, rougher onboarding for signers), but for a small business or a freelancer, none of them are dealbreakers.
If you only do one thing from this article, set up the SMTP relay correctly. Email is the part that breaks when it breaks, and a signing platform that cannot send signing invitations is not a signing platform. Spend the 20 minutes on the DNS records. The rest is a Docker Compose file.