DrakonSign
Send a document, get it signed, and keep evidence you can check. Every step is hash-chained, both completed files are fingerprinted, and every completed envelope gets its own certificate. UK-run, API-first, no per-signature fees.
Simple electronic signatures may suit ordinary business paperwork. Excluded categories include deeds, land transfers, wills and LPAs. See which documents suit it, or read exactly what the trust layer records and where it stops.
Most e-signatures are a picture on a PDF.
Ours come with checkable records.
When a signature is challenged, what matters is the system record around it: which recipient record was served which document version, which inbox was verified, which actions were submitted and whether anything changed afterwards. That record does not establish that a human opened, read or understood the document. DrakonSign records those system events in an append-only chain of SHA-256 hashes and seals the final document’s fingerprint into that chain — so tampering isn’t just forbidden, it’s mathematically detectable. You can re-verify the whole chain any time, with one click in the dashboard or one API call.
Hash-chained audit trail
Every event — created, sent, verification started, code sent, inbox verified, protected PDF accessed, signed, completed — is linked to the last by SHA-256. Change one record and the whole chain fails verification.
Completion artifacts
SHA-256 completion fingerprints for the signed PDF and its certificate are recorded on the chain the moment the envelope completes. The completed PDF gets a self-issued PAdES B-T seal only when the signing key and timestamp authority are available; readers may show an untrusted issuer. The outcome is measured on the produced file: a TSA outage records PAdES B-B only when the signature itself validates, and otherwise the completion records that a timestamp is present but unverified, that there is a signature that did not verify, or that the seal state is unknown. A missing key records an unsealed artifact. DigiCert anchoring is fail-open and exists only if DigiCert answers, with a missing anchor recorded; B-LT/B-LTA is not shipped.
Inbox verification
Signers open a personal link and confirm control of their email inbox with a one-time code before the document is shown. This supports attribution; it does not prove human identity or signature genuineness.
Certificate of completion
Recorded signer attribution and event times, plus IP and browser metadata only for applicable browser-driven events — with no guarantee of human identity or location. Both document fingerprints and the chain-verification result are captured when completion occurred. It is a snapshot; use the dashboard or API to re-verify the current chain.
API-first
Every envelope operation is available through the API: upload, place fields, send, track and download evidence. Billing, API-key management and account security remain dashboard-only.
Automatic field placement
Signature, date and initial labels detected in your PDF automatically — review, adjust, send.
What we don’t claim
Selling a trust layer means being exact about where it stops. Nothing here is buried on a sub-page; all of it is set out in full on the Security page.
- Sealing is conditional, and measured. Self-issued PAdES B-T requires the signing key and timestamp authority; the state recorded is the one measured on the produced file — PAdES B-B only when the signature itself validates, and otherwise a timestamp present but unverified, a signature that did not verify, or a seal state that is unknown. A missing key records an unsealed artifact. That recorded state is authoritative. Readers may show the self-issued certificate as an untrusted issuer, and B-LT/B-LTA is not shipped.
- Anchoring is fail-open. DigiCert anchoring exists only if DigiCert answers, with a missing anchor recorded immutably on the chain as a degradation rather than hidden.
- Inbox control, not identity documents. A one-time code confirms control of the addressed inbox before the document is shown. That supports attribution; it does not prove human identity or signature genuineness, and we examine no passports or company records.
- Not an AES, and not a QES. DrakonSign produces a simple electronic signature. Some documents need more — excluded categories include deeds, land transfers, wills and LPAs; see the full list.
- Witness and Approver are routing labels. They order the envelope and print on the certificate. They perform no statutory witnessing: every recipient goes through the same ceremony, and nothing records that a witness was present when someone else signed.
- No legal guarantee. The evidence is designed to support authenticity, attribution and enforceability. Whether a particular document is enforceable depends on its own formalities and the law that governs it — that is yours to establish, and nothing we publish is legal advice.
- Residency, stated exactly. The application, the database and your live documents are in London; encrypted 30-day backups use globally distributed Tigris storage, so we will not tell you your data never leaves the UK.
- Team access is role-scoped.Owners and admins can invite members; billing, API keys and account-security controls stay owner-only, and an API key never inherits its creator’s human role.
Live service in London. Encrypted 30-day backups on globally distributed Tigris storage. GDPR by design.
- The app, the database and your documents run in London (UK).
- Encrypted in transit and at rest — including the nightly backups, which are held for 30 days in a globally distributed bucket rather than pinned to the UK.
- Signing pages set no cookies and make no third-party requests. No analytics or tracking anywhere.
- Designed around UK eIDAS and the Electronic Communications Act 2000. Read how.
Try it free for a month. From £15 after.
Start Starter on a 30-day free trial — billing only kicks in after a month or your 3rd envelope allowance is consumed, whichever comes first. Every plan gets the full trust layer: the audit chain, fingerprinted completion artifacts and certificates aren’t premium extras. They’re the product.
Start free trial