Docuseal: Open-source DocuSign alternative
81–90 of 200 posts
Re: Docuseal: Open-source DocuSign alternative
#82Earlier quoted context omitted.
Thank you for creating this and making it open source. What mechanism(s) is used to ensure non-repudiation? I appreciate that the demo is not behind a sign up wall, but is account creation and email verification required for invitees to sign any documents? Are IP addresses stored as part of the digital signature? Any other mechanism?
IP addresses and browser User Agent strings are stored for each signature/submission - those are the only measures for 'non-repudiation' currently available. but i think it doens't differ from other mainstream SaaS solutions - if you read through their terms of services - they put 'non-repudiation' liability on users of their services
It requires you to know the phone number of the signer, but for important stuff you typically do.
Re: Docuseal: Open-source DocuSign alternative
#83Can I redact text too? If not, is there any software close to Adobe Acrobats functionality?
Re: Docuseal: Open-source DocuSign alternative
#84Unfortunately DocuSign has monopolized electronic signatures in some contexts (examples from my own local experience: healthcare, real estate), to the extent that it's become exceedingly difficult to request a simple PDF to print, hand-sign, scan and return. Such friction is common at companies who outsource their paperwork to third party workflow providers. I'm fortunate that folks I do business with tend to want my signature badly enough to escalate to someone with authority who can make a procedural exception, but I doubt everyone is so lucky and suspect many users are effectively "bullied" into accepting the Terms regardless of their wishes.
Clauses I find objectionable include:
- various consents to analytics, including use of my data to feed their machine learning (might have been more palatable if they provided some insight and stronger confidentiality assurances)
- 2.1.1 waiver of jury trials and class actions
- 8 indemnification (a and e are a little broad, I'm not going to pay for your lawyers in circumstances that don't warrant it)
- 9.2 is unfair; any damages caps should be reciprocal
- confusing and possibly overly-broad intellectual property rights clause 1.1 (they should explicitely restrict their protections to only DocuSign's IP, not "all IP").
- They expressly disclaim any warranties regarding accuracy, quality, fitness for purpose or that information they provide will be error-free. That feels dangerous in the context of forming contracts. A fundamental value proposition of their business is accuracy ("Oops we made a mistake and actually your counterpart did not really sign the document..."). Liability here falls back to the parties, and as a consumer I refuse to be liable for their mistakes.
- Nor am I a fan of increasingly common clauses along the lines of "we can modify our terms at any time and you'll be deemed to accept the revisions" or "you further agree to any other notices we might choose to inject elsewhere onto our site" or vague expectations I consent to additional third party licenses not disclosed at this time (and ironically some of their preamble along these lines seems to be in conflict with 10.8). If you and I agree to something, then later you want to change your mind, you'd better come back and seek fresh consent. If you're making changes so often as to make that annoying and inconvenient, then it's a sign you have too many salaried lawyers on staff and need to replace them with a team empowered to stop wasting my time and yours and get this right the first time. Customer attention is a precious resource, and companies sending out legal updates on a frequent basis can't possibly in good faith expect consumers to keep up with reading them.
- I take offense to their Terms page making connections to Twitter, Facebook, Salesforce, Google analytics, etc. and subjecting me to cookies prompts. All this is not required to simply provide me with your terms of use, and somewhat inappropriate seeing as I haven't yet consented to anything.
These are off their current website, but I recall similarly problematic terms the last time I started (and subsequently abandoned) a signature attempt some years back.
And don't even get me started on their Privacy policy. (Among the various problems... nobody should have to "opt out" of their personal data being sold to other parties).
Re: Docuseal: Open-source DocuSign alternative
#85Can I redact text too? If not, is there any software close to Adobe Acrobats functionality?
You can try the latest version of Scribus for editing PDFs
Re: Docuseal: Open-source DocuSign alternative
#86Re: Docuseal: Open-source DocuSign alternative
#87Earlier quoted context omitted.
Which unfortunately nobody uses because non-cryptographic signatures (such as Docusign or this but hosted by an independent third-party) are considered good enough in practice. Hell, nobody even has a smartcard reader, and as far as I know none of the eID cards have contactless capability that phones (who all have NFC readers nowadays) can use. I wish smartcards took off and computers included readers as standard. Th…
The German eID has had that for years now. And it works pretty well. Only problem is that nobody uses it because our processes aren't adapted to it. The first time I used it for anything, apart from signing pgp keys, was to collect 200€ rent assistance and it worked flawlessly in 4 minutes.
Re: Docuseal: Open-source DocuSign alternative
#88Earlier quoted context omitted.
And yet it's the standard practice for normal people.
From my research this has 0 legal validity, at least in germany in regards to the EU eIDAS. They are just smoke and mirrors for companies to make them "feel" secure but without cryptographic ensurances (Advanced Electronic Signature) or TLS like Signed Cryptography (Qualified Electronic Signature) this is just as legally binding or not binding as an E-Mail
Which is legally binding. In Germany most contracts are free-form contracts (Formfreiheit) and only need declarations of intent in the form of offer and acceptance. This can be a handshake or even a head shake.
Re: Docuseal: Open-source DocuSign alternative
#89Earlier quoted context omitted.
I'm interested in reading more about #2, can you provide a source? https://www.docusign.com/products/electronic-signature/legal... doesn't mention anything about videos or passports. I could see how that might be one means a third party has chosen to collect proof of intent, but haven't found anything legally mandating it.
This may be german law specific, the overarching EU Legislation can be found by googlign "qualified electronic signature". In general they require complete, verified cryptographic signatures via smartcards or similar but because no one uses it, videoident has become the defacto alternative in germany
The need for identification over video, etc., has more to do with the know-your-customer laws.
Re: Docuseal: Open-source DocuSign alternative
#90Earlier quoted context omitted.
One of the tough things about a party-controlled, self-hosted e-signature is that it becomes easier to repudiate because a party to the contract has custody of the platform. The non-custodial party can claim they never signed, and when the custodial party produces evidence of IP address and timestamp, the non-custodial party may have a credible argument that they are faked and the person asserting those authenticated…
> That argument is much harder to assert with something like DocuSign because it is unlikely DocuSign would put their business on the line to fake someone's signature. This seems like the claim that the USG will be unlikely to put it's Military on the line so they won't leak any tank designs on discord. Happy to concede that the CEO of DocuSign wouldn't do this but surely some 15$/h employee doesn't have that same op…