Our understanding is that DocuSign does not have any legal authority, they prove the chain of custody/modifications using digital traces which our solution can also do, arguably in a more open way.
If there’s a dispute over the veracity of a signature, it’s probably helpful to have a third party say “according to our server logs and software stack, this was signed by johndoe@example.com at 12:41pm on August 3rd, from the IP address XX.XXX.XXX.XX, and they authenticated with their email and password”. If I’m self-hosting, it’s marginally less convincing when I’m before a court if I say *my* software stack says that, since I have more direct control over it.
So, I agree DocuSign doesn’t have a special status, other than being a relatively neutral third party to that dispute. But if a signature’s validity is being questioned, that third party status is probably somewhat helpful.
Disputes over eSignatures come up allllll the time. And if you mention that it was "DocuSigned"... although you have done nothing aside from name-dropping... it will essentially end the dispute. Not saying that it should. Just saying that it does.
Edited to add: mild disclosure, I’m working on a product that has e-sign as a feature. It’s not really the main thrust of the application, but probably worth mentioning here.
These are the regulations you’ll want to adhere to in order to provide parity with digital signature authority of traditional commercial providers (in the US at least).
Great work btw!
(Not an attorney, not your attorney, but happy to chip in fiat so you can consult with counsel and obtain an opinion letter from one in support of your project)
So, if you look at e-sign, UETA, and NY’s Electronic Signatures and Records Act, then you have fairly comprehensive coverage across the US.
Also not an attorney, and this is also definitely not definitive legal advice!
Edit: I suppose in all except the free self hosted one, OpenSign would be the trusted third party, which I guess is more plausible. Unless the paid customers are given something close to root to administrate them. Still, a trusted third party is generally based on recognition. Even if I really dislike a company I eventually acknowledge they're trusted if it lasts long enough, like with ID.me. I didn't use ID.me until it was required for logging into the IRS and now I grudgingly admit that I think it's an extra security check on logging in. So until you're big like DocuSign I wouldn't view you in quite the same way as a trusted third party.
That does bring a question, are your paid customers prevented from going under the hood in such a way that they would also have to be trusted at such a level along with OpenSign?
--
This to say I'm open to using OpenSign, because there are plenty of uses where I would be open to using something that doesn't have this "trusted third party at the level of DocuSign" feature. The "digital notary public" analogy is apt. I sometimes sign documents with a notary, and other times without.
So that leaves the challenge of becoming a well known trusted third party, which is a challenge but doable.