Self-Hosted Documenso: Open-Source DocuSign You Can Audit

Every contract workflow adds a silent third party: the company that hosts the "Sign here" button. You trust them to store PDFs, deliver email links, and not change terms when a renewal email hits finance. For NDAs, contractor agreements, and client SOWs, that trust is the product — not the drag-and-drop UI.

Documenso (~15k GitHub stars, AGPL-3.0) positions itself as the open-source DocuSign alternative you can self-host and audit. Upload a PDF, place fields, send signers a link, collect signatures with a proper signing certificate, and keep the audit trail on infrastructure you control. The hosted app at documenso.com exists; the point of the project is that you do not have to use it.

What Documenso actually does

Documenso is a full signing product, not a PDF toy:

• Templates and documents — reusable layouts with signature, text, date, and checkbox fields on PDFs
• Multi-signer flows — ordered recipients, email invitations, status tracking from draft to completed
• Signing cryptography — uses PDF signature tooling (PAdES-oriented stack with @libpdf/core and related libs); you provide a signing certificate (.p12) on self-hosted installs
• Team workspaces — org-style usage for agencies and internal legal ops
• Auth options — email/password, Google, Microsoft, OIDC; signup can be locked down per domain
• API — tRPC-based backend (Hono + Prisma) for integrations and automation

Signers use a browser link — no app install. The experience is closer to DocuSign than to emailing a PDF and asking for a scanned signature back.

Documenso vs DocuSeal (we've covered both families)

We already wrote about DocuSeal — excellent open-source signing with a strong form builder and API on Docker port 3000.

How we think about the split:

• DocuSeal — fast to deploy, Ruby-friendly teams love the embeddable components, great when you want template + API + webhooks with minimal ceremony
• Documenso — product polish, team/tenant model, and a narrative built around "open trust infrastructure"; TypeScript/React Router stack; heavier env surface (encryption keys, signing cert, NextAuth)

Both beat per-envelope SaaS pricing for a busy agency. Pick Documenso if you want the DocuSign-shaped team product and are willing to configure signing certs and Postgres properly. Pick DocuSeal if you want a leaner container and embedded signing in your own app. Some orgs trial both on staging — just do not run two signing systems in production without a policy.

Why self-host?

You become the trust provider. Documenso's own README frames the goal: signing tools should not be opaque black boxes. Self-hosting lets legal review the stack and your ops team own backups.

Canadian data residency. Signed PDFs, recipient emails, and audit metadata live in your PostgreSQL (and optional S3-compatible object storage) on a Canadian VPS — a clearer PIPEDA story than "our vendor is US-based but has a DPA."

No envelope tax. Cloud tiers and enterprise sales still exist for Documenso the company; self-hosted AGPL covers running the software without counting signatures against a SaaS meter.

SMTP you control. Signing invites come from your domain via your mail relay — fewer "why is this from documenso.com?" client questions when you white-label the webapp URL.

What running it takes

Production Docker Compose is documented under docker/production/compose.yml: documenso/documenso:latest plus PostgreSQL 15. Port 3000 by default.

Plan for real secrets, not demo defaults:

• NEXTAUTH_SECRET and encryption keys (NEXT_PRIVATE_ENCRYPTION_KEY, secondary key)
• NEXT_PUBLIC_WEBAPP_URL — public HTTPS URL signers see
• SMTP — required for production invites (transport, from address, credentials)
• Signing certificate — mount a .p12 at /opt/documenso/cert.p12 (see their signing certificate docs); understand what your jurisdiction expects for e-sign validity

Optional S3 upload transport for larger deployments. Disable public signup if this is internal-only (NEXT_PUBLIC_DISABLE_SIGNUP).

RAM: 2 GB minimum for app + Postgres on a small team; 4 GB comfortable under concurrent signers. Back up Postgres and the cert volume — losing the DB loses document state; losing the cert complicates future signatures.

AGPL-3.0 means network use triggers share-alike obligations if you modify and expose it as a service to third parties — fine for internal signing, talk to counsel if you embed it in a commercial product.

Who it's for (and who should skip it)

Good fit: agencies sending client contracts weekly, SaaS companies with a dedicated compliance story, teams outgrowing "email PDF + DocuSign login shared in 1Password."

Maybe skip it: one signature a quarter (use a notary or a simple tool). If you need qualified eIDAS QES across EU member states, validate whether self-hosted Documenso meets your bar — you may need a certified trust service, not just a nice UI. If you will not maintain Postgres, SMTP, and cert rotation, hosted documenso.com or DocuSeal's lighter ops might be saner.

Hosting it in Canada

We deploy Documenso-style stacks on Canadian Docker hosting — TLS termination, managed Postgres backups, and firewall rules so the signing app is not indexed or brute-forced on port 3000.

Tell us volume, auth method (Google vs OIDC), and whether documents need S3 — we'll size the box and walk through signing cert setup on first deploy.