Generate and store electronic (digital) signatures

Question

I have a requirement for the web service I'm working on currently - users of the application can create contracts between them (downloadable via PDF) and sign these contracts digitally on the app.

At first I was searching for third-party API solutions that will help me with storing signatures and sign documents between users. But as I see such solutions like Docusign and Hellosign concentrate on a providing a bit different kind of service. Then I've read an article on difference between Digital and Electronic signature but I'm not yet sure what is the best kind of signature for the app.

What I'm looking for is a secure way to sign a pdf contract file for both users inside my application. The common app flow looks like that:

• user1 sends contract information on our server
• user2 sends contract information on our server
• server generates pdf file base on provided information, file can be previewed on the web/mobile client
• user1 and user2 can sign document on the web/mobile client (use some API here for digital/electronic signature? store signatures in our database?)
• after document is signed no changes can be made
• user1 can have several contracts so it will be handy to use his existing signature on the next docs

My main question here is it worth looking for third-party APIs or it will be safe enough to develop our own sign system? There are such open-source projects as https://github.com/szimek/signature_pad which can be used to generating signature image. Or create some kind of signature key to mimic digital signature and store inside app's database?

Any input will be highly appreciated as I'm new on this topic. Thanks!

P.S. Maybe CoSign can be an option but its' developer docs is offline for now.

Answer 1

If you're able to deliver a solid experience with legally binding contracts than your solution would probably be good enough to compete with the likes of Docusign etc... However, many companies would not want to hand roll a custom signing process which also add's legal complications if you expect this contract to offer something a little more substantial than a terms of service being checked.

Basically, Docusign has spent a considerable amount of wealth building, spreading and lobbying their product, to the point where it is now used by major fortune 500 companies for very important transactions which include insurance, deeds and medical documents.

I guess my point is, if you were going to go through all of that effort, why not have that be the product you're trying to build? To me, especially with most products I tend to build, it's not worth the effort and easier to pay a tried and true company like Docusign, but everybody's situation is different.