How signing works

The full signing flow takes about 60 seconds once you know where to click. Here's every step from "I have a PDF" to "this is legally signed."

1. Upload your PDF

Go to Sign → New (or click New document on the dashboard). Drag any PDF onto the upload zone or pick one from your computer. The PDF is scanned for malware and bad content before we accept it (a sanitizer that catches malicious JavaScript embedded in PDFs, since some PDFs can carry payloads). You'll see a thumbnail appear in seconds.

2. Place the signature fields

Once your PDF is uploaded, you see a preview with a sidebar of field types on the right:

• Signature — the signer's drawn or typed signature
• Date — auto-fills with the signing date
• Text — short free-form text (e.g. printed name)
• Checkbox — yes/no toggles
• Initial — a smaller signature (used at the bottom of every page in some agreements)

Drag fields from the sidebar onto the page where each signer needs to fill something in. You can resize and move them precisely. The view stays zoomable so you can place fields next to small lines like "Date: ____" without guessing.

3. Add signers

For each field you placed, assign it to a signer. Add signers by name + email — they don't need a SIGNFILE account. A single document can have up to 20 signers on the Starter plan and unlimited on Pro and Team.

If you want signers to complete the document in a specific order (e.g. manager before employee), enable Signing order in the wizard. Without it, all signers can sign in parallel.

4. Send

Hit Send. Each signer gets an email with a personal link like https://signfile.io/sign/AbC123dEf.... The token is a 20+ character random string that can only be used once per signer.

5. Signers open the link and sign

This is the part most people find surprising: signers don't need to create an account. They click the link in their email, see the PDF in their browser, and either:

• Type their name (the system renders it in a signature-style font), or
• Draw their signature with a mouse / trackpad / touchscreen

They hit Submit and they're done. The page can be opened on phone, tablet, or desktop — the field UI adapts.

If the signer closes the tab by accident, they can re-open the same link and continue where they left off (we track partial state in a signing lock row).

6. Webhook fires, document completes

As soon as the last signer submits (or each signer submits, if signing-order is off), our backend:

1. Stamps the signed PDF by overlaying the signature values onto the original PDF.
2. Stores the signed copy in a separate storage bucket.
3. Generates a Certificate of Completion (the legal artifact). It captures: each signer's name + email, their IP address, their user agent, and the timestamp they signed at.
4. Fires a document.signed webhook (if you have one configured — see Settings → API).
5. Emails the document owner letting them know it's done.

7. Download

The owner (and any workspace member with the right role) can download:

• The signed PDF — from /sign/detail/<doc-id> or via the dashboard
• The Certificate of Completion — from the same page (members-and-up only)

Every viewer can see the document is signed. Only members can download the certificate (since the certificate includes the signers' IP addresses, which we treat as PII).

What if a signer refuses or doesn't reply?

The document stays in pending state indefinitely. You can:

• Resend the signing email from the document detail page
• Void the document (cancels all pending signing links)
• Reassign a signer (rotate the signing token without re-uploading the PDF)

There's no automatic expiry on signing links by default — the link stays valid until you void the document. If you want a deadline, set an expiry date when you send the document.

Common questions

Can a signer edit someone else's field? No. Each field is bound to a specific signer's email. If they try to interact with a field assigned to someone else, the field is read-only for them.

What if two people sign at exactly the same time? Each document has a signing lock per signer that prevents concurrent-stamp races. The second signer's submission queues briefly; if the document has been voided in the meantime, the second signature is rejected.

Can I undo a signature? No — once a signature is submitted, it's stamped on the PDF and stored as the legal record. To "change" a signature, you void the document and re-send a fresh copy.

Still stuck? Contact support.

Plans and billing

Four plans, no hidden fees, no per-document overage charges. You can switch plans or cancel any time.

At a glance

Annual = "2 months free" — you pay for 10 months and get 12.

What happens when you upgrade

Upgrades apply immediately and you pay the prorated difference for the rest of the current billing cycle. So if you're on monthly Starter ($9) at day 15 of a 30-day cycle and switch to Pro, you pay roughly $5 (half the $10 monthly difference) and your next full charge is $19 on day 30.

Upgrades go through Dodo Payments' hosted checkout. You'll enter your card details on their hosted page (we never see your card number), they confirm the charge, and the webhook updates your workspace within a few seconds. You'll see the new plan reflected in Settings → Billing without a page refresh.

What happens when you downgrade

Downgrades are scheduled for the end of your current billing cycle. You keep full access to the higher tier until then. The dashboard shows a banner: "Switching to Starter on Aug 14, 2026." with a one-click Cancel change if you change your mind.

You don't get a refund for the unused portion of the current cycle — that's the industry standard (Stripe, Notion, Linear all do this). You're paying for the access window you've already had.

Auto-renew

By default, subscriptions auto-renew. You can turn this off at Settings → Billing → Current plan → Auto-renew. When auto-renew is off:

• Your access continues until the end of the current billing cycle
• On that date, your workspace moves to Free
• You can re-enable auto-renew any time before that date

There's no separate "pause" option — pause is functionally equivalent to "turn off auto-renew and let it expire." If you want a subscription later, just re-subscribe from the billing page.

Cancel

The Cancel plan button on the billing page opens a confirmation dialog asking why you're leaving (the answer helps us prioritize what to fix). On confirm:

• Your subscription is set to cancel at the end of the current cycle
• A persistent banner appears: "Your Pro plan is cancelled. You'll keep Pro access until Aug 14, then your workspace moves to Free."
• Dodo sends you a confirmation email
• We don't auto-delete any of your documents — they remain available on Free (with the per-month limits)

There's also an immediate cancel path used by support (refunds / proration are Dodo's responsibility) — that's not exposed in the UI but the route supports it.

Invoices and receipts

Every successful payment fires a payment.succeeded webhook that sends you a branded receipt email with the amount, plan, and next-billing date. The receipt is deduplicated per charge — if Dodo retries the event, we don't send a second email.

To download a PDF invoice or update your card, click Update card or Download invoices on the billing page. Both open Dodo's hosted customer portal (a redirect, but it gives you access to your full payment history and lets you change cards without us handling any card data).

Taxes and billing address

Dodo Payments collects applicable taxes (VAT, sales tax) at checkout based on the billing address you enter. The receipt reflects the tax line item. If you need a different billing address (e.g. for an expense report), update it in Dodo's portal — the next charge will use the new address.

Common questions

Do you offer custom enterprise plans? Not yet — Team with extra seats is the highest tier. If you need > 200 seats or custom contract terms, email support@signfile.io.

Can I get a refund? Pro-rated refunds aren't automatic (the cancel-at-period-end flow doesn't refund unused time). For exceptional circumstances, contact support.

What currency are prices in? USD only at the moment. International card support is automatic — your bank handles the FX.

Does the Free plan ever expire? No. Free workspaces stay on Free forever. You only get billed if you upgrade.

Can I switch between monthly and annual? Yes — same upgrade/downgrade flow, applies at end of cycle. Annual is a "downgrade" if you're on monthly, an "upgrade" if you're on annual and switch to monthly (so the monthly switch takes effect at period end and you keep annual access until then).

Still stuck? Contact support.

Security and audit trail

We hold legal documents — employment contracts, NDAs, vendor agreements, healthcare intake forms. The security and legal-enforceability story matters as much as the UX. Here's what's under the hood.

Legal compliance

SIGNFILE signatures are legally binding under:

• ESIGN Act (US, 2000) — federal law giving electronic signatures the same legal effect as wet-ink ones
• UETA (US, 1999) — uniform state-level adoption
• eIDAS (EU) — for European counterparties, qualified electronic signatures are recognized

The Certificate of Completion is the legal artifact that proves a signature was collected — it captures the signer's IP, user agent, and timestamp, which is the standard evidence package for any later dispute.

Caveat: SIGNFILE signatures are not currently a Qualified Electronic Signature under eIDAS. For EU regulatory filings that require QES, you'd still need a national eID provider. We're working on integration but it's not live.

Data at rest and in transit

• In transit: TLS 1.2+ on every connection. The dashboard, API, and signing pages all enforce HTTPS — the auth flow will not work over plain HTTP.
• At rest: PDFs are stored in Appwrite Cloud's region-locked buckets. Our deployment is in the Frankfurt (fra.cloud.appwrite.io) region. Bucket encryption is enabled at the platform level (set true in app/api/setup/route.ts for both buckets).
• Database: Appwrite's managed database, also region-locked to Frankfurt.

Session and authentication

• Session cookies are HttpOnly + Secure + SameSite=Lax — JavaScript cannot read them, they're only sent over HTTPS, and they're not sent on cross-origin POSTs (which blocks most CSRF).
• Password hashing: bcrypt (Appwrite's default). We never store or log passwords.
• OAuth: Google sign-in is supported. Apple and Microsoft are not yet.
• MFA: TOTP (Time-based One-Time Password) is supported via the Appwrite account settings. We don't force-enable MFA by default but we strongly recommend it for accounts that handle sensitive documents.
• Rate limiting: auth endpoints (login, signup, password reset) are rate-limited per IP and per email. Email verification requests are capped at 5 per hour per address.

What the audit trail records

Every state-changing action on a document writes a row to the audit_events collection. The schema captures:

• event — what happened (e.g. document.created, document.signed, document.voided, signer.added, signer.signed)
• document_id — which document
• signer_id — which signer (when applicable)
• user_id — which user (the document owner for owner actions, or empty for public-signer events)
• caller_role — the user's workspace role at the time of the event (owner / admin / member)
• ip_address — captured from the request (45 char cap, IPv4 or IPv6)
• user_agent — captured from the request (500 char cap)
• $createdAt — Appwrite's automatic timestamp

The audit trail is append-only — there's no API path that updates or deletes an audit_events row. Once written, it stays.

The audit trail is the primary mechanism for the Certificate of Completion: when the owner downloads the cert, we render the relevant rows as the legal record.

Who can see what

Roles within a workspace are enforced server-side. The matrix:

Cross-workspace access is impossible — every API call carries an X-Workspace-Id header that the server checks against the caller's memberships. Sending a header for a workspace you don't belong to returns 404 (no info leak about whether the workspace exists).

What we DON'T do

• No key escrow — we can't recover a document if you lose your account password AND don't have a recovery email. Set up MFA and a recovery email.
• No raw card data — payments go through Dodo Payments. We never see, store, or transmit card numbers. PCI compliance is on Dodo.
• No training on your documents — we don't use your signed content to train any AI model, and we have no third-party integrations that do (Sentry gets error stack traces; that's it).
• No data resale — we don't sell or share your data with third parties. Our sub-processors are listed at /legal/sub-processors for transparency.

Compliance certifications

Current state:

• GDPR — full compliance posture (data export, account deletion with 14-day grace period, sub-processor disclosure, DPO contact)
• CCPA — full compliance posture (right to know, right to delete, opt-out of sale — we don't sell data)
• SOC 2 — not yet. We're below the threshold that requires it for most SMB customers, but it's on the roadmap for when we land enterprise.

We're happy to answer detailed security questionnaires from prospects — email support@signfile.io with your security review template.

Common questions

Where do you store the data? Frankfurt, Germany. We don't replicate to US regions.

Can I get a data processing agreement (DPA)? Yes — it's at /legal/dpa (and signed automatically when you accept terms at signup).

Can I use SIGNFILE for HIPAA-covered documents? We don't have a signed Business Associate Agreement (BAA) yet. If you need HIPAA, contact support to discuss.

What's your uptime SLA? Free and Starter: best-effort. Pro and Team: 99.9% (we're tracking toward this; a public status page is on the roadmap).

Still stuck? Contact support.

Common errors and how to fix them

The same handful of issues account for the majority of support requests. Here they are, ranked by frequency, with the fix for each.

1. "Your card was declined" after checkout

What you see: After entering your card on Dodo's hosted checkout, you get bounced back to /settings/billing with a red banner: "Payment failed. Please try a different payment method."

Why it happens: Your bank rejected the charge. Common reasons:

• Insufficient funds
• Card flagged for fraud protection (especially common on first-time international charges)
• Prepaid card that doesn't support online recurring payments
• Card expired since you last used it

The fix:

1. Try a different card
2. If your card is being declined as "international" or "suspicious," call your bank and authorize the charge, then retry
3. If you're on a corporate card, your finance team may need to whitelist Dodo Payments as a vendor

If you keep seeing this in test mode: Make sure the test-mode Dodo products and your test card are configured correctly. The test card 4000000000000002 always declines — it's the standard Stripe-style "test a decline" card. Use 4242424242424242 for a successful test charge.

2. "This page isn't working" / HTTP 500 after clicking Sign

What you see: A blank page with "signfile.io is currently unable to handle this request" or a 500 error after clicking a button on the dashboard.

Why it happens: Usually a transient backend error (Appwrite timeout, Dodo API hiccup, Sentry rate limit). Less commonly: your session cookie expired while you were on the page.

The fix:

1. Hard-refresh (Cmd/Ctrl-Shift-R) — clears stale state
2. Sign out and sign back in — refreshes the session cookie
3. If it persists for more than 5 minutes, check our status page (coming soon) or just retry later
4. If you can reproduce it consistently, contact support with what you clicked and what browser you're using

3. "Sign token not found" or "This signing link has expired"

What you see: A signer clicks the link in their email and lands on an error page saying the token doesn't exist or has expired.

Why it happens:

• The document was voided by the owner before this signer signed (the token is invalidated when the doc is voided)
• The signer is opening an old link from a previous version of the document (e.g. the owner re-sent the document after editing it)
• The signing token was rotated (e.g. the owner reassigned the signer)
• Rare: the link was opened on a different device than the original

The fix (for the signer): Ask the owner to resend the signing email from the document detail page. The new email has a fresh, valid token.

The fix (for the owner): From the document detail page, click Resend next to the signer's row. They'll get a fresh email with a new link.

4. "You don't have permission to void this document"

What you see: Owner or admin clicks Void on a document and gets a 403 with this message.

Why it happens: Role check on the void endpoint:

• Members can only void their own documents (where they're the owner)
• Viewers can never void
• Admins can only void documents that have no signatures yet (once any signer has signed, only the owner can void)

The fix:

• If you're a member trying to void someone else's document: ask the document owner or a workspace admin
• If you're an admin trying to void a partially-signed document: ask the workspace owner
• If you're a viewer: viewers are read-only by design; ask someone with a higher role

5. "Upload rejected: PDF failed security scan"

What you see: After dragging a PDF to the upload zone, you get a red banner saying the PDF failed the security scan.

Why it happens: Our PDF sanitizer (which runs on every upload) detected content that violates our security policy. Common triggers:

• PDFs with embedded JavaScript (a known malware vector)
• PDFs with external references (fetching remote content when opened)
• PDFs that fail our magic-byte signature check (not actually a PDF, just renamed)
• Some legitimate PDFs created by older versions of Adobe Acrobat that include auto-execute actions

The fix:

1. Re-save the PDF: Open it in any PDF editor (Preview on Mac, Adobe Acrobat, Chrome's built-in viewer) and "Save as PDF" or "Print to PDF." This usually strips the embedded scripts.
2. Try a different source PDF: If you generated the original from a tool like Microsoft Word or Google Docs, re-export it directly from there.
3. Contact support with the file: if you genuinely need this specific PDF signed and the re-save doesn't help, send it to support@signfile.io and we can manually review whether the embedded content is actually malicious or a false positive.

Other things that look like errors but aren't

"Document is locked" during signing — this is intentional. Each signer's session holds a per-document lock that prevents two people from signing the same field simultaneously. If you see it persistently, your previous session may not have closed cleanly. Re-open the link from your email.

"Workspace already has a subscription" when upgrading — your workspace already has an active Dodo subscription. Use the Switch button on the billing page instead of going through checkout again.

"No file chosen" after selecting a PDF — usually the file picker dialog opened in a different window that lost focus. Click the upload zone again to re-open it.

Still stuck?

If your error isn't listed here, contact support — include what you were trying to do, what you clicked, and what you saw. The form auto-captures your browser, plan, and recent activity so we can triage without a back-and-forth.