DocuSeal vs Documenso: Self-Hosted E-Signature on a European VPS

DocuSeal vs Documenso comes down to this: both are AGPL-3.0 e-signature tools you can run on your own server, and in our lab on 29 October 2026 DocuSeal signed a document with about 210 MB of RAM in its app container while Documenso needed about 580 MB. DocuSeal (Ruby on Rails, 18,926 GitHub stars) is lighter and quicker to set up; Documenso (TypeScript, 15,601 stars) seals PDFs with a PKCS#12 certificate you generate or buy yourself, and its signature verified as a valid PAdES signature in pdfsig. Either one on a KVM VPS in Amsterdam, Dublin or Prishtina keeps your contracts off a US SaaS platform, which is the question that brought most readers here.

Key facts, checked on 29 October 2026:

• DocuSeal: 18,926 stars, AGPL-3.0 with "Section 7(b) Additional Terms", release 3.3.4 on 26 October 2026 (GitHub). Documenso: 15,601 stars, AGPL-3.0, release v2.21.1 on 22 October 2026 (GitHub).
• DocuSeal's free on-premises edition covers e-signature, unlimited retention, users, multiple signers and your own SMTP; SSO/SAML, bulk send, reminders, white-label, API and embedding are Pro, at $20 per user per month or $240 per user per year billed annually (DocuSeal pricing).
• Documenso's self-hosted Community Edition is free; SSO portal, passkey or 2FA re-authentication, CSC signing for AES and QES, 21 CFR Part 11, embedded editor and white-label need a Business or Enterprise licence (licence docs); the Business Edition is a "Fixed Yearly License" with no public price (self-hosted page).
• Documenso asks for "At least 2GB of available RAM" (Compose guide); DocuSeal publishes no figure and runs on SQLite by default, PostgreSQL or MySQL via DATABASE_URL (README).
• Under eIDAS an electronic signature "shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the grounds that it is in an electronic form"; only a qualified signature has "the equivalent legal effect of a handwritten signature" (Article 25, Regulation (EU) No 910/2014).

What we actually ran

One Debian 13 container limited to 3 GiB of RAM and 2 vCPUs, Docker inside, the two tools one after the other. Each got its official Docker Compose file with PostgreSQL plus a Mailpit container as a mail sink, so invitations really went over SMTP but never left the lab. For each we created the admin account, uploaded a one-page test PDF, placed a signature field, signed from the recipient's link in a separate browser session, downloaded the result and checked it with pdfsig from poppler-utils.

From docker stats: DocuSeal's app used 165.7 MiB idle and 209.1 MiB after signing, PostgreSQL 18 at 52 MiB; Documenso's used 541.6 MiB idle and 583.9 MiB after signing, PostgreSQL 15 at 68 MiB. Images: 837 MB plus 650 MB for DocuSeal, 2.19 GB plus 633 MB for Documenso. After one signed document each database held 67 MB; Documenso stores the PDFs inside PostgreSQL by default. Add roughly 200 to 300 MB for Debian 13, Docker and a proxy.

DocuSeal

The official docker-compose.yml has the app, PostgreSQL 18 and Caddy, which fetches a TLS certificate for HOST on its own. The lab had no public domain, so we removed Caddy, added Mailpit and set SMTP_ADDRESS, SMTP_PORT, SMTP_FROM and SMTP_DOMAIN. The app answered within a minute with a setup form for the admin user, company and public URL. The first invitation failed with STARTTLS is not supported on this server (Net::SMTPUnsupportedCommand): DocuSeal insists on STARTTLS unless SMTP_ENABLE_STARTTLS=false, which Mailpit needed and a real relay on port 587 does not.

Templates are built in the browser: upload the PDF, drag a "Signature" box onto the page, save, "Send to recipients". The signer draws, types or uploads a signature and clicks "Sign and complete"; the result is a signed PDF plus a one-page audit log with both file hashes, the signer's address and event times. On the free edition's API, listing templates and submissions and re-sending invitations worked; creating a template from a PDF did not:

# as a normal user, with the key from Settings > API
curl -s -X POST http://localhost:3000/api/templates/pdf \
  -H "X-Auth-Token: $KEY" -H "Content-Type: application/json" --data @tpl.json

{"status":404,"message":"This feature is available in Pro Edition: https://www.docuseal.com/pricing"}

That matches the pricing page, where API and embedding are Pro features. If your CRM should push contracts into the signing tool by itself, budget for Pro or look at Documenso, where the API is free.

Documenso

Documenso needs a signing certificate before it starts, created on the host, never inside the container. The commands from the local certificate guide, with a subject added so we would recognise it later:

# as root
openssl genrsa -out private.key 2048
openssl req -new -x509 -key private.key -out certificate.crt -days 365 -subj "/C=NL/O=RS Lab/CN=RS Lab e-signature"
openssl pkcs12 -export -out /opt/documenso/cert.p12 -inkey private.key -in certificate.crt
chown 1001:1001 /opt/documenso/cert.p12 && chmod 400 /opt/documenso/cert.p12
rm private.key certificate.crt

The export password goes into NEXT_PRIVATE_SIGNING_PASSPHRASE; user 1001 is the app's user inside the container. Then download the official compose.yml, write a .env with database credentials, three secrets from openssl rand -base64 32, NEXT_PUBLIC_WEBAPP_URL and the SMTP values, and start:

# as root, in /opt/documenso
curl -O https://raw.githubusercontent.com/documenso/documenso/release/docker/production/compose.yml
docker compose --env-file .env up -d && docker compose logs documenso | grep -i migrat | tail -1

documenso-1  | All migrations have been successfully applied.

Expect about forty harmless warnings that optional variables "are not set". The browser calls the API at NEXT_PUBLIC_WEBAPP_URL exactly as written, so set the real https:// address before the first start; our first sign-up through a tunnel on the wrong port failed with "We were unable to create your account". Sign-up needs a confirmation link from the email. We uploaded the PDF with a token from Team settings through POST /api/v2/document/create (multipart: a JSON payload with the recipient and a SIGNATURE field, plus the file), then POST /api/v2/document/distribute; both returned 200 on the free edition. The signer's page opens a draw/type/upload dialog and ends with an "Are you sure?" box quoting the signature disclosure; Documenso then seals the PDF and appends a "Signing Certificate" page with sent, viewed and signed times, the authentication level (email), the device and a signature ID.

Who signs the PDF, and with what certificate

# as a normal user, poppler-utils installed, empty NSS database made with certutil
pdfsig -nssdir sql:/root/nssdb documenso-signed.pdf

Digital Signature Info of: documenso-signed.pdf
Signature #1:
  - Signature Field Name: Signature_1
  - Signer Certificate Common Name: RS Lab e-signature
  - Signer full Distinguished Name: CN=RS Lab e-signature,O=RS Lab,C=NL
  - Signing Time: Oct 29 2026 17:54:49
  - Signing Hash Algorithm: SHA-256
  - Signature Type: ETSI.CAdES.detached
  - Signed Ranges: [0 - 338644], [363222 - 363987]
  - Total document signed
  - Signature Validation: Signature is Valid.
  - Certificate Validation: Certificate issuer isn't Trusted.

"Signature is Valid" means nothing changed after sealing. "Certificate issuer isn't Trusted" is expected for a certificate we made ourselves; Documenso's docs say the same, no green tick in Adobe Acrobat, integrity still proven. For the green tick, the same pkcs12 -export command converts a certificate bought from a certificate authority, with -certfile chain.crt for the intermediates.

DocuSeal's PDF was different: pdfsig printed an empty signer name and "Unknown Validation Failure", so we pulled the signature blob out of the file and read it with openssl pkcs7 -print_certs:

subject=C=AT, O=DocuSeal, CN=DocuSeal
issuer=C=AT, O=DocuSeal, CN=DocuSeal Sub-CA

subject=C=AT, O=DocuSeal, CN=DocuSeal Sub-CA
issuer=C=AT, O=DocuSeal, CN=DocuSeal Root CA

subject=C=AT, O=DocuSeal, CN=DocuSeal Root CA
issuer=C=AT, O=DocuSeal, CN=DocuSeal Root CA

So the free DocuSeal generates a small private certificate authority on first start (the leaf's validity began at 17:33:55, the minute our container came up, and runs for a hundred years) and signs with it: self-issued like Documenso's default, with three links instead of one. DocuSeal's help page confirms that "DocuSeal On-Premises also generates its own signing certificate by default" and that you can replace it under Settings, E-Signature, "Upload Cert" with a .p12, .pfx or .der file (DocuSeal). We saw the button on the free edition but did not test an upload.

Documenso adds a csc transport that routes each signature through a Cloud Signature Consortium trust service provider, so the result can be an advanced or qualified signature under eIDAS; it needs an Enterprise licence and an RFC 3161 timestamp server (CSC docs). Not tested.

DocuSeal vs Documenso: the comparison table

Prices and feature lists are from the vendors' pages on 29 October 2026; the RAM figures are ours.

What the law gives a self-hosted signature

eIDAS defines three levels. A simple electronic signature (SES) is "data in electronic form which is attached to or logically associated with other data in electronic form and which is used by the signatory to sign" (Article 3(10)): a typed name, a drawn squiggle, a click with a log behind it. An advanced signature (AES) must meet Article 26: uniquely linked to and capable of identifying the signatory, made with data under the signatory's "sole control", and "linked to the data signed therewith in such a way that any subsequent change in the data is detectable". A qualified signature (QES) is an AES made with a qualified device and "based on a qualified certificate for electronic signatures" (Article 3(12)), which only a qualified trust service provider issues. Wording from the retained UK text, identical to the EU articles on EUR-Lex.

Out of the box both tools give you an SES with a strong audit trail and a seal that detects tampering, which covers most commercial contracts, offers, NDAs and HR paperwork under Article 25(1). It is not an AES by itself: the certificate belongs to the server, not the person, so "sole control" rests on your process (email access, optional SMS or 2FA) rather than cryptography. AES needs a trust service provider in the loop, as with Documenso's CSC transport; QES never comes from a self-hosted tool alone. National laws also reserve some documents for handwritten or qualified signatures, so check before moving property or employment paperwork online.

The UK kept eIDAS as retained law with the same Article 25 and an Article 24A that treats EU-qualified signatures as qualified in the UK (legislation.gov.uk). The US ESIGN Act of 2000 says a signature or contract "may not be denied legal effect, validity, or enforceability solely because it is in electronic form", with no levels (Public Law 106-229, section 101(a)). Kosovo has Law No. 08/L-022 on Electronic Identification and Trust Services in Electronic Transactions, described by the Ministry of Economy as aligned with eIDAS (Ministry of Economy, 18 November 2025), which also publishes the register of licensed trust service providers. We could not link the gazette text, so take this as a pointer, not legal advice.

The Cloud Act angle, honestly

The query that led here was "which signature provider offers Cloud Act-free hosting?". The US CLOUD Act of March 2018 (US Department of Justice) added 18 U.S.C. 2713, under which a provider subject to US law must preserve or disclose customer data "regardless of whether such communication, record, or other information is located within or outside of the United States" (govinfo). A US e-signature SaaS with an EU data centre is still a US provider. A DocuSeal or Documenso instance on a server in Amsterdam, Dublin or Prishtina run by RS Computers, a Kosovo company, is not: the data sits in a database you control, and a request for it goes through the courts of the country the server stands in, or through you.

What self-hosting does not solve: signers still get emails, so a US mail API puts those links in the US anyway; a certificate from a US certificate authority tells the issuer who you are, though not what you sign; and Documenso's compose file carries an optional PostHog analytics key you should leave empty. The rest is in our Cloud Act checklist for European hosting; for the documents before and after the signature, see the EU office stack guide and the Paperless-ngx archive guide.

Which plan for which team

VPS Nano (1 vCPU, 1 GB) is too small once Docker, PostgreSQL and a proxy are added, even for DocuSeal. VPS Micro (2 vCPU, 2 GB, 40 GB NVMe) runs DocuSeal with headroom and Documenso at the edge of its own 2 GB requirement. VPS Mini (4 vCPU, 4 GB, 80 GB NVMe) is the comfortable default for either. VDS Small (4 dedicated vCPU, 8 GB, 240 GB NVMe, 10 Gb/s) is for the archive stage, when thousands of sealed PDFs sit in PostgreSQL. VPS plans have shared vCPUs; VDS plans have dedicated ones.

For whatever runs next to it, the RAM requirements guide for self-hosted apps has measured numbers; plan details are on the VPS Netherlands page.

Running it properly

Reverse proxy and TLS

Both tools listen on plain HTTP on port 3000 and expect a proxy in front. DocuSeal's compose ships Caddy: run HOST=sign.yourdomain.tld docker compose up -d with DNS already pointing at the server. For Documenso, or one proxy for several apps, see the reverse proxy and free HTTPS guide; new to containers, start with Docker containers on a VPS. The email links are built from the public address you configure, so set it before anyone signs.

Email

Invitations, reminders and signed copies travel by email. Outbound port 25 is blocked on new RS Computers servers and opened on request via Telegram, with reverse DNS set from the client area or by asking us. We still recommend an authenticated relay on port 587, your existing mail server or a Mailcow setup, because a signing link in the spam folder is a contract that does not get signed. DocuSeal reads the SMTP_* variables shown above plus SMTP_USERNAME and SMTP_PASSWORD; Documenso uses NEXT_PRIVATE_SMTP_*.

Backups

The database is the product: lose it and the audit trail, sealed PDFs and templates go with it. Servers in Prishtina include free weekly backups, last two kept, restored with one click from the client area, plus an optional daily add-on. Amsterdam and Dublin servers do not include backups, so schedule a nightly pg_dump plus DocuSeal's ./docuseal folder or Documenso's .p12 and .env, pushed off the server as in the restic and MinIO guide.

Updates

Both ship often; the releases we tested were under ten days old. docker compose pull && docker compose up -d updates either. Dump first, because migrations only go forward, and pin a tag instead of latest if a surprise upgrade would hurt.

Frequently asked questions

Is DocuSeal or Documenso better for self-hosting?

DocuSeal is lighter (about 210 MB for the app after signing in our test against about 580 MB for Documenso) and quicker to set up; Documenso's free edition includes the REST API and webhooks and seals PDFs with a certificate you supply. Pick DocuSeal for people signing in a browser, Documenso for software that sends documents.

Is a self-hosted e-signature legally binding in the EU?

Yes, as a simple electronic signature under eIDAS Article 25(1): it cannot be rejected as evidence only because it is electronic or not qualified. It lacks the automatic "equivalent to handwritten" status of a qualified signature, which needs a qualified trust service provider. Most business contracts are signed at the simple level with a good audit trail.

Does self-hosting make my signatures Cloud Act-free?

It takes the signature platform out of US jurisdiction: the data lives on a server in Amsterdam, Dublin or Prishtina operated by a Kosovo company. It does not cover the email relay, the certificate authority or any US tool you connect through webhooks.

How much RAM do DocuSeal and Documenso need?

In our 29 October 2026 lab DocuSeal's app used 166 MiB idle and 209 MiB after signing, plus about 50 MiB for PostgreSQL; Documenso used 542 MiB idle and 584 MiB after signing, plus about 70 MiB, and its docs ask for 2 GB free. A 2 GB VPS runs DocuSeal comfortably; 4 GB is the sensible minimum for Documenso with a proxy.

Can I use my own signing certificate?

Yes with both. Documenso requires a PKCS#12 file from the start, self-signed or converted from a CA-issued certificate. DocuSeal generates its own chain on first start and accepts a .p12, .pfx or .der upload under Settings, E-Signature. A public CA certificate removes the "issuer isn't trusted" warning; a self-signed one still proves the document was not altered.

Start with the signature server

A KVM VPS in Amsterdam is the shortest path for European signers: our ping.pe test of 6 October 2026 put Frankfurt and London under 7 ms and Paris at 9.3 ms from that server. Dublin serves Irish and UK teams; Prishtina adds the free weekly backups and sits about 3 ms from Skopje on our network. VPS Micro for DocuSeal, VPS Mini for Documenso, VDS Small when the archive outgrows the database. Tell us which tool you are installing on Telegram and we will open port 25 or set reverse DNS for your mail relay.

← All articles