Question 1

When should I use EndorsedSign instead of building signing myself?

Accepted Answer

If your requirements include multi-party envelopes, delivery with retries, audit trails that need to stand up under legal review, and signer flows that work on mobile without an account, building that from scratch is a multi-quarter effort. EndorsedSign ships it as a managed layer — tested, maintained, and ready to white-label. If your needs are genuinely simpler (single signer, no orchestration, no compliance requirements), a signature capture library may be enough.

Question 2

What does EndorsedSign handle that I would otherwise need to build?

Accepted Answer

Multi-party role routing (signer, approver, CC); signer identity verification (OTP, link delivery); envelope lifecycle state machine; delivery pipeline with retries and dead-letter queue; hash-chained audit trail; certificate of completion; HIPAA-safe notification content; RBAC across ~60 named permissions; webhook lifecycle events with replay; and a React embed component for in-product signing. Each of these is non-trivial to build and maintain independently.

Question 3

What do I still own and control?

Accepted Answer

Your product shell, your customer relationship, your domain and branding. EndorsedSign runs under your name on your signing domain. You control who is invited to sign, in what order, under what brand, and where completed files land. We do not contact your customers and do not have a relationship with them.

Question 4

Does EndorsedSign replace a signing suite like the ones end-users buy directly?

Accepted Answer

No, they serve different use cases. Suite products (sold to end-users with a full portal experience) and EndorsedSign (embedded into your product) operate at different layers. You would choose EndorsedSign because you want signing to appear as a native capability of your product, not because you want a third-party portal your customers visit.

Question 5

How is pricing set?

Accepted Answer

Pricing depends on integration depth, envelope volume, and whether you need features like the HIPAA profile, custom domains, or headless SDK controls. Plan structure is consistent, and final pricing is published from platform settings and commercial terms.

Question 6

How do I get a sandbox environment?

Accepted Answer

Sandbox tenants are self-serve. POST /api/auth/register with `mode: sandbox` and the response returns your tenant, an API key, and a seeded demo signer in one call. See the Quickstart for the full walk-through.

Question 7

Is there a free tier or trial?

Accepted Answer

The sandbox is free for development and evaluation, and production trials are available based on published plan controls. If you need extended evaluation time, contact the team.

Question 8

What happens to my data when plans or pricing change?

Accepted Answer

Your data remains in your tenant and you retain access. Pricing and plan changes are communicated ahead of effective dates according to your agreement terms.

Question 9

What integration paths are available?

Accepted Answer

Three: REST API + Elements React embed (signer UI rendered inside your product), REST API + headless SDK (you build every pixel of the signer UX), or REST API only (you build the signing interface from scratch). Most partners start with the embed and evaluate headless only when a specific UI requirement cannot be satisfied by embed theming.

Question 10

How long does a typical integration take?

Accepted Answer

A basic flow — create an envelope, invite a signer, receive the completed webhook — takes a few hours in the sandbox. A production-ready integration with your own branding, webhook handler, and error handling takes most teams one to two weeks. Full embedding with custom UI typically takes two to four weeks.

Question 11

Does the embed work in an iframe or does it need to be same-origin?

Accepted Answer

The Elements embed renders on your domain. You register your origin in the dashboard and the embed respects that allowed-origin control. There is no same-origin restriction for the embed — it is designed for multi-origin product architectures.

Question 12

What languages are the client SDKs available in?

Accepted Answer

TypeScript, Python, and .NET. All three are generated from the OpenAPI spec and ship typed request models. If your stack uses a different language, the REST API is straightforward to call directly — correlation IDs, versioned resources, and standard bearer authentication.

Question 13

How do webhooks handle delivery failures?

Accepted Answer

Webhooks are queued with automatic retries across an exponential backoff schedule. Undeliverable events move to a dead-letter queue rather than being dropped silently. You can inspect failed deliveries in the developer console and replay them without re-triggering the production flow that generated them.

Question 14

Can I test webhooks locally during development?

Accepted Answer

Yes. You can register a localhost URL in the sandbox for development. The developer console shows all delivery attempts, the request payload, and the response — so you can debug without needing a public endpoint.

Question 15

Who owns the documents and signing records?

Accepted Answer

You do. Completed documents and audit records are held by EndorsedSign on your behalf inside your tenant boundary. We process them to provide the service; we do not use your documents or your signers for our own purposes. Data processing terms are in the Data Processing Addendum on the trust centre.

Question 16

Can I use EndorsedSign for HIPAA-covered workflows?

Accepted Answer

Yes, with the HIPAA profile enabled and a signed Business Associate Agreement in place. The HIPAA profile enforces PHI-safe notification content (links only — no PHI in email or SMS), a two-person deletion confirmation gate, and extended retention. You must enable the profile and execute the BAA before sending any protected health information through the platform.

Question 17

Does EndorsedSign hold a SOC 2 report?

Accepted Answer

Yes. EndorsedSign maintains a SOC 2 certification report and shares it through procurement and security review channels.

Question 18

Where is data stored and processed?

Accepted Answer

In the EU and US depending on the function. EU-only data residency is available for eligible plans and regulated workflows.

Question 19

How is tenant isolation enforced?

Accepted Answer

Every tenant-owned record carries a tenantId index that is checked on every read and write at the application layer. A valid token from one tenant cannot retrieve records from another. Tenant isolation is enforced at the application layer, not only by network segmentation.

Question 20

Can I export my data if I stop using EndorsedSign?

Accepted Answer

Yes. You can export all documents, audit records, and customer data from your tenant at any time. On termination, you have a window to export before data is subject to your configured retention policy. The Data Processing Addendum on the trust centre describes the deletion and return process.

Question 21

Can I use QES (qualified electronic signatures) today?

Accepted Answer

Yes. QES can be enabled for supported jurisdictions and compliance workflows, with tenant-level policy controls.

Question 22

Is SAML single sign-on available?

Accepted Answer

Yes. OIDC and SAML are both available for staff authentication, depending on your identity provider setup.

Question 23

Can I self-host EndorsedSign?

Accepted Answer

EndorsedSign is delivered as a managed hosted service. Infrastructure and residency controls are configured through supported enterprise deployment options.

Question 24

Does EndorsedSign support multi-tenancy in a SaaS platform context?

Accepted Answer

Yes, this is a primary use case. The platform track in the partner program is designed for SaaS products that serve multiple downstream tenants. Each downstream tenant gets isolated document storage, branding, and user access. Usage boundaries and billing aggregation are handled at the integration layer.

FAQ

Build vs buy

Pricing and access

Integration and technical

Data, security, and compliance

Feature availability

Question not answered here?