Documenso vs Docuseal vs OpenSign: Self-Hosted Document Signing on VPS in 2026

I spent the last three months running Documenso, Docuseal, and OpenSign side-by-side on the same Hetzner CPX21 VPS (3 vCPU, 4 GB RAM, $9.42/month) to figure out which one I would actually trust for client agreements at Warung Digital Teknologi. Over 11 years of IT consulting and 50+ shipped projects, I have signed every kind of contract there is — from NDAs for our Photography Studio Manager rollouts to Smart HR Payroll service deals — and Docusign at $40/user/month became impossible to justify when I started seeing the same eSignature feature set in open-source repos with five-figure GitHub star counts.

This article is the honest write-up I wish someone had handed me before I lost a weekend on PKCS#12 certificate generation. I will tell you which stack I picked, which one I uninstalled within 48 hours, and the specific RAM and disk numbers I measured during the test. No marketing fluff — just three open-source eSignature platforms, three deployment runs, and the tradeoffs you only see when the second signer hits a 502 because the Node process died at 2 AM.

Why I Stopped Paying for Docusign

At Wardigi, our team of three runs about 18 active client engagements at a time. With Docusign Standard at $40/user/month, we were paying $1,440 a year for what is, at its core, a PDF-with-fields-and-an-audit-log workflow. When Documenso hit 6,200 GitHub stars and Docuseal crossed 11,700, the open-source maturity story finally caught up to the commercial vendors.

The trigger event was a contract renewal with a hospitality client (the one whose Hotel Management Suite we shipped in late 2025). Their compliance officer asked us to keep all signed agreements in our own infrastructure for GDPR-style reasons. Self-hosting was no longer a "nice to have." It became a procurement requirement.

So I picked the three most active open-source options on GitHub as of May 2026 — Documenso, Docuseal, and OpenSign — and gave each one a one-week production trial on an identical VPS.

The Three Contenders in 30 Seconds

Documenso is the polished one. Built on Next.js 14, TypeScript, PostgreSQL, and Prisma. Heavy emphasis on cryptographic signing via PKCS#12 certificates. AGPL-3.0 license. The cloud version starts at $30/month for individuals, but self-hosting is free unless you want their enterprise support contract ($30,000/year, which is wild for a 3-person agency but priced for Fortune 500 procurement teams).

Docuseal is the practical one. Ruby on Rails backend, SQLite by default (PostgreSQL optional), shockingly few moving parts. Docker image is a single container — docuseal/docuseal:latest — and the self-hosted open core covers 80% of what most teams need. The Pro plan unlocks SMS verification, SSO/SAML, white-labeling, and API embedding at $20/user/month.

OpenSign is the most generous. AGPL-3.0, free, no Pro tier paywalling features. MERN stack (MongoDB, Express, React, Node.js) running on Parse Server. Has audit trails, OTP verification, Zapier integration, and tamper-evident completion certificates out of the box.

Feature Comparison Table

Feature	Documenso	Docuseal	OpenSign
License	AGPL-3.0	AGPL-3.0	AGPL-3.0
GitHub Stars (May 2026)	~12,400	~11,750	~6,200
Stack	Next.js + Postgres	Rails + SQLite/Postgres	Node + MongoDB + Parse
Default DB	PostgreSQL (required)	SQLite (works fine for <5k docs)	MongoDB (required)
Docker single-container?	No (app + DB)	Yes	No (3 services)
PKCS#12 cryptographic sign	Yes, native	Yes (Pro)	Limited
SMS / OTP verification	Email OTP only (free)	SMS in Pro plan	Email + OTP free
SSO/SAML	Enterprise only	Pro $20/user/mo	Free
API access	Free, SDK in TypeScript	Pro plan	Free, REST
Webhooks	Yes	Yes (Pro)	Yes
Templates	Yes	Yes (best UI)	Yes
Audit trail in PDF	Yes, embedded	Yes, embedded	Yes, with completion certificate
Min RAM (idle)	~410 MB	~180 MB	~520 MB
Bulk send	Yes	Pro plan	Yes
Setup time (clean Docker)	22 min	4 min	14 min

Hands-On: Resource Footprint on a 4 GB VPS

I ran each platform under docker stats with one test user, three template documents, and a synthetic load of one signing flow every 10 minutes for 72 hours. Here are the measured numbers from my test:

• Documenso — idle RSS sat at 410 MB across the Next.js process and Prisma client; with PostgreSQL (managed externally on the same box) the combined footprint was 640 MB. Under load it spiked to 1.1 GB briefly while generating signed PDFs with embedded certificates. CPU was negligible (3-5%) except during PDF rendering.
• Docuseal — the most efficient by a wide margin. Idle at 180 MB in single-container mode with SQLite. Under the same synthetic load it never crossed 320 MB. I can see why people are running this on $5/month VPS boxes with no swap and surviving.
• OpenSign — heaviest. The Parse Server + MongoDB combo sat at 520 MB idle, climbing to 980 MB under load. MongoDB alone uses about 280 MB when largely empty, which is a known characteristic of WiredTiger's default cache.

For context, the 7 aggregator sites I run for OpenClaw (CloudHostReview being one of them) all live on a single Hostinger Cloud Business plan with 4 GB RAM. If I were colocating an eSignature service on that same box, Docuseal is the only one that would not noticeably move the needle. Documenso would be fine on its own VPS. OpenSign would push me toward a 6 GB plan.

Documenso: When Polish and Crypto Matter

Documenso wins on three things that matter for legal-grade signatures: native PKCS#12 certificate signing, a clean signing experience for your recipients, and the strongest developer SDK of the three.

The PKCS#12 piece is the underrated feature. When you upload your signing certificate (the same kind eIDAS-qualified providers issue), every signed PDF gets a cryptographic signature embedded that Adobe Reader will display with a green checkmark. That visual cue matters more than I expected. When I sent test contracts to two non-technical clients, both noticed the "Signed and all signatures are valid" banner immediately — neither had ever seen that on a Docusign PDF.

The signing UX is also the cleanest of the three. No "powered by" badges, no awkward modal sizing on mobile, fonts that match the rest of your brand. Documenso's team obsessed over this and it shows.

The downsides are operational. PostgreSQL is mandatory, the env config has about 22 mandatory variables on first boot (encryption keys, NEXTAUTH_SECRET, certificate paths, SMTP host), and you need to mount your cert.p12 into the container before signing works. I burned about 90 minutes on a misconfigured cert that resulted in "Invalid signature" errors with no useful logging until I bumped the log level. If you have not handled OpenSSL CSR generation before, budget two evenings.

I would pick Documenso when: you sign agreements where cryptographic validity matters legally (M&A, real estate, anything heading to court), you have engineering bandwidth for a small ops surface, and you want the prettiest signing flow for clients.

Docuseal: My Default Recommendation

If you had asked me before this test which one I expected to win, I would have said Documenso. Docuseal won on the boring stuff that matters every day.

The setup story is genuinely a 4-minute job. The Docker Compose file is 14 lines. SQLite means no database to manage. The admin UI for building templates is the most polished of the three — drag-and-drop fields, conditional logic, signing order, all in a flow that feels like it was designed by someone who has used Docusign professionally.

The catch is the Pro plan. The free open-source build is genuinely usable, but if you want SMS verification (real estate, payroll, anything where you need stronger signer identity assurance), SSO with your team's Google Workspace or Okta, white-labeling so the signing page does not say "Docuseal" in the footer, conditional fields beyond simple show/hide, or batch sending — you pay $20/user/month, same price as Documenso Cloud. At that price the math gets interesting: self-hosting Docuseal Pro for a 3-person team is $720/year for software plus VPS. Hosted Docusign Standard at $40/user/month is $1,440/year. You save $720 and own your data.

For Wardigi specifically, I ended up running Docuseal Free (no Pro) for everything except contracts that need SMS verification. For those, we still send through Docusign by exception — about 8% of our signing volume.

I would pick Docuseal when: you want the lowest ops overhead, you sign a high volume of documents that do not need cryptographic-grade signatures, your VPS budget is tight, or you are not comfortable maintaining Postgres.

OpenSign: Free Forever, Heavier to Run

OpenSign's pitch is simple: everything Docuseal locks behind the Pro plan is free here. SSO, API access, audit trails, bulk send, multi-signer, OTP — all included, all AGPL-3.0.

The architecture is also the most interesting. Parse Server is a mature backend originally built for Facebook's mobile platform, and OpenSign uses it as a sort of "BaaS in a box." That gives you a real admin dashboard, a class-based data model, and pre-built REST endpoints that are friendlier than I expected.

The completion certificate is OpenSign's signature feature — every finished document generates a separate PDF with the full audit trail (timestamps, IPs, email addresses, phone numbers if collected) and a tamper-evident hash. I have seen this implementation referenced by a few enterprise procurement teams as enough for SOC 2 evidence.

The catches are the resource footprint (MongoDB is not free) and the operational maturity. I hit two bugs in my week with it — one where the email service crashed silently after 12 hours of uptime, one where a template with more than 8 fields rendered the signer's name in the wrong position on the PDF. Both were trivially worked around, but neither would have happened on Docuseal.

I would pick OpenSign when: you cannot pay the Docuseal Pro tier, you need SSO and API access at zero cost, you already run MongoDB in your stack and have ops familiarity with it, and you are comfortable filing the occasional GitHub issue.

Recommended VPS Specs by Platform

Platform	Minimum VPS	Recommended VPS	Monthly Cost (Hetzner)
Docuseal (Free)	1 vCPU, 1 GB	1 vCPU, 2 GB	~$4.60
Docuseal (Pro features via self-host)	2 vCPU, 2 GB	2 vCPU, 4 GB	~$6.40
Documenso	2 vCPU, 2 GB	3 vCPU, 4 GB	~$9.42
OpenSign	2 vCPU, 4 GB	3 vCPU, 6 GB	~$13.18

Prices are Hetzner Cloud as of May 2026 for shared CPX line. If you are on Hostinger VPS (which is what I use for the OpenClaw aggregator sites), KVM 1 at $5.99/month is enough for Docuseal Free, KVM 2 at $7.49 handles Documenso comfortably, and KVM 4 at $15.99 is where OpenSign starts being painless.

Legal Validity: ESIGN, eIDAS, and What "Cryptographic Signature" Means

This is the part most comparison articles get wrong. All three platforms produce documents that are legally binding under ESIGN (United States) and eIDAS Simple Electronic Signature (EU). For 95% of everyday business contracts, this is enough.

Where it gets interesting is eIDAS Advanced and Qualified Electronic Signatures. Both require cryptographic signing tied to an identity that is "uniquely linked to the signatory." In practice, this means a PKCS#12 certificate issued by a Qualified Trust Service Provider (QTSP) listed on the EU Trusted List.

Documenso supports this natively. You upload the QTSP-issued certificate, configure the signing endpoint, and your output PDFs qualify as Advanced Electronic Signatures. Docuseal Pro supports a similar workflow. OpenSign's implementation is more limited — it can embed certificates but the toolchain around eIDAS-qualified providers is less mature.

For Indonesia (where Wardigi operates), UU ITE 2008 and the 2024 PDP Law are the relevant regulations. None of the three platforms are PSrE-certified by Kominfo, so for documents requiring a certified Indonesian e-signature provider (PrivyID, Peruri Sign, etc.) you still need to route through one of those vendors. For everything else — internal NDAs, vendor agreements, client onboarding — all three are fine under UU ITE Article 11.

Migration Cost: Docusign to Self-Hosted

If you are already on Docusign, your switch cost is mostly template rebuilding. None of the three platforms have a Docusign template importer. I had 14 templates in Wardigi's Docusign account. Rebuilding them in Docuseal took about 6 hours, including testing. Documenso took roughly the same. OpenSign took 9 hours because of one template that needed three rebuilds to position fields correctly.

Historical signed documents are not a migration concern. PDFs are PDFs. You can download them all from Docusign's vault and store them in S3-compatible storage (Backblaze B2 or Cloudflare R2 if you want the cheap option — both are well under $0.01/GB/month).

Decision Matrix

If your primary need is...	Pick	Why
Lowest ops overhead, get signing in 1 hour	Docuseal	Single container, SQLite, 4-min setup
Cryptographic-grade signatures (legal/financial)	Documenso	Native PKCS#12, cleanest signing UX
Zero recurring software cost, you have ops capacity	OpenSign	No Pro tier paywall, every feature is free
Mobile signer UX matters most	Documenso	Best mobile signing flow in testing
Highest signing volume (thousands/month)	Docuseal Pro	Built-in bulk send + best performance per GB RAM
SSO + audit trail, free tier	OpenSign	SSO is free, completion certificate is the strongest
You already run a Rails or Postgres shop	Docuseal (Rails) or Documenso (Postgres)	Match your existing stack
You already run a Node/MongoDB shop	OpenSign	Familiar stack reduces ops surprises

Cost Comparison: 3-Year TCO for a 5-Person Team

Numbers based on May 2026 pricing for a 5-user team signing 200 documents/month:

• Docusign Standard: $40/user/month × 5 × 36 = $7,200
• Documenso Cloud: $30/user/month × 5 × 36 = $5,400
• Docuseal Pro Cloud: $20/user/month × 5 × 36 = $3,600
• Docuseal Free self-hosted: ~$170 in VPS over 36 months
• Documenso self-hosted: ~$340 in VPS over 36 months
• OpenSign self-hosted: ~$475 in VPS over 36 months

The self-hosted spread is essentially noise. The Docusign vs. self-hosted spread is the part that pays for a long weekend of setup work many times over.

FAQ

Q: Can I run all three on the same VPS to give my team a choice?
Technically yes, but I would not. You will end up debugging three webhook integrations instead of one. Pick one, commit, and move on.

Q: How do I back up signed documents in a self-hosted setup?
For Docuseal with SQLite, the entire data directory is your backup — rsync nightly to Cloudflare R2 (about $0.015/GB/month) and you are done. Documenso and OpenSign need pg_dump or mongodump respectively, plus the filesystem volume. I use restic for all three.

Q: Will my signed PDFs still work if the platform shuts down?
Yes. The signed PDF is self-contained. The audit trail, the embedded certificate (if you used one), and any visible signatures are all baked into the file. The platform's role ends when the document is signed.

Q: Is SQLite production-safe for Docuseal?
For up to a few thousand documents per month, yes. SQLite handles concurrent reads fine; the only contention is on writes, which for an eSignature workflow are infrequent. I ran 8,400 test signings against Docuseal-SQLite over 72 hours with zero locking errors. If you cross 50,000 documents in a database, plan to migrate to Postgres.

Q: Can I use Cloudflare Tunnel to expose these without opening ports?
Yes, and I recommend it. All three platforms work transparently behind a tunnel. The signer never sees your origin IP, you do not need a public-facing reverse proxy, and you sidestep the entire "where do I put my Nginx" conversation. I run all my client-facing self-hosted services this way.

Q: What about MFA for admin accounts?
Documenso has 2FA built in. Docuseal Pro has SSO that you can layer 2FA onto via your IdP. OpenSign has basic 2FA. For a single-admin small-team setup, all three are adequate. If you have a 20-person legal ops team, route through SSO regardless of platform.

My Pick After Three Months

I run Docuseal in production for Wardigi today. The choice came down to ops overhead — when I have 7 aggregator sites, a daily content pipeline, and 18 active client engagements, I cannot afford an eSignature platform that needs babysitting. Docuseal has not needed any attention since I deployed it 11 weeks ago.

For the 8% of contracts that need stronger identity assurance, I route through Documenso Cloud on a per-document basis. That works out to about $6/month in usage. Cheaper than running both stacks myself, and I get the PKCS#12 signing without managing certificates.

If your situation is different — if you are a solo lawyer who needs Advanced Electronic Signatures for every document, or a fintech startup signing thousands of agreements a month — your math will be different. Use the decision matrix above and try the Docker images yourself. All three deploy in under an hour. You will know within a weekend which one fits your operation.

The bigger point is that you no longer have to pay $40/user/month for a feature set that three open-source projects now ship for free. That train left the station around mid-2025. If you are still on Docusign in 2026, you are paying for the brand, not the technology.