E-signature, built on the CapchaCloud evidence chain
Get it signed. Keep the proof.
CapchaSign is e-signature that ends in an Evidence Record. You prepare an envelope, place fields, and send it; each recipient signs from their own link. When the last signer finishes, CapchaSign seals the documents, issues a certificate, and folds the completion into CapchaCloud's append-only chain — so a third party can recompute the hashes themselves instead of taking a vendor's audit trail on faith.
Already using it? CapchaSign Studio is where you prepare and send an envelope; the signing page is what your recipient opens. This page explains what the product is and what its record proves.
Signature evidence
The problem with a signature you can't check
Every e-signature product hands you a completion certificate. Almost all of them are authoritative only because you trust the vendor that printed them: the document lives in their storage, the audit trail lives in their database, and the only way to test either is to ask them again. That is fine right up until the moment it matters — a dispute, an examiner, a counterparty who has no reason to trust your vendor.
"Trust our dashboard"
A screenshot of a vendor's audit log is an assertion, not evidence. If the record and the thing that vouches for the record live in the same database, one operator can change both.
Identity assurance stated vaguely
"Verified signer" can mean an email link or a government ID check — a difference that matters enormously later. CapchaSign records the exact tier per signer, in words, and says plainly when identity was not verified.
Seats and envelope caps
Signature pricing is usually per seat with an annual envelope ceiling and overage tiers to track. CapchaSign charges per completed record and draws from the same credit pool as the rest of CapchaCloud.
How it works
Five steps in CapchaSign Studio, or the same five calls against the API.
Create the envelope
Title, message, and options — including an optional HIPAA retention mode or a Part 11 mode that requires every signer to be at least tier L2. Creation is idempotency-protected, so a retried request never produces a duplicate envelope.
Upload documents
Each uploaded file is hashed on the way in. That original SHA-256 is one of the inputs the final seal commits to, so a swapped source file is detectable later.
Add recipients
Set each recipient's role, routing order, and identity tier (L1–L4). Recipients need no CapchaCloud account — they sign from a tokenized link, or inside your own app through an embedded signing token.
Place fields
Twelve field types — signature, initials, date signed, name, email, text, number, checkbox, radio, dropdown, attachment, and formula — assigned per recipient, with conditional visibility so a field can appear only when another answer calls for it.
Send, then manage
Send it, then remind, correct, delegate to another signer, or void — every one of those a first-class API action, not a support ticket. Reusable templates, public PowerForms, and bulk send are all built in.
Completion seals itself
When the last signer finishes, CapchaSign stamps and seals every document, appends a certificate page, writes a certificate record, and folds the completion into the same append-only audit chain that backs the rest of the platform.
What your recipient actually sees
The signing page is deliberately short. Depending on the tier you set, the recipient is asked to confirm it's them, agrees to use electronic records and signatures for that specific document, completes the fields assigned to them, and is done. Everything they do along the way — the tier that was satisfied, the human check, timestamps, IP and edge geolocation — is recorded into the envelope's evidence, not just into a log.
Identity tiers, described the way the certificate describes them
| Tier | What the signer does | What the certificate says it establishes |
|---|---|---|
| L1 | Opens the signing link | Self-asserted email — identity not verified |
| L2 | Email one-time passcode | Identity not verified beyond access to that mailbox |
| L3 | A CapchaVerify native screening session, or a real document image analyzed natively | A screening aid — recorded and sealed, explicitly not certified KYC or government-ID verification |
| L4 | Certified-vendor ID verification through CapchaShield | Certified-vendor ID verification, naming the provider. L4 never silently falls back to native screening when a certified vendor isn't configured |
The distinction between "screened" and "verified" is enforced in code, not just in copy: a native screen — even one that analyzed a real document image — records a screening session and is never labeled identity verification.
What the evidence record contains
A completed envelope produces a certificate (schema capchasign-cert-1.0.0) that is stored, hashed, and referenced from the public verify endpoint. It carries:
- Per signer — name, email, role, identity tier, human-check result, signing timestamp, IP and edge location, whether identity was verified or only screened, the provider and assurance tier when one was used, and the signature capture mode with its stroke-telemetry point count and telemetry hash.
- Per document — the original SHA-256, the sealed SHA-256 of the exact bytes served by the download endpoint, the pre-certificate hash that was actually folded into the seal, and whether an embedded PDF signature and its timestamp were applied.
- The seal hash —
sha256(envelope_id | audit_chain_head | sorted(original hashes) | sorted(sealed hashes)). Published in the certificate so a verifier can reproduce it from the certificate's own fields. - Chain position — the audit chain head at seal time, the audit event count, and the timestamp-authority / anchor reference when one was obtained.
- Retention and mode flags — HIPAA mode, Part 11 mode, retention mode, and the earliest date a HIPAA record may be purged, stamped into the certificate so an auditor sees them independently of the envelope row.
- A verify URL — the public endpoint for that envelope, printed on the appended certificate page inside the PDF itself.
Three independent ways to check it
Recompute the document hash
The public verify endpoint fetches the live sealed PDF bytes, hashes them, and compares against the hash recorded at seal time. Swap the file and keep the certificate, and this breaks.
Recompute the seal hash
The certificate's seal_hash is reproduced from its own recorded inputs. Edit the certificate's seal hash directly and it no longer matches what produced it.
Verify the Merkle proof
When the completion has been folded into a CapchaChain block, the endpoint returns a real inclusion proof. Newly completed envelopes report pending_next_block until the next block is produced; envelopes sealed before this shipped report not_linked rather than a faked success.
Chain blocks themselves are independently timestamped under RFC 3161 by multiple timestamp authorities and anchored asynchronously to Bitcoin through OpenTimestamps calendar servers — the mechanics and their limits are written out on the evidence methodology page.
A signature inside the PDF, checkable with no calls to us
Every CapchaSign document sealed after July 15, 2026 carries a real CMS/PKCS#7 detached signature written into the PDF's own signature dictionary and timestamped under RFC 3161 (PAdES-B-T) — the same mechanism Adobe Reader and any standard PDF validator recognize natively, checked entirely offline. The certificate records per document whether that signature and its timestamp were actually applied, so you never have to assume.
Honest disclosure, reused verbatim from our methodology page: the signing certificate is self-signed today, not yet issued by a CA on Adobe's Approved Trust List. Adobe Reader will show the signature as cryptographically valid and unmodified since signing, but the signer identity as untrusted until that upgrade is complete. The SHA-256 fingerprint of the current signing certificate is published so you can confirm a PDF was signed with CapchaCloud's actual key and not a substitute.
Two kinds of signing evidence, and the difference matters
Signature stroke capture
For a hand-drawn signature, CapchaSign records the raw pointer-stroke telemetry of the drawing itself — replayable, and evidence of natural motion rather than a pasted image. The capture mode, point count, and a hash of the telemetry are written into the certificate. This is not a recording of the signer's face.
Video of signing
A session clip can be captured, hashed, and stored alongside the envelope. Where a timestamp-authority endpoint is configured, the clip's hash is submitted for an RFC 3161 timestamp; if the authority is unreachable the clip is still stored and the missing timestamp is recorded rather than faked. The add-on is charged only when a clip is finalized — not when an upload is started and abandoned. A clip is bound to one envelope and recipient and cannot be replayed as evidence on another.
Integration
Every step above is a documented API call — see the API reference and the raw OpenAPI spec. A minimal end-to-end envelope:
POST /api/v1/sign/envelopes # create (idempotency-protected)
POST /api/v1/sign/envelopes/{id}/documents
POST /api/v1/sign/envelopes/{id}/recipients
PUT /api/v1/sign/envelopes/{id}/fields
POST /api/v1/sign/envelopes/{id}/send
# later, from anywhere — no API key required:
GET /api/v1/sign/envelopes/{id}/verify
Also available: reusable templates and templates/{id}/instantiate, public
PowerForms, bulk send, per-recipient embed-token for signing inside your own UI,
correct / void / remind / delegate, an
events feed, and tenant-authed certificate and download
endpoints. The verify endpoint is deliberately public and unauthenticated — an
auditor should not need your credentials to check your evidence.
Pricing
Priced in credits, not per seat. Credits come from your monthly plan and pool across every CapchaCloud product — one subscription, one bill. See plans and the full credit catalog.
Completed envelope
Video-of-signing add-on
No seats, no caps
If you route a signer to a certified ID vendor at tier L4, that vendor bills you directly under your own contract — CapchaCloud never marks up or passes through vendor fees.
What this does not prove
The record is strong about some things and silent about others. Here is the boundary, stated plainly.
- Not a legal conclusion. A sealed envelope is evidence about a signing event. It does not determine whether your agreement is valid, enforceable, or binding — that is a question for your counsel and the relevant law, not for a hash.
- No e-signature certification. CapchaCloud holds no eIDAS or 21 CFR Part 11 certification and no SOC 2 or ISO 27001 report today. The HIPAA and Part 11 modes are technical controls only, not certified — they enforce retention floors and minimum signer tiers and stamp those facts into the certificate. If your regulator or counterparty requires an actual certification, we will tell you so; see the honest comparison.
- Identity is only as strong as the tier you chose. L1 and L2 do not verify who the signer is. An L3 native screen is a screening aid and never binds a presenter to a document. Only L4 records certified-vendor ID verification, and only when such a vendor is actually configured.
- A human check is not an identity check. The bot-resistance screen confirms a human acted. It does not confirm which human.
- Location signals are network-origin, not GPS. IP and edge geolocation are observed server-side. They are not device GPS and not geofencing.
- Storage is hash-verified, not automatically operator-proof. Evidence objects are content-addressed and hash-verified; write-once retention applies where the underlying bucket retention lock is configured. We do not treat a hash chain alone as operator-proof WORM hardware.
- The embedded PDF signature is self-signed today. Valid and unmodified-since-signing, but the signer identity shows as untrusted in Adobe Reader until the trust-list upgrade is complete.
- Anchoring matures; it is not instant. Bitcoin confirmation through OpenTimestamps matures over time, and a freshly completed envelope reports its chain inclusion as pending until the next block is produced.
- New product, no track record claim. CapchaSign has no established body of case law behind it. We are not going to pretend otherwise.
Questions people actually ask
Does the signer need a CapchaCloud account?
No. Each recipient signs from a tokenized link, and the signing session is authenticated by that token plus whatever identity tier you assigned. If you want signing to happen inside your own product instead, request a per-recipient embed token.
How does a skeptic verify a document without trusting you?
They fetch the sealed PDF, recompute SHA-256 over the bytes, and compare against the hash in the certificate; then recompute the seal hash from the certificate's own fields. They can also skip us entirely and let Adobe Reader check the embedded signature offline. The verify endpoint is public and needs no API key.
What happens if a document fails to seal?
The envelope is not marked completed. CapchaSign restores the prior status and lets a retry re-run rather than shipping a partial envelope with a meaningless seal hash — a completed record that quietly contains nothing is worse than a visible failure.
Can I correct a document after sending?
Yes — correct, void, remind, and delegate are all API actions, and every one of them lands in the envelope's event history rather than silently mutating state.
Can I collect payment at signing?
Yes, through your own processor — you are the merchant of record and CapchaCloud structurally never touches the funds. Details are on the comparison page.
How does this compare to DocuSign?
Feature by feature, including where DocuSign is the better choice, on CapchaSign vs DocuSign. Short version: we give you a seal a third party can check and per-record pricing; they have the certifications and the track record.
Send one and inspect the record
A free account includes credits — enough to send a real envelope, complete it, and pull its certificate apart. The demo takes 30 seconds if you'd rather watch a seal break first.
Prepare & send in Studio · vs DocuSign · Evidence methodology · Compliance Envelope · API reference