Honest answers, not marketing copy.

Yes. Spondeo envelopes meet the requirements of the U.S. ESIGN Act and UETA, EU eIDAS (Simple Electronic Signature), and the corresponding statutes in Canada, the UK, and Australia. Every signed envelope ships with a tamper-evident Certificate of Completion capturing intent to sign, identity attribution, IP, user agent, and timestamp, the same evidence DocuSign and Adobe Sign provide.

The compliance framework Spondeo uses, ESIGN + UETA + court-tested audit certificate format, is the same one upheld in US courts for two decades across DocuSign, HelloSign, and Adobe Sign. The relevant case law applies the same way.

QES requires a qualified trust service provider (QTSP) for identity verification. Spondeo ships Simple Electronic Signatures (SES) on every plan, which covers most commercial contracts. QES is on the roadmap via a QTSP integration.

Any time. Signed PDFs download from the document detail page or via GET /v1/envelopes/{id}/final. The certificate is appended to the PDF itself, the same artifact you'd hand a court.

No cap on any tier. Solo, Team, Business all include unlimited envelopes, unlimited signers, unlimited templates. DocuSign caps Business Pro at 100 envelopes per user per year, we don't.

10 documents per month, free, no card. Hit the limit and we email you, no surprise overage charges, no auto-upgrade. You decide whether to pay or wait until next month.

Annual is 16% off. Switch any time; we prorate.

For 250+ seats, dedicated CSM, custom data residency, or procurement requirements, get in touch. Pricing is similar to Business but the contract is bespoke.

Yes, monthly plans cancel at the end of the current period, annual plans cancel at renewal. Your existing signed PDFs stay accessible and downloadable through your plan's retention window.

Encrypted at rest with AES-256, in transit with TLS 1.3. Source PDFs are SHA-256 hashed at upload and verified at every finalize so post-hoc tampering would invalidate the certificate.

US by default (AWS us-east-1). EU residency is available on the Business plan (AWS eu-west-1) as a per-workspace setting, switch when you create the workspace.

Yes, Type II, ISO 27001. Report available under NDA.

Business plan is HIPAA-eligible. We sign a BAA on request. PHI in signed documents is encrypted at rest, audit-trailed, and access-controlled at the workspace level.

Available on the Business plan, adds the printed-name requirement, dual-component authentication ceremony, and the audit attributes Part 11 requires. Common in clinical trials and pharma.

Standard envelopes use email-based attribution. Knowledge-based authentication (KBA) and government ID verification are available on the Business plan via partner integrations.

Under a minute once a template exists. Pick template, fill merge variables, paste recipient emails, send. Initial template setup takes a few minutes because you're placing fields; after that, it's reuse.

No. They click the link in their email, sign in their browser, done. The link is one-time-use and bound to their email address.

You see it in the audit log on the document detail page. The "Correct email" action lets you fix the address, Spondeo rotates the signing link so the old (wrong) recipient can't sign.

Both. Sequential: each signer is invited only after the prior one signs. Parallel: everyone gets the link at the same time. Set it per envelope.

Signature, initial, date, name, email, company, title, text, number, checkbox, radio, dropdown, multi-line text, sender pre-fills, calculated formula fields, attachment upload, stamp/seal images. Conditional visibility on any field.

Yes. Every email pulls from a workspace-editable template, subject, HTML body, plain-text body. Recipient name, sender, subject, signing URL, and template-specific variables are available as merge tags.

REST API on Business. Webhooks on Team and Business. We don't charge per envelope through the API, pricing is per seat.

Your customers sign your documents inside your app via an iframe, no DocuSign redirect, no third-party branding. The API returns a one-time exchange token; your client posts it to mount the iframe.

Subscribe to envelope or recipient events. We POST to your URL with an HMAC signature. Failed deliveries retry with exponential backoff and are visible and replayable in /settings/webhooks.

Test API keys partition test data from live. Test envelopes never send real emails, render the certificate with a TEST watermark, and don't count against your document quota.

/docs, full OpenAPI reference rendered with Scalar. Try-it built in.

Signed PDFs from any e-sign provider import with their signatures intact, they're already self-contained PDFs. Spondeo's certificate doesn't apply retroactively (we didn't witness the signing), but the original provider's certificate stays attached.

Templates need to be recreated, every provider stores field placement differently. A typical template takes 2–5 minutes to rebuild. CSV-driven template import is in private beta; ask if you have more than 10 templates.

Lower price, no document caps, custom fields and formulas without a premium tier. HelloSign is a strong product; we win on price and on what's included on the lower tiers.