semics E-sign

Simple electronic signatures for EmDash (ESIGN and UETA in the US; a simple electronic signature under eIDAS in the UK and EU). Write Markdown templates with placeholders, send an envelope to one signer, and get back a signed PDF with a certificate.

• The signer agrees to your consent wording and types their name (drawing a signature too is optional), or declines.
• Every step is an event in a hash-chained audit trail. Personal values enter the chain only as salted hashes, so retention can delete them without breaking it.
• The signed PDF is built once and its hash stored. Anyone can check a PDF on /verify; only its hash leaves their browser.
• Unsigned envelopes expire; personal data and signed records each have a retention period you set.
• Other systems can start signatures through a documented, signed protocol (esign-intent/1).
• English and Arabic built in; tested against WCAG 2.2 AA at 320 px.

The signing pages come from the npm package @semics-tech/emdash-esign (the registry delivers the core only).

E-sign Pro (same plugin, separate licence) adds several signers, an email one-time code, reminders, uploaded PDF templates, self-serve forms, bulk send and MCP tools.

Documentation: https://github.com/semics-uk/emdash-plugins/tree/main/apps/docs/pages

Is this a qualified or advanced signature? No. It makes simple electronic signatures. Ask your lawyer whether that suits your documents.

How long is data kept? Personal data 12 months and signed records 7 years after an envelope closes, by default. The signed PDF and its certificate keep the signer's name and IP address (and a minor's name, when a guardian signed) until the signed-records period ends.

Can a signer's data be deleted on request? Yes: Delete personal data on the Envelopes page. The signed record keeps its own period.

No email is sent. Set the site URL and an email provider.

Several signers, codes, reminders, PDFs? E-sign Pro.

More: https://github.com/semics-uk/emdash-plugins/blob/main/apps/docs/pages/faq.md

Report security problems to security@semics.co.uk, not in a public issue.

• Signing links are 256-bit random tokens, stored only as hashes. The signing page sends Referrer-Policy: no-referrer and posts the token rather than putting it in later URLs.
• Wrong links are limited per IP address. Opening a link records nothing: a mail scanner is not a signer.
• The signing and verify pages run under a strict Content-Security-Policy with no third-party scripts.
• The audit trail is hash-chained over salted commitments of personal data; the signed PDF's hash is stored and checked on download.
• Integration tokens are HMAC-signed with a secret derived per client and are single use.
• The only outside host is challenges.cloudflare.com, for the Pro self-serve form.

Details: https://github.com/semics-uk/emdash-plugins/blob/main/apps/docs/pages/esign.md

1. Install the core from the registry, or with npm together with the UI kit:

pnpm add @semics-tech/emdash-esign @emdash-cms/sandbox-workerd

1. Add the integration and the UI plugin to astro.config.mjs. A core installed from the registry has an r_… id: pass it as esignIntegration({ pluginId }) and leave the core out of sandboxed.

import semicsEsign from "@semics-tech/emdash-esign";
import { esignIntegration } from "@semics-tech/emdash-esign/integration";
import { esignUi } from "@semics-tech/emdash-esign/ui";
import { defineConfig } from "astro/config";
import emdash from "emdash/astro";

export default defineConfig({
	output: "server",
	integrations: [
		esignIntegration(),
		emdash({
			siteUrl: "https://sign.example.com",
			sandboxRunner: "@emdash-cms/sandbox-workerd/sandbox",
			sandboxed: [semicsEsign],
			plugins: [esignUi()],
		}),
	],
});

1. Set the site URL (siteUrl or EMDASH_SITE_URL): without it no signing email is sent.
2. Set EMDASH_ENCRYPTION_KEY and an email provider.
3. Write a template on Templates, then send an envelope from Envelopes.

Full guide: https://github.com/semics-uk/emdash-plugins/blob/main/apps/docs/pages/install.md