What changed.

Signing on a phone, and a monthly summary

The signer view now pans and zooms on a small screen instead of scaling a page down until the fields are unreadable, and the sender app — documents, templates, contacts, and the field editor — reflows properly on a phone rather than assuming a desktop window.

A monthly activity digest goes out to senders who want one: what was sent, what completed, and what is still waiting. It is on by default and can be switched off under notification preferences; it counts live documents only.

Phases 1 to 5

The product. Documents, templates, and bulk sends through the REST API and the web app; embedded signing and the embedded document and template builders; text tags; per-workspace webhook endpoints with body signatures, health states, a delivery log, and replay.

Every completed document is sealed and carries an audit trail, and a signed Merkle root over everything sealed that day is published each night.

Authentication covers API keys — live and sandbox — and an OAuth 2.1 authorization server with PKCE, dynamic client registration, and scopes a person approves on a consent screen. Free, Light, Business, and Enterprise are enforced from code, with API documents metered per envelope.

The MCP server, the Zapier integration, the browser embed library, and the TypeScript client all live in this repository and are built against the same OpenAPI document. None of them is published to a package registry yet; the integrations page says which is which.

Phase 0

The first entry, and an honest one: nothing was shipped in it. Phase 0 is the groundwork everything after it depends on.

The API contract is written and frozen as OpenAPI 3.1, covering documents, templates, bulk sends, files, webhooks, and the signer session, with every compatibility behaviour recorded from measured fixtures rather than from documentation. The compatibility matrix names each behaviour as preserved, fixed, or an extension, so no divergence is accidental.

The design direction is decided and the tokens exist in both themes. The control catalog is written: 143 controls across seventeen domains, each mapped to SOC 2, ISO 27001, and the HIPAA Security Rule, with its status recorded honestly as planned, implemented, or evidence-ready.

This site is the first surface built against those tokens.