Yesterday we needed to route a real agreement between two parties for signature. The other side's plan was to send it through DocuSign. Ours became: build our own, that day, on infrastructure we already own — and then give it away.
BL Sign went from empty repo to signed-sealed-verified production in one working session: a Cloudflare Worker in front of D1 for envelopes, signers, fields, and an append-only audit log, R2 for the documents, pdf-lib to burn everything into the final file. Upload a PDF, click where the signatures go, share a link. Marginal cost per envelope is effectively zero, which is why the free tier isn't a trial — three envelopes a day, forever, no card.
The part we actually care about: evidence
E-signature tools mostly sell the same three screens. What they charge for is the paper trail. So that's where the work went:
- Certificate of completion, burned into the PDF itself — every signer's ESIGN consent timestamp, signing timestamp, IP, and device, plus the full event log. Not a record in someone else's cloud that disappears with your subscription; it's in the file.
- Tamper-evident hashes. The original and final SHA-256 are recorded on a public
verification page stamped onto every page of the document. Anyone holding a copy can run
shasum -a 256and prove it untouched — forever, without asking us. - Real routing. Sequential or parallel, up to eight signers, CC recipients who get the sealed copy without signing, reusable templates, decline-with-reason, expiration windows, multi-document envelopes merged into one signing session with per-document hashes on the certificate.
The first production envelope was a genuine two-party agreement, sent the same night the tool was built. The signer on this machine drew a signature at 00:54 UTC and the audit chain — viewed, consented, signed, IP, device — sealed correctly on the first real use.
What our own test battery caught
Per house rules, nothing above got listed until it was exercised on the live site, and the battery earned its keep:
- pdf-lib accepts garbage by default. Our "reject corrupt PDFs" check passed a file that
was literally
%PDF-plus noise, because the parser is lenient unless you ask forthrowOnInvalidObject. Without that, a bad upload would only explode at seal time — after everyone signed. - The CC bug the safety net caught. With a CC recipient on the envelope, the last signer's completion counted the viewer as "unsigned" and skipped sealing. We'd already built a retry: any read of an all-signed envelope re-runs the seal if a prior attempt failed. It quietly repaired the envelope before we'd even diagnosed the bug. Then we fixed the root cause anyway, because a safety net you're leaning on is just a bug with good PR.
- Deploy propagation lies to you. Twice we chased "broken" behavior that was really a ~1-minute window of old and new worker versions serving side by side. The lesson is now a standing rule: curl the exact asset again before performing surgery on caches.
Hardening shipped the same night: CSP and security headers on every response, signing links marked non-indexable (they're bearer secrets), login throttling, PNG magic-byte checks on signatures, a double-submit guard so two tabs can't double-sign, quotas per email and IP, and a global daily circuit breaker on the public tier. Signer email verification followed the next morning.
Why it's free
Every counterparty who signs anything sees the tool working at the exact moment they care about it — that's distribution no ad budget buys. And it's the sales pitch for the actual business: BL Sign went from zero to production on our own stack in a day. If your business needs its own tools built like that, that's the work we sell.
Automated email delivery and reminders are the current lane — sending is the one thing we don't fully own yet, and the deliverability world is hostile territory we've written about before. Until then, links travel however you already talk: text, email, Slack.
Send something for signature at sign.blacklabeltec.com, or read the feature page at /sign.