SignMe · contract lifecycle management for Australia & New Zealand
E-sign, sealed evidence, and contract lifecycle management
An Australasian-hosted contract lifecycle management platform — eSignature, sealed evidence and CLM in one — for Australian and New Zealand organisations. Reviewed honestly, capability by capability, against the code and against the enterprise CLM market: DocuSign IAM, Ironclad, Icertis, Agiloft and Sirion.
→ next ← back
The shape of it
One workspace. Six moving parts.
A workspace is the tenant boundary — members, entities, seal identity, everything scoped to it. Nothing crosses workspaces, and SignMe never boots through Incendio's tables: separate repo, separate database, separate API tree and host.
Contracts
A register with a dynamic attribute schema per contract type — string, number, money, date, cascading lookups — driving merge tokens, extraction targets and reports.
Documents
A per-workspace vault: folders with inherited ACLs, full-text search on ingest, retention rules and legal hold.
Signing & seal
Field placement, routing, recipient authentication, then a PKCS#7 sealed execution copy and a Certificate of Completion.
Workflows
A visual drag-and-drop canvas compiling approval matrices, SLA timers and send-for-signature into one engine.
Obligations
Milestones, price escalations and renewal alerts extracted straight from contract attributes, on a 90/60/30-day pipeline board.
AI & intelligence
Key-term extraction, playbook risk scoring and a cited assistant — gated behind an AI key, always human-reviewed, never autonomous.
Underneath all six: a party model. Entities can be individuals, companies, trusts, partnerships or government bodies (NZBN/ABN), each with a signing-authority rule — sole, all, any-N, or named signatories.
How work moves
Seven stages, one proven path
docs/UAT-WALKTHROUGH.md walks a reviewer through this exact path in about 30 minutes; api/tests/e2e-uat.php proves it end to end as its own “journey” block.
- 01Intakeform / email
- 02Draftgenerate from template
- 03Negotiateredline + comment
- 04Approvematrix workflow
- 05Signrouted, multi-channel
- 06SealPKCS#7 + certificate
- 07Governobligations, audit
Renew, Amend and Clone each open a new contract in place, linked back to where it came from — the loop that keeps stage 7 flowing back into stage 1.
Stage 1 · Intake
A form builder bound to the contract schema
- 01Public intake wizard. Login-free, workspace-branded, built with a page/field editor — validation and conditional show-when included.
- 02Inbound email. A Cloudflare Worker posts parsed mail into the same triage path — sandboxed today via a “Simulate inbound email” form.
- 03Request desk. Triage, assign, an SLA panel from a business-hours policy, reject with a reason, convert to a draft contract.
AI triage only annotates suggested field values when an AI key is configured — converting a request to a contract always stays a human click.
Request desk
Details · Activity · Convert
- Assigneeset on triage
- SLAdue time computed, no AI needed
- Rejectreason required
- Convertalways a human click
Stage 2 · Draft & author
Merge tokens, clause governance, rules that pick the variant
- 01DocGen v2. {{token}} merge plus {{#if}}/{{#each}} conditional and table-row logic, with numeric/date formatting filters.
- 02Clause library. Standard/fallback/prohibited variants, an owner, an approve/reject/retire workflow, a 1–5 risk score, region and business-unit tags.
- 03Smart Rules. Contract-type conditions auto-select a clause variant, with a wizard override toggle and a “test with sample context” tool.
An inline #if inside one paragraph collapses that paragraph's per-run bold/italic — block tags need their own paragraph or table row, a docx-authoring limit, not a scheduled fix.
Quick start seeds
- Document seal
- NZ contract types
- Clause library (26 NZ standard clauses)
- Starter playbooks
- Workflow recipes
- An intake form
Stage 3–4 · Negotiate & approve
One redline view, a matrix that compiles itself
- 01Redlining. document.xml-level paragraph diff, side-by-side red/green/yellow, an AI “Summarise changes” button.
- 02Clause locks. A locked paragraph is hashed; an incoming version editing it is flagged, and can be server-rejected.
- 03Approval matrix. Match-all or match-any rules (one nested group, e.g. value > 100k or governing law ≠ NZ) per contract type compile into a workflow automatically — serial, parallel, or parallel-unanimous.
The approval fingerprint hashes the primary document, value, term, governing law and counterparties. Change any of them post-approval and every send path refuses — named field and all — until Re-run approval clears it.
Internal approval
Settings → Contract types
Approver field, serial or parallel, lock-document-while-out, expiry.
Counterparty portal
/negotiate/{token}
View, comment, upload a counter-draft, accept — token-gated, no seat.
Stage 4 · The engine behind approval
A drag-and-drop canvas, 46 activities deep
- 01Build. Drag a step from the palette, wire an edge from its output handle, edit it in the properties panel. Undo, redo, auto-layout, minimap; a full-window designer with a resizable palette.
- 02Nine triggers. Manual, contract status, document uploaded, schedule (real cron), inbound webhook, API, negotiation accepted, intake submitted, renewal decision.
- 03Validate, then publish. A published workflow is versioned; the Runs tab shows the same map with every node coloured by that run's status.
- 04Reaches out. A step can POST to any URL or a saved connector, push to a CRM, generate a document, or send for signature.
Agreement lifecycle — review, sign, execute · 33 steps · click to open and zoom
Renewal & amendment orchestration — wait, notify, branch on auto-renew, then renew or amend with approval · 20 steps · click to open and zoom
Both are live workflows in the Harbourstone workspace, rendered from the builder's own canvas. The enterprise platforms advertise bigger palettes (DocuSign Maestro lists 100+ activities; Ironclad and Icertis lean on integration catalogues); SignMe has 46 across seven categories, every one unit-tested. Escalation notifies but does not yet reassign automatically.
Stage 5 · Sign
Routing, fields, and honest recipient authentication
- 01Routing. Serial, parallel or custom per-signatory conditions; signing groups; delegation.
- 02Field kinds. Signature, initials, text, checkbox, radio, number, date, dropdown, formula.
- 03Action types. Needs-to-sign, in-person, receives-a-copy, approver, certify — all with a working public page.
- 04Delivery. Email always; SMS and WhatsApp queued through the same outbox as everything else.
Recipient authentication, honestly
| Method | Status |
|---|---|
| Access code | Real (hash-based) |
| SMS-OTP | Real (Twilio delivery) |
| Phone call | Sandboxed |
| KBA | Sandboxed |
| ID document | Sandboxed |
| eID / QES | Disabled (501) |
Stage 6 · Seal
Prepare, stage, publish — and a hash-chained audit head
- 1PrepareLock the request, hash the source, snapshot the seal identity, take a lease.
- 2StageSign into staged storage with an RFC 3161 timestamp request.
- 3PublishUnder a guarded claim with a lease re-check — a crash resumes rather than restarts.
Live today: the seal key is held in an Azure Key Vault HSM and every seal carries a DigiCert RFC 3161 timestamp, verified before publication. Not yet: an AATL-trusted certificate over that key, so Acrobat shows “validity unknown” — a trust-display upgrade gated on investment, not a legal requirement: NZ’s Contract and Commercial Law Act 2017 Part 4 and Australia’s Electronic Transactions Act 1999 are technology-neutral and accept the signature as produced. The public /trust page says exactly this.
- SignaturePKCS#7 — self-signed, PEM upload, or Azure Key Vault HSM
- CertificateIP, device, attestation, waiver reasons
- Evidence packexecution PDF + certificate + original + event log + sha256 manifest
- Audit head{seq, hash} into the workspace's hash-chained event log
Stage 7 · Govern
Folders, full-text search, retention and legal hold
- 01Folders & ACLs. Inherited or overridden, member/group/role × view/edit/manage.
- 02Search. MySQL FULLTEXT OR'd with a substring match, no page ceiling.
- 03OCR. Ghostscript extraction always runs on ingest; tesseract OCR picks up scanned PDFs in the background.
- 04Retention & hold. A rule per document type; legal hold freezes edits (423) until released; disposal always logged.
Enterprise repositories still carry documented limits — DocuSign's “Modernized Search” is prefix-only with a 4-character minimum and a 500-page extraction cap, and most CLM vendors index metadata rather than full text. SignMe's substring match with no page ceiling plausibly exceeds them — a checkable claim, not an assumption.
- no page ceiling
- 4 ACL levels
- 423 while on hold
- disposal always logged
- tesseract OCR live — scans become searchable in the background
Stage 7 · Govern, continued
A pipeline board for what's coming due
- 01Obligation register. Milestones, price escalations, SLA review dates, recurrence, evidence attachment.
- 02Renewal alerts. 90/60/30-day cadence — the default the enterprise platforms document (DocuSign's, adopted verbatim) — plus opt-out notice generation.
- 03Reporting. Filters, group-by, aggregates, a live preview, saved/shared reports, CSV export, scheduled delivery.
- 04BI feed. A bearer-token GET /feed/{subject}.csv export for Power BI or Excel.
Renewal pipeline
- 90dExpiring
- 60dNotice window
- 30dOpt-out passed
- 0dExpired
Assist, don't automate
Extraction with a citation, never a hallucinated answer
- 01Extraction. Every value carries confidence plus a page/quote anchor, then a confidence-thresholded human review queue.
- 02Classification. ~40 industry-standard document types, plus clause detection with a “same legal effect” verdict.
- 03Risk. Deterministic playbook rules + an AI checklist + statistical outliers within a contract type's own population.
- 04Assistant. Cited, clickable answers with a visible tool-call trace — falls back to plain search, never a hallucinated answer with no citation.
Nothing decides autonomously. The 2026 pitches from DocuSign, Ironclad and Icertis all lean hard on agents; SignMe's closest analogue — AI-annotated intake triage — is explicitly human-in-the-loop, by design.
- ProviderGemini or OpenAI, chosen in Admin → AI with per-feature models, a fallback model, a key encrypted at rest and never returned (last four only), and a “Test connection” — no Claude adapter, by decision
- Busy provider429/5xx retried with backoff, jobs deferred without burning an attempt, nothing marked failed by a transient error
- No key?503 or a silent skip — never a crash
Trust, by control, not by claim
MFA, step-up, hash-chained audit — and a public Trust page
- 01Step-up. Seven guarded actions need a five-minute, single-use challenge: API-key minting, seal-key change, SSO/SCIM config, legal-hold release, disposal approval, promotion to owner, custom-role edits.
- 02Roles. Workspace roles + folder ACLs live today; custom roles exist in tested code, no deployed screen yet.
- 03SSO & sign-in policy. Entra + Google OIDC, SAML 2.0 and SCIM 2.0; each workspace chooses its allowed sign-in methods and IdP domains; remembered devices carry MFA once per device while the magic link stays 15-minute single-use; platform admins must pass MFA.
- 04Audit. A hash-chained event log with a “Verify audit chain” replay, and a public, unauthenticated /trust page stating what's real versus sandboxed.
- MFA — TOTP + recovery codes
- Step-up × 7 actions
- SAML 2.0 — no live IdP yet
- Sign-in policy per workspace
- Remembered devices — rotating refresh
- SCIM 2.0
- Audit chain verify
- /trust page →
Honestly, category by category
SignMe against the market leader — the scorecard
DocuSign IAM publishes the most complete CLM capability list, so it is the reference column here (Ironclad, Icertis, Agiloft and Sirion follow on the next slide) — set against what's built, tested and deployed on signme.nz/test — every SignMe cell re-verified on 2026-09-08 against routes, libraries, UI and tests, not against the docs.
| Area | DocuSign IAM | SignMe, this build | Verdict |
|---|---|---|---|
| Intake & request | Web Forms, Agreement Desk triage, OCR paper intake | Form builder with conditional pages, public wizard, AI-annotated triage, SLA desk, kanban; OCR of scans live (tesseract) | Parity |
| Authoring & clauses | Agreement Preparation: DocGen, clause library governed by folder ACL | Nested DocGen block engine, clause library with an approve/reject/retire workflow and risk/region/BU tags, Smart Rules | Parity |
| Negotiation & approval | Word add-in, external portals, Internal Approval step | Major/minor versions with word-level diff and rollback, counterparty portal, matrix-compiled approval; add-in is check-out/check-in | Parity |
| E-signature | Routing, multi-channel delivery, SMS-OTP/KBA/eID/notary IDV | Serial/parallel/custom routing, groups, delegation, 9 field kinds burned into the sealed PDF, bulk send, 4 capture methods; access code + SMS-OTP real, phone/KBA/ID-doc sandboxed, eID disabled | Partial identity verification |
| Sealed evidence | Certificate of Completion, AATL-trusted seal, RFC 3161 | PKCS#7 seal signed by an HSM-held key in Azure Key Vault, DigiCert RFC 3161 timestamp verified on every seal, rich certificate, CMS-signed evidence manifest, hash-chained audit — certificate still self-signed, AATL cert not yet issued | Partial no AATL seal |
| Repository & search | Agreement Manager: folders, metadata, “Modernized Search” (prefix-only, 500-page cap) | Folder ACL inheritance, smart folders, auto-filing, cascading lookups, retention + legal hold (423), substring search with no page ceiling | Exceeds ahead on search |
| Obligations & reporting | Obligation extraction, renewal alerts, reporting | Recurring obligations with evidence and targets, 90/60/30 sweeps, 4-stage renewal board, report builder, Power BI feed | Parity |
| AI & intelligence | Iris — 100+ concepts, agentic Agreement Desk | 113 built-in concepts, schema-driven extraction with a no-key rules extractor, PDF-anchored review queue, playbooks + statistical outliers, cited assistant — no autonomous agents | Parity no autonomous agents |
| Developer platform & SSO | REST API, Connect webhooks, App Center, SAML/SCIM | OpenAPI (141 paths), scoped keys, Idempotency-Key, HMAC webhooks (233 events), MCP (14 tools), SAML 2.0, Entra + Google OIDC, SCIM, TOTP MFA, per-workspace sign-in policy with remembered devices | Parity |
| Named enterprise connectors | Salesforce, SAP Ariba, Workday, Coupa, NetSuite, ServiceNow | SharePoint via Graph is real; Salesforce/HubSpot/Xero are “coming soon” cards; the other six are absent | Gap |
| Compliance attestations | SOC 1/2, ISO 27001, FedRAMP, HIPAA, PCI-DSS, multi-region | Controls document mapped to ISO 27001 Annex A; no certification held; hosted in Sydney, NZ on request | Gap |
The wider market, app by app
The same capabilities across the 2025 Gartner CLM leaders
native ◔partial, partner or sandboxed ○none. Competitor cells are our read of vendor material, mid-2026. The SignMe column is code-verified.
| DocuSign IAM app | DocuSign | Ironclad | Icertis | Agiloft | Sirion | Adobe Sign | SignMe |
|---|---|---|---|---|---|---|---|
| eSignature | ◔partner | ◔partner | ◔partner | native | |||
| Agreement Manager AI repository, extraction, search, reporting | ○ | ||||||
| Workflow Builder / Maestro | ◔routing | 46 activities | |||||
| Web Forms | |||||||
| Agreement Desk intake, triage, approvals, agents | agents | agents | ◔ | ◔ | agents | ○ | ◔human-in-the-loop |
| Agreement Preparation DocGen, clauses | ◔templates | ||||||
| Iris AI engine | ◔ | ◔no AI redlining, no agents | |||||
| ID Verification & Notary | ○ | ○ | ○ | ○ | ◔ | ◔OTP + access code; no notary | |
| Multi-channel SMS, WhatsApp | ○ | ○ | ○ | ○ | ◔ | ◔Twilio seam | |
| Monitor security events | ◔ | ◔ | ◔ | ◔ | ◔ | ◔hash-chained audit, no alerting | |
| Workspaces multi-document transaction | ◔ | ○ | ◔related agreements | ||||
| Connect / App Center / Admin | ◔API, webhooks, MCP; no named connectors | ||||||
| Salesforce-embedded | ○ |
Parity on the core five — signing, repository, workflow, forms, DocGen — with native signing that three of the CLM leaders source from a partner. The real gaps are the same three everywhere: autonomous agents, vendor-backed IDV and delivery (a config change once accounts exist), and named enterprise connectors. Data stays in Australasia (Sydney compute, Oceania storage), and nobody else in this table prices without an envelope meter. Conga sits just behind these five; name it if Salesforce comes up.
The honest other half
Where SignMe is already ahead
Features the others lack or only partly have. Same legend: native ◔partial, partner or sandboxed ○none. SignMe cells are code-verified; competitor cells are conservative reads of public material, mid-2026. Lead with the first two — no meter, extraction with no AI key — and the sovereignty line: data stays in Australasia, priced without a meter.
| Feature | DocuSign | SignMe | Ironclad | Icertis | Agiloft | Sirion | Adobe Sign |
|---|---|---|---|---|---|---|---|
| No envelope or transaction meter | ○metered | ◔seats; partner eSign metered | ◔ | ◔ | ◔ | ○metered | |
| Extraction works with no AI provider at all (deterministic rules extractor) | ○ | rules-v1 | ○ | ○ | ○ | ○ | ○ |
| NZ/AU legal framing on the certificate (CCLA, not US ESIGN boilerplate) | ○ | ○ | ○ | ○ | ○ | ○ | |
| Hosted in Australia (Sydney), NZ region on request; data stays in Oceania (R2 location hint OC) | ◔AU region | AU · ◔NZ on request | ○ | ○ | ○ | ○ | ◔AU region |
| Phone-scan wet-ink capture: QR → phone camera → ink clean-up → back into the ceremony | ◔draw/upload | ○ | ○ | ○ | ○ | ◔draw/upload | |
| Entity signing-authority rules (sole/all/any-N/named) attested on the certificate | ○ | ◔routing only | ◔ | ◔ | ◔ | ○ | |
| Signature waiver with the reason recorded on the certificate | ○ | ○ | ○ | ○ | ○ | ○ | |
| Approval-drift refusal: send blocked if value, law, document or counterparty changed after approval | ◔ | fingerprint | ◔ | ◔ | ◔ | ◔ | ○ |
| Kanban signing pipeline plus a stage-based register | ○flat task list | ◔ | ◔ | ◔ | ◔ | ○ | |
| Substring full-text search with no page ceiling | ◔prefix-only, 4-char min, 500-page cap | ○ | |||||
| Rules-vs-AI disagreement flagged on every extracted value | ○ | ○ | ○ | ○ | ○ | ○ | |
| Mandatory confidence-threshold review queue with PDF page and quote anchor | ◔recommended spot-check | ◔ | ◔ | ◔ | ○ | ||
| Statistical outlier detection within a contract type's own population | ◔ | sd / percentiles / z-score | ◔ | ◔ | ○ | ||
| Clause governance as a workflow: submit → approve → retire, self-approval blocked, approved versions immutable | ◔folder ACL | ◔ | ○ | ||||
| One unified redline view: document diff and Word tracked changes in one place | ◔two disconnected paths | ◔ | ◔ | ◔ | ○ | ||
| Counterparty negotiation portal with no seat and per-invite version redaction | ◔ | ◔ | ◔ | ◔ | ◔ | ○ | |
| Hash-chained audit log the customer can verify themselves | ◔immutable, not customer-verifiable | ◔ | ◔ | ◔ | ◔ | ◔ | |
| Evidence package with a CMS-signed manifest carrying the audit head | ◔certificate only | ○ | ○ | ○ | ○ | ◔ | |
| Customer-owned seal identity: an Azure Key Vault key per workspace | ◔CMEK for storage; the seal is DocuSign's | ○ | ○ | ○ | ○ | ○ | |
| Step-up re-authentication on seven guarded admin actions | ○ | ○ | ○ | ○ | ○ | ○ | |
| CSV register import with a dry run and an undo window | ◔no undo | ◔ | ◔ | ◔ | ◔ | ○ | |
| MCP server for AI agents (14 scoped tools) | ◔ | ○ | ○ | ○ | ○ | ||
| Idempotency-Key on mutating workspace API calls | ○ | ○ | ○ | ○ | ○ | ○ | |
| Public Trust page that says what is sandboxed versus live | ◔trust centre | ◔ | ◔ | ◔ | ◔ | ◔ | |
| AI is advisory only: no autonomous writes beyond a configurable auto-accept threshold | ○agents act | by design | ○ | ◔ | ◔ | ○ | n/a |
The last row is a governance stance, not a capability gap — say it deliberately. And keep the three real gaps in the same breath: autonomous agents, vendor-backed IDV and delivery, named enterprise connectors. On price: DocuSign's CLM Essentials tier runs roughly US$25 per user per month; CLM+ and enterprise IAM deals run US$25k–100k+ per year, plus US$200–350/hour services and US$1–2 per envelope overage. SignMe has no pricing code yet — a deliberately parked decision.
The detail behind the scorecard
Capability by capability, with the caveat that matters
| Capability | SignMe, this build | Honest caveat |
|---|---|---|
| Contract request intake | AI-triaged, human-converted request desk with a business-hours SLA | Triage card is empty without an AI key; status changes always stay a human click |
| Redlining / version compare | Major/minor versions, word-level diff, rollback, an AI summary, a real Office.js Word add-in | The add-in is check-out/check-in, not live sync; clause locks are an override-able gate on one upload path |
| Approval workflows | A matrix of 11 operators compiles to a real published workflow; rules are match-all or match-any with one nested group; a parallel rule can require every approver | Matches DocuSign's own documented Internal Approval step; first-approver-wins remains the default and is labelled as such |
| Workflow engine | 46 drag-and-drop activities, 9 trigger kinds, real cron, SLA calendar, escalation | The enterprise platforms list 100+ activities (DocuSign Maestro); escalation notifies, it does not reassign automatically |
| Recipient authentication | Access code and SMS-OTP real; phone-call, KBA and ID-document sandboxed | SMS delivery needs Twilio keys; eid is hard-disabled (HTTP 501) — never claimed |
| Fields on the executed PDF | Text, checkbox, radio, dropdown, number, date and formula values are burned into the sealed PDF | Attachment and stamp fields are placeable by API, not yet from the slot editor |
| Sealed execution | PKCS#7 with self-signed, PEM or real Azure Key Vault identity; prepare/stage/publish with leases | Key is HSM-held (Azure Key Vault) and every seal is DigiCert-timestamped; the certificate over the key is still self-signed — the AATL certificate (CSR ready) is investment-gated |
| Full-text search | FULLTEXT OR'd with a substring match, no page ceiling, ACL-scoped | Exceeds the documented limits of enterprise repository search (DocuSign: prefix-only, 4-char minimum, 500-page cap) — checkable, not assumed |
| OCR of scans | Ghostscript extraction always; tesseract OCR for scanned PDFs, live on the test environment | English only today; OCR runs in the background job queue, so a scan is filed immediately and becomes searchable a few minutes later |
| Key-term extraction | 113 built-in concepts plus schema-driven values; a regex rules extractor runs with no key at all | Concepts are present/absent findings with an excerpt; roughly 8–20 values per contract type are extracted |
| Public REST API | OpenAPI (141 paths), 15-scope keys with rate limiting, Idempotency-Key, HMAC webhooks over a 233-event catalogue, an MCP server with 14 tools | About 40% of routes are not yet in the spec; the Node and PHP SDKs are unpublished |
| SSO / SAML / SCIM | Entra + Google OIDC, a SAML 2.0 SP, SCIM Users + Groups, TOTP MFA, a permission-matrix editor; per-workspace sign-in policy (which of password / magic link / Google / Entra / SAML members may use, allowed IdP domains), identifier-first login, remember-this-device with rotating refresh tokens and replay detection, MFA once per device, mandatory MFA for platform admins | No real IdP is registered on this environment; SAML has no single logout. Remembered devices never loosen the magic link itself — it stays 15-minute, single-use |
| Security attestations | A controls document mapped to ISO 27001 Annex A | No certification is held; pen test → insurance → ISO 27001 readiness is the stated order, not a done one |