EquaSign

Description

EquaSign lets you send a document for electronic signature and collect a legally meaningful signature without leaving your WordPress site. It is built around a simple, honest promise: every completed signature produces a self-contained proof file that can be verified independently, offline, with no dependency on our servers.

EquaSign implements a Simple Electronic Signature (SES) in the sense of the eIDAS regulation. It is designed for everyday agreements — quotes, mandates, consent forms, internal approvals, service contracts — where a clear, auditable record of who signed what, and when, is what matters.

What it does

  • Send a document (PDF) to a signer by email for signature.
  • Verify the signer’s access with a one-time code (OTP) sent over your site’s email system.
  • Let the signer review the document and apply a signature (typed signature rendered on the document).
  • Seal the signed result and generate a proof file for the transaction.
  • Keep a tamper-evident record: the proof is sealed with an Ed25519 cryptographic signature so any later modification is detectable.

Self-contained, verifiable proof

The distinguishing feature of EquaSign is that the proof of a signature does not rely on our infrastructure to stay valid. Each proof bundle is cryptographically sealed and can be verified on its own, offline. Your evidence keeps its value even if you stop using the plugin.

Works on its own

EquaSign is fully functional on its own. Installing it, adding your document type and model, and configuring an email transport (see below) is enough to start collecting signatures. No account on any external service is required for the core signing workflow.

Data ownership

Documents, signer information and proof files stay in your own WordPress site’s database and uploads. EquaSign does not send your documents, your signers’ personal data, or the content of any transaction to us or to any third party.

EquaSuite

EquaSign is part of EquaSuite, a set of independent WordPress plugins that also work well together. EquaSign works perfectly well by itself; the rest of the suite is optional.

A Pro version of EquaSign is available separately (distributed outside WordPress.org) and unlocks additional features. The free version shown here is complete for the core simple-signature workflow.

External services

This plugin can connect to one external service, described below so you know exactly what is sent, when, and why. It never receives your documents, your signers’ personal data, or the content of any signing transaction.

EquaSuite content service — marketing.equadev.fr

The plugin can display EquaSuite news and information banners inside the WordPress admin. This feature is off by default and only makes a request if you explicitly opt in. When enabled, and only while viewing an EquaSign admin screen, the plugin requests this content from https://marketing.equadev.fr. The request sends only a product identifier (equasign), a language/locale value, and a display slot. It sends no personal data and no document content.

Email delivery. EquaSign sends access codes and invitations through your site’s own email system (the transactional email plugin or SMTP transport you configure). EquaSign itself holds no third-party email credentials; any connection to an email provider is made by that provider’s own plugin, not by EquaSign.

Terms. By using these optional services you agree to the EquaSign End User License Agreement: https://equasuite.equadev.fr/legal/license/20260727-en.pdf

Third-party libraries

EquaSign bundles the following third-party libraries (under vendor-equasign/), all under a GPL-compatible licence. Versions are pinned; see docs/CREDITS.md for details.

  • TCPDF (LGPL-3.0-or-later) — PDF rendering, signature overlay and proof page.
  • FPDI (MIT) — importing the pages of the source PDFs.
  • Dancing Script (SIL Open Font License 1.1) — the handwriting font of the typed-signature mode.

Screenshots

Installation

  1. Upload the plugin to /wp-content/plugins/equasign, or install it from the WordPress plugin directory.
  2. Activate the plugin through the Plugins screen in WordPress.
  3. On first activation, review and accept the End User License Agreement when prompted.
  4. Configure an email transport so EquaSign can deliver access codes and invitations (see the FAQ — “Do I need anything else to send emails?”).
  5. Open the EquaSign menu to create your first document type and model, then send your first document for signature.

Requirements

  • WordPress 6.0 or later.
  • PHP 7.4 or later.
  • The PHP sodium extension is recommended (WordPress ships a pure-PHP fallback, so EquaSign also works without it; enabling the native extension is recommended for optimal security).
  • A working email transport on your site (see the FAQ).

FAQ

Do I need anything else to send emails?

Yes. EquaSign sends access codes (OTP) and invitations by email, and — like every WordPress plugin that sends email — it needs a working email transport on your site. WordPress does not deliver email reliably on its own.

We recommend installing and configuring a transactional email provider (for example the Brevo plugin) with your own sending domain (SPF/DKIM) for good deliverability. EquaSign does not include or require any email credentials of its own: it hands the message to whatever transport your site is configured to use. If no dedicated transport is configured, an optional wp_mail() fallback can be enabled, but without a properly configured SMTP transport messages may be rejected or land in the recipient’s spam folder.

Is this a qualified electronic signature?

No. EquaSign implements a Simple Electronic Signature (SES) as defined by eIDAS. It is not an Advanced (AdES) or Qualified (QES) electronic signature. It is intended for everyday agreements where a clear, auditable record is what you need.

Can the proof be verified without your servers?

Yes. Each proof bundle is sealed with an Ed25519 signature and is designed to be verified independently and offline. The validity of your evidence does not depend on our infrastructure.

Does EquaSign send my documents or my signers’ data anywhere?

No. Your documents, your signers’ personal data and your proof files stay in your own WordPress site. EquaSign does not transmit them to us or to any third party. See “External services” below for the full list of the (few, optional) external calls the plugin can make.

Where is my data stored?

In your own WordPress database and uploads directory. You remain the sole owner of your data.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“EquaSign” is open source software. The following people have contributed to this plugin.

Contributors

Translate “EquaSign” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.0.3

  • Security hardening and WordPress.org coding-standards compliance: stricter input validation and output escaping, safer file-upload handling, and internal naming cleanup. No change to the signing, sealing, or proof workflow, or to your data.

1.0.2

  • Build-derivation hardening: the free build no longer ships any code, flag, or wording for features it does not include. No change to the signing, sealing, or proof workflow, or to your data.

1.0.1

  • WordPress.org review compliance: removed the Pro-feature upsell teasers, replaced the in-admin Pro installer with an outbound link, moved inline scripts and styles to the native enqueue functions, dropped the bundled translations (served by translate.wordpress.org), and added direct-access guards to the vendored files.

1.0.0

  • First public release.
  • Simple Electronic Signature (SES, eIDAS) workflow: send, verify by one-time code, sign, seal.
  • Self-contained, offline-verifiable proof file sealed with an Ed25519 signature.
  • Works without the native PHP sodium extension (WordPress pure-PHP fallback supported).
  • Compatible with WordPress 6.0+ and PHP 7.4+.