SignContract for WooCommerce

Description

SignContract for WooCommerce lets store owners require document approval or electronic signature after checkout for selected products or categories. Merchants can assign signing templates to products or categories, define a fallback template, send signing links to customers, and show signing status in WooCommerce orders.

This WooCommerce approval workflow helps merchants collect document approval and electronic signing where required as part of their order process. The signing process is handled by the SignContract service, while WooCommerce displays the relevant signing status and order metadata.

Features include:

• Require approval or signature after checkout for selected WooCommerce products or categories.
• Assign agreement templates at product or category level.
• Configure a fallback signing template.
• Support PDF and supported image documents when supported by the SignContract service.
• Create customer signing links after checkout.
• Let customers sign by drawing, typing, or uploading a signature image.
• Show signing link expiry to customers.
• Include signing link expiry in customer email.
• Configure signing links from 1 to 168 hours, with a maximum of 168 hours / 7 days.
• Track signing status in WooCommerce order admin.
• Preserve historical signing metadata after disabling the integration.
• Show signed PDF and verification information when available.
• Export signed documents and audit metadata when available.
• Show plan, monthly usage, subscription renewal, and usage reset in WooCommerce admin.
• Configure template-based workflow actions after successful signing.
• Optionally update WooCommerce order status after signing when configured in the selected signing template.

SignContract account required

This plugin requires an active SignContract account and API key. Some features require an active paid subscription, except where a new customer free trial is available. The plugin connects to SignContract servers to create signing sessions, process documents, store signed files, and return status and verification data.

The plugin does not provide a complete local signing service by itself. Signing sessions, document processing, signed document storage, verification data, account usage, and subscription information are provided by SignContract.

External services

This plugin connects to the SignContract service at https://signcontract.app and https://api.signcontract.app/api. The service is provided by SignContract / Tengo International GmbH.

The SignContract service is required for this plugin to create signing sessions, process agreement documents and templates, generate signing links, store signed documents according to the merchant’s plan, provide verification metadata, return account/subscription/usage status, and send webhook updates back to WooCommerce.

Data sent to SignContract may include:

• Site URL or domain.
• WooCommerce order ID or order reference.
• Product, category, and template metadata needed to select the correct signing document.
• Customer name and email when needed to create or send signing sessions.
• Store owner or administrator email when needed for account connection, metadata, or support context.
• Agreement documents or templates uploaded by the merchant.
• Signature field positions and visible PDF seal preference.
• Signature method metadata, such as drawn, typed, or uploaded signature method, and typed signer name where used.
• Return URL, public signing frontend URL, webhook URL, webhook URL host, and generated webhook secret shared server-to-server for webhook HMAC verification.
• Connect token, plugin version, site locale, source identifier, and business account identifier when present during account connection or subscription management.
• Signing session status and webhook metadata.
• Signed document metadata, document hashes, and verification URLs.
• API key authentication headers or tokens required to authenticate store API requests.

Data may be sent when:

• Connecting the store to SignContract or exchanging a connection token.
• Opening SignContract pricing, checkout, subscription, or billing management pages from WooCommerce admin.
• Creating or refreshing a signing session.
• Preparing or editing a signing template.
• A customer signs a document.
• The plugin checks account, subscription, or usage status.
• Webhooks update WooCommerce order status or signing metadata.

Terms of Service: https://signcontract.app/terms
Privacy Policy: https://signcontract.app/privacy
Data Processing Agreement: https://signcontract.app/dpa

This plugin may redirect store owners to Stripe’s billing portal for subscription management. Stripe provides payment processing and billing services used by SignContract. When a store owner accesses billing management, the browser is redirected to Stripe’s hosted billing portal.

Data sent to Stripe indirectly via SignContract may include:

• Business account email.
• Subscription plan and billing details.

Stripe’s billing portal is hosted at https://billing.stripe.com.

Stripe Terms of Service: https://stripe.com/ssa
Stripe Privacy Policy: https://stripe.com/privacy

Privacy and data retention

Signed documents and metadata may be stored by SignContract according to the merchant’s selected plan and retention or download availability period. Signing link expiry controls how long a pending signing link remains valid. It is separate from signed PDF download availability or retention after signing.

Merchants are responsible for informing their customers that order and signing data may be processed by SignContract and for updating their store privacy policy accordingly.

Suggested privacy policy text:

When a product or order requires document approval or electronic signature, we may send order details, customer contact information, and the relevant agreement document to SignContract to create and process a signing session. SignContract may store signed documents and verification metadata according to our selected plan and retention settings.

Security

• Signing links are tokenized and expire.
• Expired signing links show an expired-link message.
• Webhooks are signed and verified using HMAC signatures created with a generated webhook secret shared server-to-server with SignContract.
• The API key is used for authenticated API requests from WooCommerce to SignContract.
• The generated webhook secret is used only to verify webhook callbacks from SignContract to WooCommerce.
• API keys and webhook secrets are stored in WordPress options.
• Technical server-to-server settings are hidden in production where applicable.

Developer Notes

• Technical connection settings may be shown in local or development environments only.
• Production uses configured service defaults or constants where applicable.
• Run Plugin Check before release.
• Do not include secrets in the plugin package.

License

GPLv2 or later.