LEGALESIGN LIMITED

Legalesign

Legalesign is a UK-hosted electronic signature (eSignature), electronic witnessing (eWitness), enterprise agreement platform. Organisations prepare, send, sign, witness, approve and manage agreements digitally. It supports Advanced Electronic Signatures (AES), Qualified Electronic Signatures (QES), document workflows, integrations and APIs, helping public sector teams manage high-volume digital agreement processes.

Features

• Electronic Signatures (e-signature), eWitnessing, Approvals and acknowledgement workflows
• Advanced Electronic Signature (AES) & Qualified Electronic Signatures (QES)
• Document templates, reusable form fields and configurable signing workflows
• Team workspaces with role-based access controls, permissions and SSO
• Central Inbox for documents awaiting signature, witnessing or approval
• Bulk Send for high-volume electronic signature and document workflows
• REST, GraphQL APIs, components, embedded signing, forms and direct links
• UK data residency, live document tracking and comprehensive audit trails
• Microsoft Power Automate connector and Word add-in for integrated workflows
• Salesforce integration for sending, tracking and managing documents

Benefits

• Reduce agreement turnaround times across teams and departments
• Replace paper-based processes with secure digital document workflows
• Enable collaboration while maintaining control over sensitive documents
• Provide clear visibility of document status and completion
• Support enterprise-scale sending with consistent governance and controls
• Allow users to manage documents privately within team workspaces
• Integrate document workflows into existing business systems
• Capture acknowledgements and approvals with a complete digital record
• Reduce manual errors and administrative overhead
• Security controls aligned with UK Government Security Classification principles

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@legalesign.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

511386219798112

Contact

Nicholas Morris
01223628950
sales@legalesign.com

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Document
        • Document
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: • REST API and GraphQL API; • Microsoft Approved Connector (Power Automate, Dynamics 365, SharePoint); • Salesforce app; • Integrations with third-party business systems (for example CRM, mortgage and time-recording platforms); • Direct links and embeddable / componentised widgets
• Cloud deployment model: Public cloud
• Service constraints: The service is delivered as a web-based, multi-tenant SaaS and requires an internet connection and a modern supported web browser. Downtime is rare; service availability and any incidents are transparently published via a public status and uptime page (https://status.legalesign.com/). Planned maintenance is carried out outside of core UK business hours and is communicated in advance. Some advanced functionality may require API access or third-party integrations to be enabled.
• System requirements:
  • Modern supported web browser
  • Internet connection
  • Network access permitting outbound secure WebSocket connections (for real-time updates)
  • Email access for notifications and signing links
  • API access credentials (only if using integrations)

User support

• Email or online ticketing support: Yes
• Support response times: Support is provided according to SLA, or best efforts basis if none.; ; Average response times are 1hr30 for email.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Legalesign provides UK-based support as part of all standard subscriptions. Unless an SLA is agreed, support is delivered on a best-effort basis during UK business hours via email and telephone. Typical response times during UK business hours are under 5 minutes for phone calls and under 2 working hours for email.; ; Customers have access to online documentation for the web application and APIs, including implementation guidance, configuration options and troubleshooting resources.; ; Enterprise and public sector customers are assigned a named Account Manager at no additional cost. The Account Manager supports onboarding, advises on configuration and workflows, and acts as the escalation point for support issues. Where required, issues can be escalated internally to senior technical staff.; ; Legalesign offers an optional Service Level Agreement (SLA) covering service availability, with a monthly uptime target of 99.95%. Where the SLA applies, service credits may be issued if availability falls below the agreed threshold. SLA terms and service credits are provided at no additional cost on eligible plans.; ; No separate paid support tiers are required for standard use. Additional services such as bespoke configuration, document preparation, training, or dedicated support arrangements can be provided by agreement and are charged separately.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Legalesign supports users getting started through structured onboarding, online guidance and optional training. Enterprise and public sector customers are typically onboarded using a phased, team-by-team approach to minimise disruption and support adoption.; ; Onboarding includes initial configuration of teams, branding, email content, reminder schedules and signer experience settings, followed by workflow design sessions to align Legalesign with existing document processes. Customers are supported in setting up templates, roles and fields, either directly in Legalesign or using text tags within upstream documents.; ; Live training sessions are provided to introduce core concepts and walk through real workflows. Follow-up sessions after go-live are recommended to address questions, clarify workflows and support early adoption.; ; Users have access to an online support hub containing implementation guides, how-to articles and videos. Technical users can also access API and integration documentation covering REST and GraphQL APIs, embedded pages and component-based integrations.; ; Ongoing support is provided via documentation, email and telephone support during UK business hours, with account manager support for enterprise customers.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Users can extract their data directly from the Legalesign platform during the contract term and prior to contract end. Authorised users can download documents and related document information via the web application.; ; Where customers require structured access to their data, Legalesign provides APIs that allow programmatic access to customer data during the contract period.; ; If data extraction is required at contract end beyond standard self-service or API capabilities, this can be discussed and agreed with the customer as part of the offboarding process. Where manual or bespoke extraction is required, this may be provided as a chargeable professional service to cover developer or operational time, subject to agreement.; ; Following contract termination and completion of any agreed data extraction, customer data is deleted in accordance with Legalesign’s documented data retention and deletion policies.
• End-of-contract process: At the end of the contract, customers retain access to the Legalesign platform until the agreed contract end date. During this period, authorised users can continue to access their account and extract their data using standard self-service features, including downloading documents and related document information via the web application. This is included in the price of the contract.; ; Programmatic access to customer data via Legalesign’s APIs during the contract term is also included.; ; If additional support is required at contract end, such as manual or bespoke data extraction beyond standard self-service or API capabilities, this can be discussed and agreed with the customer as part of the offboarding process. Any such activity may be provided as a chargeable professional service to cover developer or operational time, subject to agreement.; ; Following contract termination and completion of any agreed data extraction, customer data is deleted in accordance with Legalesign’s documented data retention and deletion policies.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Legalesign is fully responsive and works across modern desktop, tablet and mobile browsers. The signing experience (for signers, witnesses and approvers) is optimised for mobile use, including touch-friendly layouts and navigation. Sending and administration functions are optimised for desktop use.
• Service interface: Yes
• Description of service interface: Legalesign provides browser-based service interfaces including the main web application for sending, signing, witnessing, approving and managing documents, plus an API interface (API dashboard) for managing API access and credentials. The service includes administrative controls for user management, templates, permissions, reporting and GDPR settings. Users also have access to an online support hub containing product documentation, configuration guides and help articles. In addition, Legalesign provides programmatic access via REST and GraphQL APIs, and integrations with third-party platforms such as Microsoft Power Automate and Salesforce.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Legalesign designs its service interface to meet WCAG 2.2 AA requirements and considers accessibility throughout product development. Testing includes internal accessibility reviews, keyboard navigation checks, screen reader testing, colour contrast validation and responsive layout testing across devices. Accessibility improvements are informed by user feedback, including feedback from public sector customers, and are incorporated into ongoing development and refinement of the interface.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Legalesign is API-first through REST and GraphQL APIs. All functions of the system are available through the API. Additionally, installable UI components, a realtime webhooks system and a realtime websockets system are available. Customers integrate agreement workflows into their own systems and processes, including document preparation, electronic signing, witnessing and approvals/acknowledgements. Using the API, users can create and manage documents from templates, populate sender and recipient data, define workflow order, send documents to participants, and retrieve completed documents and completion evidence. API access and reporting is managed through a dedicated API dashboard.; ; For integration into third-party applications, Legalesign supports embedding and component-based approaches. Customers can embed Legalesign pages for document preparation and signing, and can also install Legalesign components (widgets) into their own software. The Edit component enables document preparation and field placement within external applications; signing components are being introduced to support end-to-end embedded workflows.; ; Single Sign-On (SSO) is supported and configured via the web administration interface. Where SSO is enabled, user access is controlled by the customer’s identity provider and Legalesign does not manage or store user passwords. Some configuration and billing controls are managed through the web interface rather than the API.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can customise Legalesign through configuration options available in the web application and via APIs, subject to role-based permissions. Organisation and team administrators can configure branding elements such as logos, colours, email templates and sender details, and can control language, reminders, signing options and security settings.; ; Users can customise workflows by creating and managing document templates, defining signing, witnessing and approval order, adding fields, and configuring document behaviour. Data retention rules and GDPR-related controls can also be configured at organisation level.; ; For technical users, customisation is available through REST and GraphQL APIs, embedded signing pages, and component-based integrations that allow Legalesign functionality to be incorporated into other systems.; ; Customisation is performed by authorised users such as organisation administrators, team administrators and permitted technical users. End users and external signers do not have access to administrative customisation features. Core application functionality is provided as standard and is not modified on a per-customer code basis.

Scaling

• Independence of resources: Legalesign is a multi-tenant SaaS service. Customer separation is implemented at the software level, with customers able to request infrastructure-level separation if required. The platform is hosted on AWS and uses services including VPC, EC2, Lambda, Step Functions, AppSync (GraphQL) and API Gateway. Legalesign utilises infrastructure-as-code for infraops. Service capacity is monitored using AWS CloudWatch dashboards and alarms, and capacity planning is performed to ensure the service can meet increases in demand without impacting other users.

Analytics

• Service usage metrics: Yes
• Metrics types: Legalesign provides service usage metrics through real-time dashboards and reporting within the web application. Metrics include documents created and sent, document status (completed, pending, declined, expired), timestamps for key events, signer participation, user activity, and extracted field data from documents.; ; Graphical reports show trends such as document volumes over time. Support metrics, including ticket status and activity, are available via the support hub. Usage and event data can also be accessed programmatically via the REST and GraphQL APIs.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can export their data directly from the Legalesign platform during the contract term using self-service features within the web application. Authorised users can download signed documents and associated metadata at any time.; ; Where customers require structured or automated access to their data, Legalesign provides REST and GraphQL APIs to enable programmatic export during the contract period.; ; If additional assistance is required at contract end (for example bulk or structured exports beyond standard self-service capabilities), this can be agreed as part of the offboarding process, in line with existing support arrangements.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XLSX
  • PDF
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • PDF
  • JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Legalesign provides a Service Level Agreement (SLA) for availability. For qualifying subscriptions, Legalesign commits to a monthly uptime percentage of 99.95%, measured over one-minute intervals.; ; If the service does not meet the guaranteed availability level, customers may be eligible for service credits, calculated as a percentage of the charges paid for the affected billing period, in accordance with the SLA terms. Service credits are applied against future invoices.; ; Availability excludes planned maintenance periods, which are announced in advance via the service status page, and outages caused by factors outside Legalesign’s reasonable control, including customer actions, unsupported inputs, beta services, or force majeure events.; ; Full details of eligibility, exclusions, and the service credit claim process are set out in the Legalesign Service Level Agreement.
• Approach to resilience: Legalesign is designed as a resilient, cloud-native SaaS platform hosted on Amazon Web Services (AWS). The service is deployed using highly available AWS infrastructure, with redundancy built into core components to reduce single points of failure.; ; The platform is designed to scale to handle variations in demand, with capacity monitored continuously to identify and address potential issues before they impact users. Data is stored on resilient, managed storage services with built-in redundancy, and regular backups are taken in line with Legalesign’s business continuity and disaster recovery policies.; ; Legalesign operates a documented Business Continuity Management System and Disaster Recovery Plan, which are regularly reviewed and tested. Planned maintenance is managed and communicated in advance, and service health is monitored to support rapid detection, response, and recovery in the event of an incident.; ; Datacentre resilience and physical security are provided by AWS, which operates ISO-certified facilities with independently audited resilience controls.
• Outage reporting: Legalesign reports service availability and outages via a public service status page, which provides real-time and historical information on platform availability and incidents.; ; For significant incidents, Legalesign communicates directly with affected customers through in-application notifications and email updates, providing clear information on impact, progress, and resolution.; ; Where appropriate, Legalesign produces post-incident reports outlining the cause of the issue, customer impact, resolution steps taken, and preventative measures. Customers can also contact the Legalesign support team directly for incident-related queries, with updates reflected through the support hub.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Platform users authenticate using unique usernames and passwords; passwords must adhere to a defined strong password standard as set out in Legalesign’s information security policies. Multi-factor authentication (2FA/MFA) is supported and can be enforced at team level, and is mandatory for users with API dashboard access. Legalesign also supports identity federation (SSO) with third-party identity providers. Programmatic access is controlled using API credentials over TLS. Login activity is recorded; Team Admins can view login logs for users in their team.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Legalesign operates a mature information security management framework aligned with ISO/IEC 27001, which has been independently certified for multiple years. The framework is supported by a comprehensive suite of documented information security policies and procedures covering areas including access control, data protection, secure development, change management, incident management, business continuity, supplier management, and acceptable use.; ; Information security responsibilities are clearly defined, with senior management retaining oversight and accountability. Policies are approved at management level and reviewed regularly through formal management reviews and an internal audit programme.; ; Compliance with information security policies is enforced through role-based access controls, secure system configuration, logging and monitoring, and mandatory security awareness training for staff. Security incidents, risks, and non-conformities are recorded, reviewed, and escalated where appropriate, with corrective actions tracked to completion to support continuous improvement.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Legalesign operates a documented configuration and change management process aligned with ISO/IEC 27001. Service components, including application code, infrastructure configuration, and dependencies, are tracked through their lifecycle using version control and an internal change schedule.; ; All changes are formally recorded, risk assessed, and approved prior to implementation. Security impact is considered as part of change assessment, including potential effects on confidentiality, integrity, and availability. Changes are tested before deployment and include rollback plans where appropriate. Emergency changes follow a defined expedited process and are reviewed retrospectively. Compliance is monitored through internal audit and management review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Legalesign operates a documented vulnerability management process aligned with ISO/IEC 27001. Potential threats are identified through secure development practices, dependency and vulnerability scanning, external penetration testing by a CREST-approved provider, and review of threat intelligence from vendors and industry sources.; ; Identified vulnerabilities are risk assessed based on severity and potential impact. Remediation actions are prioritised accordingly and tracked through to resolution. Patches and fixes are deployed using controlled change management processes, with higher-risk issues addressed as a priority. Vulnerability management activities and outcomes are reviewed through internal audit and management review.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Legalesign operates protective monitoring using application logging, security event monitoring, and cloud-native monitoring tools. Potential compromises are identified through alerts on anomalous behaviour, access patterns, errors, and system health indicators, supported by endpoint protection and infrastructure monitoring.; ; When a potential compromise is detected, incidents are investigated in line with the documented incident management process. Access may be restricted, affected components isolated, and remedial actions taken as appropriate.; ; Incidents are prioritised based on severity and impact, with higher-risk events escalated promptly. Monitoring and incident response activities are reviewed to improve detection and response effectiveness over time.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Legalesign operates a documented incident management process aligned with ISO/IEC 27001. Pre-defined procedures exist for common events, including security incidents, data breaches, compromised credentials, and service availability issues.; ; Users can report incidents via the Legalesign support channels, including email and the support hub, where incidents are logged and tracked.; ; Incidents are assessed, prioritised by severity and impact, and managed through investigation, containment, remediation, and recovery steps. Where appropriate, customers are kept informed during an incident and provided with a post-incident report outlining the issue, impact, resolution, and preventative actions taken.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Legalesign offers a free 14-day trial with full access to the web application feature set. Trials are limited to one team with unlimited users. API access is available with sandbox restrictions and throttling; API- trials are available for one month. Rolling monthly contracts allow short proof-of-concept use.
• Link to free trial: https://legalesign.com/landing/free-trial/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 25%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Thursday 20 November 2025
• What the ISO/IEC 27001 doesn’t cover: The ISO/IEC 27001 certification covers the development and operation of Legalesign’s electronic signature and document management SaaS platform. Activities outside the certified scope include non-production marketing websites, third-party customer systems, and customer-managed devices or environments that interact with the service but are not operated or controlled by Legalesign.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: C23dbea6-6a23-4791-ad1b-b19a3a5defad
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 1125b045-8ccf-4263-b963-ce9c8c34b5a9
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@legalesign.com. Tell them what format you need. It will help if you say what assistive technology you use.