E-Signature
Oneflow
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Oneflow AB · oneflow.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Oneflow at a glance
- Vendor
- Oneflow AB
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Oneflow 1.5/5, the mean of 6 judges. Oneflow is an AI contract lifecycle management platform from Oneflow AB of Stockholm, listed on Nasdaq First North, covering digital contracts, electronic and digital signatures, proposals and quotes. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Oneflow is an AI contract lifecycle management platform from Oneflow AB of Stockholm, listed on Nasdaq First North, covering digital contracts, electronic and digital signatures, proposals and quotes. Strongest is integration and API, where scores hold at 4: connectors are named — Salesforce, HubSpot, Microsoft Office 365, Google Workspace, Teamtailor, Zapier — and the API is in the contracted service. Identity verification scores 4-5 on fifteen electronic IDs listed with their countries, set per participant or via the E-ID Hub, though the brokers behind them are not named. Weakest are sovereignty at 0-2, where the only location commitment is EU/EEA processing of meeting recordings and we found no public information on document storage, subprocessors or certifications; pricing transparency at 1-2, with no public information on plan prices and only dollar-marked AI add-ons as cost facts; and evidence and retention at 1-2, with no public information on an audit trail or completion certificate. Signature levels sit at 3: advanced signing is asserted via partner brokers, and we found no public information on levels by plan or country. flagged splits flag no split.
Speaks for it
- Named connectors for Salesforce, HubSpot, Microsoft Office 365, Google Workspace, Teamtailor and Zapier, with the API included in the contracted service and a developers help centre.
- Fifteen electronic IDs published with their countries — BankID, MitID, Smart-ID, D-Trust sign-me among them — assignable per participant or chosen by the signer through the E-ID Hub.
- Ready-made contract templates that can be used as-is or customized, across categories including employment agreements and leases.
- Contract status updates automatically from within connected business systems, with data pulled from your systems into the contract.
- The terms commit to returning your data or securely deleting it, with retrieval in a generally accepted format.
Held against it
- Sovereignty scored 0-2: meeting recordings are the only data stated to be processed within the EU/EEA, and we found no public information on where documents and identification data are stored, on subprocessors, or on certifications.
- We found no public information on plan prices, envelope or document limits, or per-signature fees; the only cost facts shown are AI add-ons marked with a dollar sign, alongside named-user seats, automatic renewal and a three-month notice period in the terms.
- Evidence and retention scored 1-2: we found no public information on an audit trail, certificate of completion, timestamp source or long-term validation for signed documents.
- We found no public information naming the brokers behind advanced signatures and electronic IDs, or mapping signature levels to plan or country.
- We found no public information on webhooks, rate limits, SDKs or embedded signing, leaving the developer story half-documented.
Best for
- You run Salesforce or HubSpot and want contract status to update automatically inside your CRM.
- Your signers use national electronic IDs such as BankID, MitID, Smart-ID or D-Trust sign-me across the Nordics, Germany, the Netherlands and the other listed countries.
- You send multi-party documents from customizable templates and want to set the signing method per participant.
- You want to evaluate on a trial that includes full Oneflow platform functionality.
Avoid if
- You must verify where signed documents and identification data are stored, and see a subprocessor list, before procurement — sovereignty scored 0-2 on this record.
- You need to prove a signature's validity years later against a documented audit trail or completion certificate — evidence and retention scored 1-2.
- You need public prices to budget a signing volume before talking to sales — pricing transparency scored 1-2.
- You require qualified signatures from a named trust service provider — signature levels scored 3, and we found no public information on levels by plan or country.
The scores
| Criterion | Panel median |
|---|---|
| eIDAS levels & trust services | 1.5 of 5 |
| Signer identification | 2 of 5 |
| Signing workflow & signer experience | 2 of 5 |
| Evidence, validation & retention | 1 of 5 |
| Integrations & API | 2 of 5 |
| European sovereignty | 1 of 5 |
| Pricing transparency | 0.5 of 5 |
eIDAS levels & trust services
Show reasoningHide reasoning
How this is scored
Which signature levels the platform offers — simple, advanced, qualified, and qualified seals — through which qualified trust service provider on the EU Trust List, for which countries and legal regimes (eIDAS, ZertES), and on which plans.
0 — No signature level named; the platform calls its signature "legally binding" without saying which kind it is.
3 — Simple signatures by default with "advanced" or "qualified" mentioned as available, but no trust service provider named and no statement on which plan or country offers which level.
5 — SES, AdES and QES offered and labelled in the product, the qualified trust service provider named, and which documents need which level explained for at least Germany or the EU.
8 — Every level documented with the plans and countries it is available in, the QTSP's entry on the EU Trust List linked, QES under eIDAS (and ZertES where relevant) stated, qualified electronic seals for company documents, and the signature level printed in the signed document and audit trail.
10 — Levels are an explicit product decision: the provider is or contracts a named QTSP with its conformity assessment published, level selection per document type or template, remote QES without a separate account, EUDI wallet support stated with a date, and the legal effect per level documented for the main EU markets.
The Legal Counsel
The pages name "electronic signatures" and "digital signatures" as modules and state Oneflow partners with brokers to provide Electronic IDs and advanced signatures in a wide range of countries, so advanced signing is at least asserted. But we found no public information naming simple, advanced or qualified levels per plan or country, no qualified trust service provider linked to the EU Trust List, and no statement on qualified seals or the legal effect of each level — the long list of national eIDs never says which eIDAS level a resulting signature carries. 5 1 5
The HR Operations Lead
The product labels "electronic signatures" and "digital signatures" and states that advanced signatures are provided through partner brokers, but we found no public information naming qualified signatures, the trust service provider behind them, or which plan and country delivers which level. For fixed-term contracts that need written form, I cannot confirm a qualified option from these pages. 5 5 7
The Revenue Operations Lead
The security pages say advanced signatures come through partner brokers alongside Electronic IDs, and the product pages list electronic and digital signatures as capabilities, but we found no public information on a qualified level, a named trust service provider, or which plan and country offers which level. I cannot tell a sales team which of their quotes need a qualified signature, because that mapping is not published. 5 5 1
The Integration Engineer
The captured pages advertise "electronic signatures" and "digital signatures" and say Oneflow partners with different brokers to provide "advanced signatures", but no level is ever labelled simple, advanced or qualified, and the trust service provider behind those brokers is never named. We found no public information on which plan or country delivers which level, on qualified seals, on an EU Trust List entry, or on whether the levels are reachable through the API rather than only the web app. 5 6 5
The Data Protection Officer
The captured pages advertise "electronic signatures" and "digital signatures" and mention that Oneflow partners with unnamed brokers to provide "advanced signatures" in a wide range of countries, but we found no public information on which plan or country offers which level. We found no public information on qualified signatures, qualified seals, eIDAS or ZertES labelling, or an entry on the EU Trust List. 5 5 7
The Skeptic
The pages speak of "electronic signatures" and "digital signatures", with "advanced signatures" supplied through partner brokers, but we found no public information naming a qualified trust service provider, a qualified level, electronic seals, or which plan or country delivers which level. That is precisely the tier where "advanced" is mentioned as available and the trust chain behind it is not shown. 5 5 1
Signer identification
Show reasoningHide reasoning
How this is scored
How the signer is identified for each level: email and SMS codes, video ident, eID card (Online-Ausweis), bank ident or EUDI wallet — who performs it, in which countries it works, and what happens to the ID data afterwards.
0 — Email link only; no statement on how signers are authenticated.
3 — Email plus SMS or access code, with "ID verification" mentioned as an add-on but no methods, provider or countries named.
5 — Identification methods for AdES and QES listed by name (for example video ident, eID, bank ident), the identification provider named, and the countries or ID documents they accept stated.
8 — Methods documented per level and country, automated and agent-based ident distinguished, reuse of an identification for later signatures explained, retention and deletion of ID data stated, and the ident provider listed as subprocessor.
10 — Identification is transparent end to end: every method with its countries, assurance level and failure rate or completion guidance, EUDI wallet and national eID supported, ID data minimisation and retention committed, and the signer-facing privacy notice published.
The Legal Counsel
The signing-methods page is the strongest legal disclosure here: fifteen named Electronic IDs with their countries (BankID in Sweden and Norway, MitID in Denmark, D-Trust sign-me in Germany, and so on), offered either participant-chosen through the E-ID Hub or sender-specified per participant. What I cannot verify is the chain of responsibility — Oneflow says it "partners with different brokers" without naming a single one — and we found no public information on which method yields which signature level, nor on retention or deletion of identification data. 5 5
The HR Operations Lead
The electronic ID signing page names fifteen electronic IDs with their countries — BankID, Smart-ID, MitID, iDIN and D-Trust sign-me for Germany among them — and lets me set the signing method per participant or present a choice list, which is what new hires actually need. The brokers performing the identification are not named, and we found no public information on assurance levels, what happens to identification data afterwards, or any subprocessor listing. 3 5 5
The Revenue Operations Lead
Fifteen Electronic IDs are published with their countries — BankID for Sweden and Norway, MitID for Denmark, D-Trust sign-me for Germany and the Nordics — and the sender can pin one method per participant or let signers choose from an eID hub. The brokers behind these IDs go unnamed, however, and we found no public information on what happens to identification data afterwards or on separate video or bank ident services. 5 5
The Integration Engineer
Identification methods are unusually well evidenced for this vendor: fifteen electronic IDs are listed with their countries, the sender can fix a method per participant or let participants choose from an approved list, and four signing methods are available per participant. The brokers who perform the identification are not named, though, and we found no public information on retention or deletion of identification data or on ident providers being listed as subprocessors. 5 5
The Data Protection Officer
The eID page is genuinely transparent at the method level, naming sixteen identification methods with the countries each works in, letting the sender restrict methods per participant while the participant picks a preferred eID. But the identification providers appear only as unnamed "brokers", the methods are not mapped to advanced or qualified signature levels, and we found no public information on where signer ID data is stored or how long it is kept. 3 5 5
The Skeptic
The eID pages publish a long method-by-country list — BankID, MitID, Smart-ID, D-Trust sign-me, iDIN and more — under two modes, standalone and hub, where the sender restricts methods and the participant picks. But identification is performed by "different brokers" we found no names for, no assurance level per method is stated, and we found no public information on retention or deletion of identification data or on the brokers as subprocessors — good method detail, weak trust chain. 5 5 3
Signing workflow & signer experience
Show reasoningHide reasoning
How this is scored
Getting a document out and back signed: templates and form fields, signing order and roles, bulk sending, reminders and delegation, signing without an account or app, mobile signing, and accessibility for signers.
0 — Single-recipient signing of an uploaded PDF; no templates, order or reminders.
3 — Multiple signers and basic templates, but no signing order, no bulk send, and signers must create an account.
5 — Templates with field placement, sequential and parallel signing order, automatic reminders and expiry, signing without an account on mobile, and a status overview for the sender.
8 — Roles and conditional fields, bulk sending, delegation and substitute signers, team and approval workflows, branded signer experience, signer languages listed, and signer accessibility addressed.
10 — The workflow is complete and documented: web forms and self-service signing links, mixed signature levels within one process, in-person and remote signing, a published accessibility conformance statement, and team administration with shared templates and audit of sender actions.
The Legal Counsel
Customisable templates across business categories, per-participant signing methods, and a contract-status overview with automatic updates from within business systems are documented, which covers multiple signers and sender control. We found no public information on signing order (sequential or parallel), reminders, expiry, bulk sending, or whether signers can sign without creating an account, and no accessibility conformance content was captured — so I stop short of crediting a complete signer experience. 7 1 8
The HR Operations Lead
Ready-made, customizable templates including an Employment Agreement and per-participant signing methods are documented, with automatic status updates from connected business systems. We found no public information on bulk sending, signing order, reminders and expiry, or whether signers can complete on a phone without creating an account — the exact things my two hundred contracts a year depend on. 5 7 1 8
The Revenue Operations Lead
Customizable ready-made contract templates, contract status that updates automatically inside the business systems, and per-participant signing methods cover the basics my reps need. We found no public information on signing order, automatic reminders, bulk sending, or whether signers can sign without creating an account — the pieces that decide whether a quote stalls in someone's inbox. 7 8 5
The Integration Engineer
Templates are strongly evidenced, ready-made and customizable across many document categories, the sender sets a signing method per participant, and contract status can be tracked from within the customer's business systems. We found no public information on signing order, bulk sending, reminders and expiry, delegation, signing without an account, or signer accessibility. 7 5 8
The Data Protection Officer
Templates in several categories, a searchable contract repository, status control with automatic updates from connected systems, and signers who choose an eID from a list are all documented. We found no public information on signing order, field placement, reminders and expiry, bulk sending, or the contents of a signer accessibility statement. 5 7 1 8
The Skeptic
Ready-made, customisable templates across several categories, per-participant choice among four signing methods, and automatic contract-status updates back into business systems are evidenced. We found no public information on signing order, reminders and expiry, bulk sending, delegation, mobile or account-free signing, or signer accessibility content on the accessibility page — so this sits at multiple signers plus templates. 7 5 8
Evidence, validation & retention
Show reasoningHide reasoning
How this is scored
What proves a signature years later: the audit trail and certificate of completion, qualified timestamps, long-term validation (PAdES-LTV), validation reports, and how long signed documents and evidence are kept — and whether they can leave the platform.
0 — A signed PDF and nothing else; no audit trail, no statement on storage or deletion.
3 — An audit trail or completion certificate exists, but its contents, the timestamp source and the retention period are unstated.
5 — Audit trail with signer events, IP addresses and authentication method embedded in or attached to the signed PDF, timestamps applied, documents downloadable, and the retention period stated.
8 — PAdES signatures with long-term validation, qualified timestamps from a named provider, a validation tool or report, configurable retention and automatic deletion, and bulk export of documents with their evidence.
10 — Evidence outlives the subscription: LTV and archive timestamps documented, validation verifiable with independent tools such as the EU DSS validator, export to a DMS or archive with evidence intact, and post-termination access and deletion committed in the terms.
The Legal Counsel
For a disputed contract eight years on, this record gives me almost nothing: no public information on an audit trail, a certificate of completion, timestamp source, long-term validation such as PAdES-LTV, or validation reports. The terms do commit the customer's data to return or secure deletion and export "in such generally accepted format", and internal deletion routines exist, but the published retention periods cover Oneflow's own business contacts and meetings — we found no statement on how long signed documents and their evidence are kept. 3 4
The HR Operations Lead
We found no public information on an audit trail, a certificate of completion, timestamp sources or long-term validation for signed documents. The terms do commit to export in a generally accepted format and a return-or-delete choice, and note that Oneflow may move a terminated customer to a free subscription — the only post-termination access signal found. 3 4
The Revenue Operations Lead
The terms commit to returning or deleting data in a generally accepted format after termination, and the privacy pages state deletion routines, but those statements cover personal data rather than signature evidence. We found no public information on an audit trail, a certificate of completion, timestamp sources or long-term validation, so I cannot say what proves a Oneflow signature three years from now. 3 4
The Integration Engineer
The captured pages never evidence an audit trail, completion certificate, timestamp source or long-term validation, which for me is the make-or-break since I archive signed documents in the DMS with their evidence intact. The terms do commit to returning or deleting data and to retrieval after termination in a generally accepted format, and the privacy notice states internal deletion routines, but we found no public information on how long signed documents and their evidence are kept. 3 4
The Data Protection Officer
We found no public information on an audit trail, certificate of completion, timestamp source or long-term validation for signed documents; the retention figures that are published cover business contacts, support enquiries, demo requests and meeting recordings, not signed documents and their evidence. The terms do commit to returning or securely deleting customer data on instruction, and to retrieval in a generally accepted format, which is the one reassurance in this area. 3 4
The Skeptic
We found no public information on an audit trail, completion certificate, timestamp source, long-term validation or a validation report — the things that prove a signature years later. The privacy notice states internal deletion routines and durations, and the terms commit to retrieving data after termination in a "generally accepted format" or secure deletion, with a possible free subscription after termination — real commitments, but about the vendor's data handling, not the signature's evidence. 3 4
Integrations & API
Show reasoningHide reasoning
How this is scored
Signing from inside the systems where contracts are made: a documented API with webhooks and a sandbox, embedded signing, and connectors for Microsoft 365, CRM, HR, DMS and ERP systems.
0 — No API and no integrations; everything happens in the vendor's web app.
3 — A few named integrations or a Zapier connector, and an API mentioned without public documentation.
5 — A documented REST API with webhooks and a sandbox, plus connectors for Microsoft 365 or Google Workspace and at least one CRM or HR system named.
8 — Embedded signing in the customer's own application, API access to every signature level, versioned API with rate limits published, SDKs, and connectors for named DMS, ERP or HR systems with their scope.
10 — Integration is a product: white-label and embedded flows documented, API parity with the web app, a status page with incident history, deprecation policy, and a marketplace of integrations with stated maintainers.
The Legal Counsel
The connector set is real and named — Salesforce, HubSpot, Microsoft Office 365, Google Workspace, Teamtailor, Zapier — spanning CRM, HR, ATS, ERP and automation categories, with a Developers help centre, partner-assisted custom integration, and terms contemplating sandbox test environments at Oneflow's sole discretion. We found no public information confirming a documented REST API with webhooks, published rate limits, or API access to each signature level, which is what I would need before wiring contracting systems to it. 4 9 8
The HR Operations Lead
Named connectors cover Salesforce, HubSpot, Microsoft Office 365, Google Workspace, Teamtailor and Zapier across CRM, HRM, ATS, ERP and recruitment categories, with a developers section, an API named in the service definition and partner support for custom projects. We found no public information on webhooks, a documented API sandbox for developers, or embedded signing in my own HR system. 4 8 9 8
The Revenue Operations Lead
Salesforce and HubSpot connectors with automatic status updates back into the CRM are exactly what I want to see, alongside Microsoft Office 365, Google Workspace, Teamtailor, Zapier, a developers resource and sandbox terms in the agreement. We found no public information on webhook documentation, published rate limits or API versioning, which is what separates a documented API from a named one. 4 8 9
The Integration Engineer
This is the strongest area on the record: the API is part of the contracted service, a developer help centre and custom-integration page exist, and connectors cover Microsoft Office 365, Google Workspace, Salesforce, HubSpot, Teamtailor and Zapier across CRM, HRM, ATS and ERP categories, with automatic data pull and status updates into business systems. But we found no public information on webhooks, API versioning, rate limits, SDKs or embedded signing in our own portal, and a sandbox appears only as a discretionary clause in the terms rather than a published environment. 4 8 9 8
The Data Protection Officer
Named connectors for Salesforce, HubSpot, Microsoft 365, Google Workspace, Teamtailor and Zapier across CRM, HR, ATS and ERP categories are documented, with a developers help center and partner support for custom integrations, and the terms mention discretionary test environments. We found no public information on webhooks, embedded signing, API versioning or rate limits. 4 6 9 8
The Skeptic
Named connectors — Salesforce, HubSpot, Microsoft Office 365, Google Workspace, Teamtailor, Zapier — plus partner-aided custom integration, and the API is part of the contracted service with developer documentation and sandbox-style test environments mentioned in the terms. We found no public information on webhooks, REST specifics, embedded signing, SDKs or rate limits, so the developer story stays half-documented. 4 8 9
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity, the trust service provider and their owners are, where documents, audit trails and ID data are stored and processed, and who the subprocessors are. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents and signer data are stored, and subprocessors unnamed.
3 — An EU entity contracts, but documents or signer data are processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data storage stated, with a DPA, but the hosting, identification or trust service chain is non-EU-controlled without a stated safeguard.
8 — EU entity, documents, audit trails and ID data stored in named EU data centres, an EU qualified trust service provider, subprocessor list with locations published, and certifications (ISO 27001, ETSI conformity) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity and EU QTSP, every processing location and subprocessor European, customer-selectable data residency, and certifications with their scope published.
The Legal Counsel
The independently sourced sovereignty attributes could not confirm the contracting entity's jurisdiction, ownership, data residency or subprocessor exposure from the vendor's own captured pages — every attribute is unknown. The only location commitment found is that recordings of Oneflow's own online meetings are processed within the EU/EEA, which says nothing about where signed documents, audit trails or signer identification data sit; we found no published subprocessor list with locations and no certifications. 3
The HR Operations Lead
The vendor is identified as Oneflow AB of Stockholm, listed on Nasdaq First North, but we found no public information on where signed documents and identification data are stored, on certifications, or on any subprocessor list. The only EU-processing commitment captured covers recordings of online meetings. 3 4 5
The Revenue Operations Lead
The only location commitment we found is that meeting recordings are processed within the EU/EEA, which says nothing about where signed documents and audit trails live. We found no public information on data residency for documents, the contracting entity's jurisdiction on the captured pages, the subcontractor list, or certifications such as ISO 27001. 3 4
The Integration Engineer
The contracting entity's jurisdiction, ownership, data residency and subprocessor exposure are all unconfirmed on the vendor's own captured pages; the only EU-processing statement is that meeting recordings stay within the EU/EEA, which does not cover customer documents or audit trails. We found no public information on storage locations for documents and identification data, or on certifications such as ISO 27001 or ETSI conformity. 3 4
The Data Protection Officer
The captured pages leave the contracting entity's jurisdiction and ownership unconfirmed, and we found no public information on where documents, audit trails and signer ID data are stored, on certifications, or on any subprocessor list — the only EU/EEA processing statement concerns Oneflow's own meeting recordings. Identification is delegated to unnamed brokers, so the trust service chain cannot be traced by a buyer or a regulator. 3 4 5
The Skeptic
The only processing-location statement on the vendor's captured pages is that meeting recordings are processed "within the EU/EEA" — we found no public information on where contracts, audit trails or identification data are stored, on the contracting entity's jurisdiction and ownership as confirmed on the vendor's own pages, or on any subprocessor. The privacy notice and terms govern data, but the European chain a buyer must verify is not shown. 3 4
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of their signing volume from public pages alone — plan prices, envelope or document limits, the per-signature price of AdES and QES, identification fees, API pricing and overage.
0 — No public prices at all; every plan is a sales conversation.
3 — Plan prices published, but envelope limits, QES and identification fees are unstated — the cost of a qualified signature is unknowable.
5 — Plans with envelope or document limits priced, but at least one commonly incurred cost (per-QES fee, video ident, API access, overage) is missing or "on request".
8 — Every plan and limit priced publicly, AdES and QES priced per signature, identification fees and overage stated, API pricing published, and contract term and notice period given.
10 — Complete cost computability: the cost of a given monthly volume per signature level derivable from public pages, volume tiers published, and every add-on and price-change term on a public page.
The Legal Counsel
The pricing page was captured twice and the only cost facts it yields are dollar-marked AI add-ons ("AI Review & Insights ($), AI Insights Premium ($)") and a full-platform trial — we found no public information on plan prices, envelope or document limits, or per-signature and identification fees, so the cost of any signing volume is not computable. Commercial terms are partly public: automatic renewal by default, self-serve plan changes, and a three-month termination notice. 2 4 2
The HR Operations Lead
The captured pricing pages show AI add-ons flagged with a ($) marker and trial support details, but we found no public information on plan prices, envelope or document limits, per-signature prices for advanced or qualified signing, or identification fees. The terms publish auto-renewal and a three-month notice period, yet the cost of my yearly contract volume cannot be computed from public pages. 2 4 2
The Revenue Operations Lead
The pricing page shows feature lists and marks two AI add-ons with a dollar sign, but we found no public information on plan prices, envelope or document limits, or per-signature fees, so the cost of any signing volume is a sales conversation. The terms do publish auto-renewal, named-seat licensing and a three-month notice period, which is the only cost structure a buyer can read before talking to sales. 2 4 2
The Integration Engineer
The captured pricing page offers a full-platform trial and lists AI Review & Insights and AI Insights Premium marked with a dollar sign, but we found no public information on plan prices, envelope or document limits, or the per-signature cost of advanced and qualified signatures. The only public cost terms are the three-month termination notice and automatic renewal, so a buyer cannot compute any signing volume from these pages. 2 4 2
The Data Protection Officer
No plan price, envelope or document limit, or per-signature fee for any signature level appears on the captured pricing pages — only dollar markers against AI add-ons and a demo booking flow — so the cost of a given signing volume is not computable from public information. The terms do publish a three-month notice period, default auto-renewal and self-serve plan changes. 2 4 2
The Skeptic
The captured pricing page shows premium AI features flagged "($)" and trial text — we found no plan prices, no envelope or document limits, and no per-signature fee for advanced or qualified signing or identification on the captured pages. The terms fix structure only: named-user seats, automatic renewal, a three-month notice period, self-serve plan changes — not one figure a buyer could compute a volume with. 2 2 4
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Oneflow
Is Oneflow European?
Yes. whats-best.ai classifies Oneflow as EU-Made.
Where does Oneflow store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Oneflow have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Oneflow?
As of 15 Oct 2026, the panel rates Penneo (2.5/5), Youtrust (Yousign) (2.5/5) and MOXIS (2.5/5) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Penneo (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Oneflow alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data residency. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 50 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 43 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 17 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 2 Pricing page oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 3 Privacy policy oneflow.com Checked 13 Oct 2026 Details →
- 4 Terms of service oneflow.com Checked 13 Oct 2026 Details →
- 5 Signer identification — found from sitemap oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 6 Signing workflow & signer experience — found from sitemap oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 7 Signing workflow & signer experience — found from sitemap oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 8 Integrations & API — found from sitemap oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 9 Integrations & API — found from sitemap oneflow.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →