E-Signature
sign-me
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by D-Trust GmbH · www.d-trust.net
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
sign-me at a glance
- Vendor
- D-Trust GmbH
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates sign-me 2.5/5, the mean of 6 judges. sign-me is D-Trust GmbH's remote signature service; the vendor is itself the qualified trust service provider of the Bundesdruckerei group. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
sign-me is D-Trust GmbH's remote signature service; the vendor is itself the qualified trust service provider of the Bundesdruckerei group. Scores are strongest on signature levels, clustering at 5-6, and identity verification at 5-7: all eIDAS levels are covered, the qualified signature is stated to equal a handwritten signature and fulfil the written-form requirement, and identification runs via AusweisIDent, VideoIdent or Point-of-Sale-Ident. Weakest is pricing transparency at 0-1 — beyond two free qualified signatures at registration, every cost is a sales conversation. Signing workflow and integration and API sit at 3-4: signers must register and identify before signing, templates and workflows exist only on the portiQ or signature-server route, and no public API documentation, webhooks, sandbox or named connectors appear. Sovereignty splits the judges from 3 to 6: four credit the documented German chain — a Berlin entity, the sealing service in the vendor's own German data centre, only hash values exchanged for sealing — while the Data Protection Officer at 3 and the Revenue Operations Lead at 4 weigh the unconfirmed storage of portal documents and signer data, with no published subprocessor list or ISO 27001 certification.
Speaks for it
- All eIDAS signature levels are covered, with the qualified signature stated as equal to a handwritten signature and fulfilling the written-form requirement
- Identification methods are named — AusweisIDent, VideoIdent and Point-of-Sale-Ident — with the German ID card, electronic residence permit and EU citizen card accepted
- Every qualified signature automatically carries a qualified timestamp with the LTV function for long-term verifiability
- Qualified certificate and proof data are kept permanently under § 16 Abs. 4 VDG, with log files deleted after at most forty-five days
- The API reaches every signature level via portiQ, direct API or partner application, deployable on-premises or as managed cloud
Held against it
- Beyond the two free qualified signatures at registration, we found no public plan prices, per-signature fees, limits or API pricing — packages are quoted by the sales team
- Every signer must register and complete one-time identification before any signature in the portal
- Templates, workflows and PDF forms exist only as functions of the portiQ connection or signature server, not in the portal itself
- We found no public API documentation, webhooks, sandbox, SDKs or named connectors for Microsoft 365, CRM, HR or document management systems
- We found no public information on where sign-me documents and signer identification data are stored, on a subprocessor list, or on certifications such as ISO 27001
Best for
- You need qualified electronic signatures with the same legal effect as a handwritten signature that fulfil Germany's written-form requirement
- Your signers hold German ID cards, electronic residence permits or EU citizen cards and can identify once via AusweisIDent or VideoIdent
- You archive signed documents for years and rely on automatic qualified timestamps, the LTV function and permanent certificate retention under § 16 Abs. 4 VDG
- You seal large document volumes automatically and need documents to stay in your own environment, with only hash values exchanged with the German data centre
Avoid if
- You must compute the cost of a real signing volume before purchase — ask the vendor: the public pages we read do not show it
- Your signers would balk at registering and completing a one-time identification before their first signature
- You run high-volume contract sending from a portal — the documented flow is a four-step self-signing process aimed at freelancers, self-employed and private individuals
- Your compliance review requires published API documentation or named connectors before you wire signing into Microsoft 365, a CRM or an HR system
The scores
| Criterion | Panel median |
|---|---|
| eIDAS levels & trust services | 3 of 5 |
| Signer identification | 3 of 5 |
| Signing workflow & signer experience | 2 of 5 |
| Evidence, validation & retention | 2.5 of 5 |
| Integrations & API | 2 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 0.5 of 5 |
eIDAS levels & trust services
Show reasoningHide reasoning
How this is scored
Which signature levels the platform offers — simple, advanced, qualified, and qualified seals — through which qualified trust service provider on the EU Trust List, for which countries and legal regimes (eIDAS, ZertES), and on which plans.
0 — No signature level named; the platform calls its signature "legally binding" without saying which kind it is.
3 — Simple signatures by default with "advanced" or "qualified" mentioned as available, but no trust service provider named and no statement on which plan or country offers which level.
5 — SES, AdES and QES offered and labelled in the product, the qualified trust service provider named, and which documents need which level explained for at least Germany or the EU.
8 — Every level documented with the plans and countries it is available in, the QTSP's entry on the EU Trust List linked, QES under eIDAS (and ZertES where relevant) stated, qualified electronic seals for company documents, and the signature level printed in the signed document and audit trail.
10 — Levels are an explicit product decision: the provider is or contracts a named QTSP with its conformity assessment published, level selection per document type or template, remote QES without a separate account, EUDI wallet support stated with a date, and the legal effect per level documented for the main EU markets.
The Legal Counsel
All three eIDAS levels are named, simple and advanced triggered without a second factor in the portal, and the qualified trust service provider is D-Trust itself, the trust provider of the Bundesdruckerei group, with QES stated to equal a handwritten signature and to satisfy the written-form requirement, alongside qualified and advanced seals issued to organisations. We found no public information tying levels to plans or countries, no link to the provider's entry on the EU Trust List, and no statement that the chosen level is printed in the signed document or its evidence, which is what the higher anchors turn on. 2 5 6 7 12 14
The HR Operations Lead
All three eIDAS levels are labelled and the vendor is itself the trust service provider of the Bundesdruckerei group, with qualified seals covered in unusual depth and the written-form effect of the qualified signature spelled out for Germany. I found no public information on which plans or countries carry which level, no link to the provider's EU Trust List entry, and nothing on ZertES or the signature level being printed in the signed file or audit trail. 2 6 7 14 15
The Revenue Operations Lead
Simple, advanced and qualified signatures are all labelled, every eIDAS level is covered, and D-Trust itself is the named trust service provider — with usable guidance that QES replaces the handwritten signature for written form and AES suits internal approval processes. What holds it back: we found no public information on which plan or country offers which level, no link to the EU Trust List entry, and nothing on ZertES or the signature level being printed in the signed document and audit trail. 2 14 15 7 6
The Integration Engineer
All three eIDAS levels are labelled, the provider names itself as the qualified trust service provider of the Bundesdruckerei group, seals are qualified and issued to organisations, and the legal effect of the qualified signature plus the internal-approval use case for advanced signatures are spelled out for Germany. I found no public information on which plan or country carries which level, a link to the EU Trust List entry, or the level being printed in the signed document and its audit trail, which keeps this below the top band. 2 5 7 14 15
The Data Protection Officer
D-Trust is itself the trust service provider of the Bundesdruckerei group and covers all signature levels under eIDAS plus qualified and advanced seals, with the qualified signature stated as equal to a handwritten signature and fulfilling the written-form requirement. We found no public information on which plan or country offers which level, a link to the provider's EU Trust List entry, or the signature level printed in the signed document and audit trail. 14 2 6 7 5
The Skeptic
Simple, advanced and qualified signatures are named and distinguished (advanced and simple triggered without a second factor), and — the point I read for first — the qualified trust service provider is the vendor itself, the trust service provider of the Bundesdruckerei group, with qualified and advanced seals for organisations offered alongside. Which level suits which document is sketched (advanced for internal approval processes, qualified meeting the written-form requirement), but we found no public information on which plan or country offers which level, no EU Trust List link, and no statement that the level is printed in the signed document or audit trail. 2 6 7 14 15
Signer identification
Show reasoningHide reasoning
How this is scored
How the signer is identified for each level: email and SMS codes, video ident, eID card (Online-Ausweis), bank ident or EUDI wallet — who performs it, in which countries it works, and what happens to the ID data afterwards.
0 — Email link only; no statement on how signers are authenticated.
3 — Email plus SMS or access code, with "ID verification" mentioned as an add-on but no methods, provider or countries named.
5 — Identification methods for AdES and QES listed by name (for example video ident, eID, bank ident), the identification provider named, and the countries or ID documents they accept stated.
8 — Methods documented per level and country, automated and agent-based ident distinguished, reuse of an identification for later signatures explained, retention and deletion of ID data stated, and the ident provider listed as subprocessor.
10 — Identification is transparent end to end: every method with its countries, assurance level and failure rate or completion guidance, EUDI wallet and national eID supported, ID data minimisation and retention committed, and the signer-facing privacy notice published.
The Legal Counsel
Identification before QES is named by method — AusweisIDent via the German ID card's eID function, VideoIdent, or Point-of-Sale-Ident — operated jointly by D-Trust and Governikus, with accepted documents listed (German ID card, electronic residence permit, EU citizen card) and notified eID means of other EU states covered. The privacy policy states what happens to ID material, including permanent retention of qualified-certificate data under § 16 Abs. 4 VDG, and identification is described as a one-time step before QES use. We found no public subprocessor list for the identification chain and no assurance levels or completion guidance per method. 2 3 5 8 9 15
The HR Operations Lead
AusweisIDent via the German ID card's eID function and VideoIdent are named, the identification service is co-developed with Governikus and offered by D-Trust itself, and the accepted documents — German ID card, electronic residence permit, EU citizen card, plus notified eIDs of other EU states — are close to what my applicant pool actually holds. The gaps that matter to a recruiter: automated versus agent-based identification is not distinguished, reuse of an identification for later contracts is only implied by a one-time identification requirement, and no subprocessor listing appears; retention of ID data is stated as permanent for qualified certificates under the VDG with logfiles deleted after forty-five days. 2 3 8 9 15
The Revenue Operations Lead
Identification methods are named — AusweisIDent via the German ID card's eID, VideoIdent and Point-of-Sale-Ident — with D-Trust and Governikus named behind AusweisIDent, the accepted ID documents listed, other EU states' notified eID means offered as an option, and a one-time identification required before QES use. Retention of certificate and ID data is stated, with permanent safekeeping for qualified certificates under the VDG. We found no public information distinguishing automated from agent-based identification or naming identification providers as subprocessors. 15 9 2 3 8 5
The Integration Engineer
Identification routes are named — eID via AusweisIDent developed with Governikus, VideoIdent and point-of-sale reading — with the accepted ID documents stated, a stated option to use other EU states' notified eIDs, and the privacy policy listing ID data categories and deletion periods for logs and certificate records. I found no public information on the identification provider appearing as a subprocessor, methods broken down per level and country, or whether one identification is reused for later signatures. 2 3 8 9 15
The Data Protection Officer
Methods are named — AusweisIDent via the eID function of the German ID card, VideoIdent, and Point-of-Sale-Ident — performed by D-Trust itself or external parties, with AusweisIDent jointly developed with Governikus and the accepted documents listed (German ID card, electronic residence permit, EU citizen card) plus an eIDAS option for notified eID means of other EU states. Beyond the permanent safekeeping of certificate data under section 16 VDG we found no public information on retention and deletion of ID copies and biometric photos, on reuse of an identification for later signatures, on a signer-facing privacy notice, or on the identification provider appearing in a subprocessor list. 2 15 9 3 5
The Skeptic
Identification for the qualified level is concrete: AusweisIDent through the German ID card's eID, VideoIdent, and Point-of-Sale-Ident, developed with Governikus, with the German ID card, electronic residence permit and EU citizen card named and an option for other EU states' notified eID means. Retention is stated — qualified certificate data kept permanently under the VDG, log files deleted after forty-five days. We found no public information distinguishing automated from agent-based identification, on reuse of an identification for later signatures, or on a subprocessor list naming the identification provider. 2 3 8 9 15
Signing workflow & signer experience
Show reasoningHide reasoning
How this is scored
Getting a document out and back signed: templates and form fields, signing order and roles, bulk sending, reminders and delegation, signing without an account or app, mobile signing, and accessibility for signers.
0 — Single-recipient signing of an uploaded PDF; no templates, order or reminders.
3 — Multiple signers and basic templates, but no signing order, no bulk send, and signers must create an account.
5 — Templates with field placement, sequential and parallel signing order, automatic reminders and expiry, signing without an account on mobile, and a status overview for the sender.
8 — Roles and conditional fields, bulk sending, delegation and substitute signers, team and approval workflows, branded signer experience, signer languages listed, and signer accessibility addressed.
10 — The workflow is complete and documented: web forms and self-service signing links, mixed signature levels within one process, in-person and remote signing, a published accessibility conformance statement, and team administration with shared templates and audit of sender actions.
The Legal Counsel
The portal flow is register and identify, upload, sign with two-factor authentication on smartphone, tablet or laptop with no extra hardware, then download — while workflows, templates and PDF forms exist only as functions of the portiQ or D-Trust signature server. A published accessibility statement covers the sign-me web portal and new PDFs are prepared to the PDF/UA standard. We found no public information on multiple signers in one process, signing order, reminders, expiry, bulk sending or delegation, and registration plus identification is required before signing. 1 2 10 11 14 15
The HR Operations Lead
Signing from phone, tablet or laptop with no extra hardware is well evidenced, there is a published accessibility statement for the sign-me portal, and new documents are aimed at PDF/UA. But the portal workflow is register, identify, upload, sign, download — templates and workflows exist only as functions of portiQ or the signature server — and I found no public information on bulk sending, signing order, reminders or a sender status overview, which is what two hundred contracts a year needs. 1 2 10 11 14 15
The Revenue Operations Lead
The portal flow is register, identify, upload, sign with two-factor and download — a self-signing tool where every signer must first register and be identified, which is exactly where my quotes would stall. Workflows and templates appear only as functions of the portiQ connection or the signature server on the enterprise route. We found no public information on signing order, bulk sending, automatic reminders or a sender status overview, though mobile signing and a published accessibility statement for the web portal are genuine bright spots. 2 14 15 10 11 1
The Integration Engineer
The portal flow is register and identify, log in, upload, sign with two-factor, download — reachable from smartphone, laptop or tablet — and templates, workflows and PDF forms exist, but only as functions of the signature server or portiQ rather than in the portal itself, and signers must register first. I found no public information on signing order, multiple signers, bulk sending, reminders or delegation; the published accessibility statement for the web portal is the one piece that goes beyond the basics. 1 2 10 14 15
The Data Protection Officer
The portal flow is documented as four steps — registration with identification, log-in, upload and signing with two-factor authentication, download — and signing from tablet and smartphone is stated, with a published accessibility statement for the sign-me web portal and PDF/UA targeted for new documents. We found no public information on signing order, parallel signing, bulk sending, reminders, delegation or substitute signers, and registration with one-time identification is a prerequisite for signers. 2 15 10
The Skeptic
The portal flow is a four-step register, identify, upload, sign-and-download aimed at individuals signing their own documents, with templates, workflows and PDF-form handling available only through the signature-server or portiQ connection, mobile signing via smartphone or tablet, and a published accessibility statement for the web portal. We found no public information on signing order, bulk sending, reminders, delegation or a sender status overview, and the portal requires registration and identification before any signature. 2 10 14 15
Evidence, validation & retention
Show reasoningHide reasoning
How this is scored
What proves a signature years later: the audit trail and certificate of completion, qualified timestamps, long-term validation (PAdES-LTV), validation reports, and how long signed documents and evidence are kept — and whether they can leave the platform.
0 — A signed PDF and nothing else; no audit trail, no statement on storage or deletion.
3 — An audit trail or completion certificate exists, but its contents, the timestamp source and the retention period are unstated.
5 — Audit trail with signer events, IP addresses and authentication method embedded in or attached to the signed PDF, timestamps applied, documents downloadable, and the retention period stated.
8 — PAdES signatures with long-term validation, qualified timestamps from a named provider, a validation tool or report, configurable retention and automatic deletion, and bulk export of documents with their evidence.
10 — Evidence outlives the subscription: LTV and archive timestamps documented, validation verifiable with independent tools such as the EU DSS validator, export to a DMS or archive with evidence intact, and post-termination access and deletion committed in the terms.
The Legal Counsel
Every qualified signature automatically receives a qualified timestamp from the provider itself, with the long-term validation function and long-term archiving explicitly documented and tampering said to become clearly visible in common programs, and retention is stated: permanent keeping of qualified signature and seal certificate and proof data under § 16 Abs. 4 VDG, log files deleted after at most forty-five days. We found no public information on a customer-facing audit trail or completion certificate, a validation report or independent validator, configurable retention, or export of documents together with their evidence. 2 3 7 14
The HR Operations Lead
Every qualified signature is automatically given a qualified timestamp with long-term validation for permanent verifiability, tampering is shown clearly in common programs, signed files are downloadable, and certificate data is retained permanently under the VDG. I found no public information on an audit trail or completion certificate and its contents, on how long the signed documents themselves are kept, or on a validation report or bulk export of documents with their evidence. 2 3 14 15
The Revenue Operations Lead
Every qualified signature is automatically given a qualified timestamp with the long-term validation function documented, later manipulation is made clearly visible in common programs, certificate evidence is retained permanently under the VDG, and the flow ends with downloading the signed document. But we found no public information on an audit trail with signer events, IP addresses or authentication method, on a validation report or tool, or on how long signed documents remain retrievable — let alone after a subscription ends. 14 15 3 2 5
The Integration Engineer
Every qualified signature automatically carries a qualified timestamp with the LTV function for long-term verifiability, manipulation is said to become clearly visible in common viewers, and signed documents are downloadable. For my archive requirements the gaps matter: I found no public information on the audit trail's contents, a validation tool or report, retention or deletion periods for signed documents, or bulk export with evidence intact into a document management system. 2 3 5 14 15
The Data Protection Officer
Every qualified signature automatically receives a qualified timestamp with the LTV function for long-term verifiability, and certificates, certificate-proof data and contact data are kept permanently under section 16 VDG — a solid evidentiary commitment — while IP address pairs and access times are logged as a data category. We found no public information on the audit trail's contents travelling with the signed document, on a validation tool or report, on bulk export of documents with their evidence, or on post-termination access and deletion. 14 2 3 5
The Skeptic
Every qualified signature automatically carries a qualified time stamp from the vendor itself, the LTV function for permanent verifiability is named explicitly, and tampering after signing is made visible in common programs. We found no public information on an audit trail or completion certificate and its contents, on a validation tool or report, and on how long signed documents are kept — only the retention of certificate and identification data under the VDG appears in the privacy policy. 2 3 14 15
Integrations & API
Show reasoningHide reasoning
How this is scored
Signing from inside the systems where contracts are made: a documented API with webhooks and a sandbox, embedded signing, and connectors for Microsoft 365, CRM, HR, DMS and ERP systems.
0 — No API and no integrations; everything happens in the vendor's web app.
3 — A few named integrations or a Zapier connector, and an API mentioned without public documentation.
5 — A documented REST API with webhooks and a sandbox, plus connectors for Microsoft 365 or Google Workspace and at least one CRM or HR system named.
8 — Embedded signing in the customer's own application, API access to every signature level, versioned API with rate limits published, SDKs, and connectors for named DMS, ERP or HR systems with their scope.
10 — Integration is a product: white-label and embedded flows documented, API parity with the web app, a status page with incident history, deprecation policy, and a marketplace of integrations with stated maintainers.
The Legal Counsel
sign-me offers a direct API aimed at embedding into existing applications and specialised procedures, covers all eIDAS signature levels through the API, connects via portiQ, direct API or partner applications, with the seal-me sealing service attachable in every variant and on-premise installation available for data sovereignty. We found no public API documentation, no webhooks or sandbox, no named connectors for Microsoft 365, CRM, HR, DMS or ERP systems, and no rate limits or SDKs. 1 2 14 15
The HR Operations Lead
sign-me can be reached three ways — the portiQ appliance, a direct API into existing applications, or partner applications — with the remote sealing service attachable in every variant and deployment on-premise or as managed cloud. No public API documentation, webhooks, sandbox, SDKs or named connectors for Microsoft 365, CRM or HR systems appear on the captured pages, so signing from inside my HR system is not something I can see. 1 14 15
The Revenue Operations Lead
The API story is real positioning — portiQ, direct API or partner application as connection options, aimed at companies and authorities embedding signatures into their own applications, backed by a partner network of signature and workflow providers with a list in the FAQ. We found no public API documentation, no webhooks or sandbox, and no named connectors for Microsoft 365, a CRM, HR or DMS system — so I cannot wire signing events into my pipeline or send from the CRM today. 14 15 1 2
The Integration Engineer
The API is a first-class product here — embedding into existing applications and specialised procedures, every eIDAS signature level reachable through it, three connection options including an on-premise or managed-cloud portiQ, seal-me attachable in every variant, and for seals only hash values exchanged so documents never leave the customer's IT. What I need before committing is not visible: I found no public information on API documentation, webhooks, a sandbox, versioning or rate limits, nor named connectors for Microsoft 365, CRM, HR or DMS systems — the partner network is referenced but its members are not in the captured pages. 1 7 9 14 15
The Data Protection Officer
An API is offered with three connection variants — portiQ, direct API and partner application — deployable on-premises or as a managed cloud, and a partner network of signature and workflow providers is described, with the remote sealing service attachable in every variant. We found no public API documentation, no webhooks or sandbox, and no named connectors for Microsoft 365, CRM, HR or document management systems. 14 15 7
The Skeptic
The API is a primary product, not an afterthought: all signature levels via API, three connection variants (signature server, direct API, partner application), on-premise or managed-cloud deployment, and a partner network of signature and workflow providers. We found no public information on API documentation, webhooks, a sandbox, SDKs, or any named connector for Microsoft 365, CRM, HR or DMS systems. 2 14 15
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity, the trust service provider and their owners are, where documents, audit trails and ID data are stored and processed, and who the subprocessors are. Independently sourced by the sovereignty pipeline.
0 — Non-EU contracting entity, no statement on where documents and signer data are stored, and subprocessors unnamed.
3 — An EU entity contracts, but documents or signer data are processed outside the EU by default without an explained safeguard, or the subprocessor list is absent.
5 — EU contracting entity and EU data storage stated, with a DPA, but the hosting, identification or trust service chain is non-EU-controlled without a stated safeguard.
8 — EU entity, documents, audit trails and ID data stored in named EU data centres, an EU qualified trust service provider, subprocessor list with locations published, and certifications (ISO 27001, ETSI conformity) published.
10 — Sovereign end to end and evidenced: European ownership, EU entity and EU QTSP, every processing location and subprocessor European, customer-selectable data residency, and certifications with their scope published.
The Legal Counsel
D-Trust GmbH in Berlin, the trust provider of the Bundesdruckerei group, runs the sealing service in its own highly secure data centre in Germany with only hash values exchanged so documents never leave the customer's environment, and on-premise installation or managed cloud is offered. The independently collected sovereignty attributes nevertheless report the contracting entity's jurisdiction, ownership, data residency and subprocessor exposure as not confirmed on the captured vendor pages, and we found no subprocessor list with locations and no published certifications such as ISO 27001. 3 7 10 14
The HR Operations Lead
The captured pages show a Berlin group entity — D-Trust as the Bundesdruckerei group's trust service provider, with the website's controller named as Bundesdruckerei GmbH at a Berlin address — and the sealing service runs in the vendor's own highly secure data centre in Germany, with only hash values exchanged so documents never leave the customer's IT environment. I found no public information on a subprocessor list with locations, on published certifications such as ISO 27001 or ETSI conformity, or on where the sign-me portal's signed documents are stored. 3 5 7
The Revenue Operations Lead
The visible chain is thoroughly German: D-Trust as the Bundesdruckerei group's trust service provider, keys and the seal service in its own highly secure German data centre with only hash values ever exchanged, and on-premise installation or managed cloud as deployment choices. But we found no public information on where sign-me documents and signer data are stored, no subprocessor list with locations, and no published certifications such as ISO 27001 on the captured pages. 7 6 14 3 10
The Integration Engineer
The chain looks German end to end as captured: D-Trust GmbH in Berlin, trust service provider of the Bundesdruckerei group, seal-me run from its own high-security data centre in Germany, and signature-creation components held in D-Trust's secured environment. I found no public information on a subprocessor list with locations, ISO or ETSI certifications, or where sign-me's own documents and signer ID data are stored, which caps this well below the top band. 3 7 10 14
The Data Protection Officer
The captured pages show D-Trust GmbH in Berlin, part of the Bundesdruckerei group, running its own highly secure data centre in Germany for the sealing service, where only hash values are exchanged so documents stay in the customer's environment, and D-Trust acts as a processor under instruction. We found no public information on where sign-me documents, audit trails and identification data are stored, who the subprocessors are, or certifications such as ISO 27001 with their scope, and the independently collected sovereignty attributes remain unconfirmed on the vendor's own pages. 3 7 6 10
The Skeptic
The chain that is documented is German end to end: D-Trust GmbH in Berlin as contractor, the trust services operated by the vendor itself as part of the Bundesdruckerei group, seal-me in the company's own data centre in Germany, and for remote sealing only hash values exchanged so documents never leave the customer's environment. We found no public information on where sign-me portal documents and signer identification data are stored, on a subprocessor list with locations, or on certifications such as ISO 27001 on the captured pages. 3 7 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the cost of their signing volume from public pages alone — plan prices, envelope or document limits, the per-signature price of AdES and QES, identification fees, API pricing and overage.
0 — No public prices at all; every plan is a sales conversation.
3 — Plan prices published, but envelope limits, QES and identification fees are unstated — the cost of a qualified signature is unknowable.
5 — Plans with envelope or document limits priced, but at least one commonly incurred cost (per-QES fee, video ident, API access, overage) is missing or "on request".
8 — Every plan and limit priced publicly, AdES and QES priced per signature, identification fees and overage stated, API pricing published, and contract term and notice period given.
10 — Complete cost computability: the cost of a given monthly volume per signature level derivable from public pages, volume tiers published, and every add-on and price-change term on a public page.
The Legal Counsel
The only public price information we found is two free qualified signatures included on registration, no quantity limit on seal-me seals, and the terms' optional automatic renewal with six weeks' notice before expiry. Packages are otherwise quoted by the sales team, and we found no public plan prices, per-signature QES or identification fees, envelope limits or API pricing, so the cost of any real signing volume is not computable from public pages. 2 5 7
The HR Operations Lead
The only pricing-adjacent disclosure is that registration includes two free qualified signatures; no plan prices, envelope limits or per-signature qualified fees appear anywhere, and packages are handled through a sales consultation with the vendor's sales team. For a fixed price per qualified signature known before the employment contract goes out, the public pages give me nothing to compute from. 2 7
The Revenue Operations Lead
The only public number is two free qualified signatures included at registration; package pricing is explicitly routed to the sales team for consultation. We found no public information on plan prices, envelope or document limits, per-signature fees for advanced or qualified signatures, identification fees or API pricing — I cannot compute the cost of any signing volume from these pages. 2 7
The Integration Engineer
The only price-adjacent statement I found is that registration includes two free qualified signatures; no plan prices, envelope or document limits, per-signature fees for advanced or qualified signatures, identification charges or API pricing are public. Beyond the free pair, cost appears to be a conversation with the sales team. 2 15
The Data Protection Officer
The only public cost statement we found is two free qualified electronic signatures included with registration; everything else is routed to the sales team, which advises on the "passenden Paketen". No plan prices, per-signature fees for advanced or qualified signatures, identification fees, limits or overage terms appear on the captured pages. 2 7
The Skeptic
The only cost statement on the captured pages is that registration includes two free qualified electronic signatures; beyond that, buyers are referred to the sales team for advice on suitable packages. We found no public information on plan prices, envelope or document limits, per-signature qualified fees, identification fees, or API pricing — the cost of any real signing volume is a sales conversation. 2 7
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about sign-me
Is sign-me European?
Yes. whats-best.ai classifies sign-me as EU-Made.
Where does sign-me store data?
The default storage location for customer data is not stated on the vendor’s pages as of 13 Oct 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 13 Oct 2026.
Does sign-me have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to sign-me?
As of 15 Oct 2026, the panel rates Penneo (2.5/5), Youtrust (Yousign) (2.5/5) and MOXIS (2.5/5) highest among the other 14 E-Signature products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Penneo (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: sign-me alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Data residency. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 19 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (15)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.d-trust.net Checked 13 Oct 2026 Details →
- 2 Product page www.d-trust.net Checked 13 Oct 2026 Details →
- 3 Privacy policy www.d-trust.net Checked 13 Oct 2026 Details →
- 4 Legal notice www.d-trust.net Checked 13 Oct 2026 Details →
- 5 Terms of service www.d-trust.net Checked 13 Oct 2026 Details →
- 6 EIDAS levels & trust services — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 7 EIDAS levels & trust services — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 8 Signer identification — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 9 Signer identification — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 10 Signing workflow & signer experience — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 11 Signing workflow & signer experience — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 12 Evidence, validation & retention — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 13 Evidence, validation & retention — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 14 Integrations & API — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →
- 15 Integrations & API — found from sitemap www.d-trust.net Checked 13 Oct 2026 Details →