DocuSeal

DocuSeal is an open-source e-signature platform: build PDF forms with a drag-and-drop editor, send them for legally binding signatures, and keep every signed document on infrastructure you control. Deploying it on CloudStation gives you a self-hosted DocuSign alternative with no per-signature fees, without setting up servers, PostgreSQL, domains, or SSL yourself.

This guide takes you from deploy to your first signed document. If you use Charlie, you can also just ask: "Deploy DocuSeal and help me set up email."

What this template deploys

Component	Value
DocuSeal	`docuseal/docuseal:3.2.5` (pinned; you choose when to update)
Database	Dedicated PostgreSQL 16 with a 10 GB persistent volume
Documents	10 GB persistent volume mounted at `/data/docuseal`, so uploads and signed files survive restarts and redeploys
Security	A unique `SECRET_KEY_BASE` generated per deployment, HTTPS enforced (`FORCE_SSL`), free SSL on your CloudStation domain
Health	HTTP health check on `/up`, automatic restarts on failure

You do not need Redis or object storage: DocuSeal runs its own job queue inside the container and stores files on the volume. Object storage (S3-compatible) is only worth adding if you run several DocuSeal replicas.

Deploy DocuSeal

Open the template

Go to the DocuSeal template in the CloudStation store and click Deploy Now.

Choose where it runs

Pick the workspace and project, then click Deploy Template. Both services (DocuSeal and its PostgreSQL) are created together; no variables need to be filled in.

Wait for it to come up

The first start runs database migrations and takes about two minutes. When the service shows Running, open the URL under Your App URLs in the service panel.

Charlie can do the same from chat or through the cs CLI (cs template deploy docuseal --project <project-id>). Either way, the two setup steps below are returned with the deployment so nothing is missed.

Open your DocuSeal link and fill in the short setup form to create your admin account. There is no default username or password; the first person to open the app becomes the administrator.

If you see the sign-in page instead of the form, an account already exists. Sign in at /sign_in or use Forgot your password? (requires email, see below).
Turn on two-factor authentication for the admin account under your profile once you are in.
The URL you enter during setup becomes DocuSeal's App URL, which it uses to build links in emails. Keep it as your public address.

Email (SMTP)

DocuSeal uses your own email account to send signing requests, reminders, and password-reset links. Until email is connected, you can create documents but recipients will not receive invitations. Setup takes about two minutes and you can do it in the app, or ask Charlie.

In the app (recommended)

Sign in as the admin and go to Settings → Email.
Enter the details from your email provider: host, port, username, password, and the from-address.
Click Save. DocuSeal sends you a test message immediately; if it fails, the error is shown on the same page.

Common providers:

Provider	Host	Port	Notes
Gmail / Google Workspace	`smtp.gmail.com`	`587`	Use an App Password, not your account password
Microsoft 365 / Outlook	`smtp.office365.com`	`587`	SMTP AUTH must be enabled for the mailbox
Your company mail server	ask your IT team	`587` (STARTTLS) or `465` (SSL)

With Charlie

Ask Charlie: "Set up email for my DocuSeal." Charlie asks which email account you use and for the connection details, then applies them and redeploys. Nothing changes until you confirm.

With environment variables (advanced)

If you prefer configuration as code, set these variables on the docuseal service, then redeploy it: SMTP_ADDRESS, SMTP_PORT (587 for STARTTLS, 465 for SSL), SMTP_USERNAME, SMTP_PASSWORD, SMTP_FROM (required). Optional: SMTP_AUTHENTICATION (plain or login), SMTP_DOMAIN, SMTP_ENABLE_STARTTLS (default true), SMTP_ENABLE_SSL (true for port 465 only), SMTP_SSL_VERIFY (default true).

Never leave SMTP_ADDRESS empty

If SMTP_ADDRESS exists but is empty, DocuSeal switches to environment-based email and silently ignores the settings you enter under Settings → Email. Mail stops without an error. Either set all the variables with real values, or do not create SMTP_ADDRESS at all and use the in-app settings.

Send your first document

Create a template

In DocuSeal, click Create and upload a PDF (a contract, NDA, offer letter, consent form). DocuSeal turns it into a reusable signing template.

Place the fields

Drag signature, initials, date, text, checkbox, and other fields onto the pages and assign each field to a signer role (for example Client, Company).

Send for signature

Click Send, enter each signer's name and email, and set the signing order if it matters. Signers receive a link by email and sign in the browser or on their phone. They do not need a DocuSeal account.

Get the signed PDF

When everyone has signed, DocuSeal emails the completed document to all parties and stores it with an audit log (who signed, when, from where). You can download it any time from Submissions.

Invite your team

Go to Settings → Users to add colleagues. Each user gets their own login; templates and submissions are shared within the account.

API, webhooks, and automations

DocuSeal has a full REST API for creating templates, sending documents, and fetching signed files, plus webhooks for events such as form completed. Create an API token under Settings → API, and configure webhook URLs under Settings → Webhooks. This is how you connect DocuSeal to your own app, or to Zapier, Make, and n8n.

See the DocuSeal API documentation for endpoints and the embedding guide to put the signing form inside your own website.

Custom domain

Add your own domain from the service panel under Custom Domain; CloudStation provisions SSL automatically. After the domain is live, update the App URL inside DocuSeal's settings so links in emails use the new address instead of the cloud-station.app one.

Backups and your data

Documents live on the volume at /data/docuseal; metadata, users, and audit logs live in PostgreSQL. Both volumes are covered by CloudStation's automatic backups.
Do not detach or shrink the /data/docuseal volume below its current usage, or documents become unreadable while their database entries remain.
SECRET_KEY_BASE is generated once per deployment and encrypts stored secrets such as two-factor seeds and the saved email password. Never change it on a running instance; previously encrypted data would become unrecoverable.

Updating DocuSeal

The template pins docuseal/docuseal:3.2.5 so releases reach you when you choose, not automatically. To update, change the image tag on the docuseal service to the version you want and redeploy. Database migrations run on start. DocuSeal publishes releases roughly weekly; check the release notes before a jump of several versions.

Troubleshooting

Signing invitations are not arriving. Check Settings → Email and click Save again to trigger the test message; the error it shows is the real cause. Most common: a Gmail account password used instead of an App Password, or a port/security mismatch (587 needs STARTTLS, 465 needs SSL). If you set environment variables, make sure SMTP_ADDRESS is not empty (see the warning above) and that you redeployed after setting them.

The setup form does not appear, only a sign-in page. An admin account already exists. Use Forgot your password? if email is configured; otherwise ask CloudStation support to reset it.

I lost my two-factor device. Another admin can disable two-factor for your user under Settings → Users. If you are the only admin, contact CloudStation support.

Documents are listed but will not open. The /data/docuseal volume is missing or was replaced. Check the service's Storage Volume in the panel; restore it from a backup if needed.

Configuration reference

Variables set automatically by the template; you normally do not touch them.

Variable	Set by template	Purpose
`DATABASE_URL`	yes	Connection to the dedicated PostgreSQL 16
`SECRET_KEY_BASE`	yes (unique per deployment)	Encrypts sessions and stored secrets; never change on a live instance
`HOST`	yes (your app domain)	Used for links in emails
`FORCE_SSL`	yes (`true`)	Redirects HTTP to HTTPS and sets secure cookies
`SMTP_*`	no (optional)	Environment-based email; see Email (SMTP)

FAQ

Is DocuSeal free and open source? Yes. DocuSeal is open source and self-hostable with no per-signature fees. On CloudStation you pay only for the resources it runs on.

Are DocuSeal signatures legally binding? Yes. DocuSeal produces signatures compliant with ESIGN, UETA, and eIDAS, with an audit trail and a signed PDF for every completed document.

Is DocuSeal a good DocuSign alternative? For most contracts, NDAs, HR paperwork, and consent forms, yes. You get templates, multiple signers, signing order, reminders, an API, and webhooks, without per-envelope pricing. DocuSign still has the larger integration marketplace and enterprise identity verification options.

Do the people signing need a DocuSeal account? No. Signers receive a link by email and sign in the browser or on their phone.

Where are my documents stored? On the persistent volume of your own DocuSeal service on CloudStation, at /data/docuseal. They are not sent to a third-party e-signature cloud.

Can Charlie set DocuSeal up for me? Yes. Charlie can deploy the template and configure email for you; you confirm before any change is applied.

What does it cost to run? DocuSeal and its PostgreSQL run as two services on your CloudStation plan; see the template page for the current plan fit. There are no signature or user fees.

Can I migrate from an existing DocuSeal? Yes. Move the PostgreSQL data and copy the /data/docuseal directory from the old instance into the new volume. Secrets encrypted with the old SECRET_KEY_BASE (two-factor seeds, saved email password) must be set up again.