Open-source notices, version oss-1
Version oss-1, published 2026-11-10, effective 2026-11-10. Each version is fixed once published; a change is a new version. SHA-256 f17c54e1bb86f9261ebe50a7063a94075b3be7ba074063cc9e4e917eef8a1887. This version's fixed copy.
. The notices
Sovrasign Open-Source Notices. Version oss-1, effective 10 November 2026.
In short: our verifier and the description of our document format are open source, so anyone can check a signed document without us. Our apps and pages also contain open-source software from others; this page tells you where to find their licences.
1. What we publish as open source
1.1 Sovrasign Verify, built on SignPDF. The verifier that checks documents signed with Sovrasign, and the open signing engine it is built on. Source code at https://github.com/sovrasign/verify, under the MIT licence or the Apache License 2.0, at your choice.
1.2 The envelope format description and test files. The description of how our signed documents are built and verified, under the Creative Commons Attribution 4.0 licence (CC BY 4.0), and the test files that go with it, under CC0 1.0 (no rights reserved). Published in the same repository.
1.3 Names and logos. These licences cover the code and the text, not the names Sovrasign and SignPDF or their logos. Forks are welcome, and may say that they are based on SignPDF, but may not use these names or logos as their own product's name, and may not claim that documents they sign are verified by Sovrasign.
1.4 The rest. Our apps, the signing page, the web app and the cloud service are not open source. They are licensed under our terms of service.
2. Open-source software inside our products
2.1 Where to find the licences. Each product lists the open-source components it contains, with their licences and notices:
| Product | Where |
|---|---|
| Web app, desktop and mobile apps | In the app: Settings > About > Open-source licences |
| Signing page | On request from support@sovrasign.com until the list is published here |
| Verifier | In its repository, https://github.com/sovrasign/verify (the LICENSES folder and each component's licence), and on request |
| Websites and help center | On request from support@sovrasign.com until the list is published here |
2.2 Main components. For example:
| Component | Used in | Licence |
|---|---|---|
| PDF.js (Mozilla) | Showing documents on the signing page | Apache License 2.0 |
| Flutter and its packages (Google and others) | Web app, desktop and mobile apps | BSD 3-Clause, and the licences of each package |
| Rust libraries, compiled into our signing and verification modules | Signing page, verifier, apps | Mostly MIT or Apache License 2.0; listed per library |
| Hanken Grotesk and Bricolage Grotesque fonts | Websites, web app | SIL Open Font License 1.1 |
| Roboto font | Web app | Apache License 2.0 |
| Dancing Script, Great Vibes, Caveat and Marck Script fonts | Typed signatures on the signing page (licences served next to them, /fonts/signature/) | SIL Open Font License 1.1 |
2.3 Licence texts and notices. Each build we ship includes the licence texts, copyright notices and any required NOTICE content for the components it bundles; the lists above are those notices for the version you use. The common ones are: the MIT licence, the Apache License 2.0, the BSD 3-Clause licence, the SIL Open Font License 1.1, CC BY 4.0 and CC0 1.0.
3. Source code of open-source components
We use components under licences that let us ship them inside our products without publishing our own source code. If a component's licence gives you the right to its source code, ask us at legal@sovrasign.com and we will provide it in the way and for the period that component's licence requires, and in any case for at least three years after we last shipped that version.
4. Contact and changes
Questions about these notices: legal@sovrasign.com. Security problems in our open-source software: see our responsible disclosure policy. We update this page when what we publish or the main components change; each version has its own id and date.