Skip to content
OctoDoc

About

The Who. The What. The How.

Upload documents, prepare who signs, and get on with life.

The whole path

One document. Four stages. No tool-hopping.

OctoDoc keeps the work together from source file to signed PDF. You stay in control at every step.

Prepare a document

Product preview

Choose a source file, then review its fields.

IRS Form W-9

Internal Revenue Service

Preparing

OctoDoc

IRS Form W-9

Source: Internal Revenue Service

1. Name

2. Federal tax classification

3. Certification

Switch between preparation and signing. This interactive walkthrough shows the intended flow; captured product evidence is published only after the corresponding screen has shipped.

  1. Choose the exact PDF to sign.

    Upload a PDF, confirm and review a Word-to-PDF conversion, or choose a source-checked reusable PDF form.

  2. Prepare one signing-ready version.

    Add the people, place their fields on the real pages, set the order, and check the outgoing file before anyone sees it.

  3. Give every signer a clear path.

    Each person opens one secure link, reads the whole document, completes only their fields, and reviews before signing.

  4. Return the signed PDF to everyone.

    After the final signature, the sender and every signer keep the same signed file.

Upload and review

Start with your file. Keep every page in view.

A PDF keeps its source pages. A Word file asks before conversion, then waits for your explicit approval before preparation.

Ask about the document

Ask Octo answers supported factual questions with the exact passage and page it used.

Use a reviewed form

Choose a reusable PDF form by issuer and source. OctoDoc checks its stored digest before opening a private copy.

A Word file stays in your browser until you select Convert to PDF. The result cannot move forward until you inspect every page and select Use this PDF.

Browse reusable PDF forms

Prepare and send

Right fields. Right people. You send only what you checked.

Add the people who need to sign, assign their fields, set the order, and inspect the outgoing document before anyone receives it.

Send documents for signature with a username. Choose the person, review the document, then send.

Place signatures, initials, dates, names, emails and text fields on the real pages. A person places and confirms every field — not an automatic layout.

Before a file goes out, the confirmation lists every signer and every person on copy by name and by the exact address their email goes to. When you send, OctoDoc freezes the version you reviewed. Resending cannot swap a different document under an open signing session.

Real fixture document · PDFium page render

The first page of a Mutual NDA between Northwind Labs and Acme Industries shows its purpose, effective date, and fixed terms.

Measured crop

Purpose and dates

The highlighted region of page 1, cut from the same page render at higher resolution.

The magnified document region names the purpose, effective date, and two separate time periods.
  1. The page is a fixed PDF fixture used only to prove exact page rendering.
  2. The highlighted region separates the agreement term from the confidentiality term.
  3. The committed image bytes came from the isolated server-side PDFium boundary.

Review and sign

The signer sees the document — not a maze.

Nothing to install. Each invited person uses one free account for every verified email address that receives a request.

The signer can read every page, download or print the file, and move only between fields assigned to them. They can type a signature or draw one.

A separate review step catches missing fields before the final action. An expired invitation or a changed document stops the session instead of producing a partial result.

Product preview · 32 seconds

What the video shows
  1. What the signer sees. Dana Reyes at Acme Industries signs a Mutual NDA from Northwind Labs. Nothing to install.
  2. Every page is readable and printable before signing. Each consent is its own choice.
  3. One signature fills only the marks assigned to this signer.
  4. A required review lists every mark. Finishing is a separate act.
  5. OctoDoc seals the file once and publishes its SHA-256 for anyone to check.
  6. Every byte, as approved. The seal covers the exact file the signer reviewed. Check it at octodoc.org/verify.
Get Started

Seal and return

Everyone leaves with the same signed PDF.

When the last signer finishes, OctoDoc seals the file once. The sender and every signer get access to that result.

Only the fields people approved enter the frozen PDF. Ask Octo answers and citations never become part of the signed file.

The sender can see who is waiting, who has signed, and where to download the signed PDF.

OctoDoc describes the cryptographic result it produces. It does not promise that a court will accept a particular agreement.

What you keep

The sealed PDF returns to every party.

Your account keeps the signed file available under the published retention period. You can download it, store it, and check its signature in a normal PDF reader.

The signed file

The PDF contains the document, the marks each person approved, and the signing-record pages sealed with it.

The current limit

Anyone can check a sealed file’s digest at octodoc.org/verify, and the record of signing downloads with the sealed PDF. The PDF itself carries no long-term validation material.

Not expecting this?

Stop before you sign. Check who sent the request.

The invitation names the sending organization and the document. If either is unfamiliar, do not continue from the link.

Use another channel

Contact the sender through an address or phone number you already trust. You can decline after opening the request, and signing never starts automatically.

Technology

One exact file, open on every surface.

The ingestion path keeps the exact file. What sets OctoDoc apart is that a person, and an agent beside them, can reach that same file from the surface they already use.

Ingestion

Upload a PDF or Word file, or choose a source-checked reusable PDF form. A PDF keeps its source pages. A Word file asks before conversion, then waits for an explicit page review. A reusable form must match its reviewed digest before a private file is created. The server re-measures every confirmed mark against the stored pages. Nothing a model writes can enter the bytes that are sealed.

Every surface

That file is prepared in the workspace and opened by a signer. Anyone can check a sealed file with no account, and even offline. With separate consent, Slack can say what is waiting in any workspace where an owner added the OctoDoc app. A forwarded email from a verified, opted-in address becomes a private review. The installed CLI can review, summarize, and verify with no account. A typical e-signature suite stops once it has collected a mark. Questions leave for email, and the record stays in the vendor’s account.

Agents

The CLI reviews, summarizes, and verifies files you provide, and a signed-in CLI prepares, sends, and signs them. Machine identity alone supplies no transaction authority. An answer with no matched passage and page is not shown as a citation.

Send documents for signature with a username. Choose the person, review the document, then send.

The comparison is with common practice across e-signature products, not with one vendor’s current plan.

Anatomy

Every part, numbered.

$AFTER SIGNPAY08 GET PAID07 THE LEDGERPAdES B-T06 THE SEAL05 SIGNATURESHA-25604 TRANSACTIONS03 ANSWERS02 GEOMETRY01 SOURCES612 × 792 PTXY0,0 — BOTTOM-LEFT ORIGIN
OctoDoc — Document AnatomyOrigin: bottom-left

Source

One exact file in.

PDFDOC / DOCXREUSABLE FORM612 PT792 PTIMMUTABLE VERSIONSA CHANGE IS A NEW VERSION
Fig. 01 — SOURCESThree intake pathsImmutable versionsLayer 01/08

  1. Intake

    Upload a PDF or Word file, or choose a source-checked reusable PDF form.

  2. Page geometry

    Every page's size and rotation are measured at ingestion and stored. Nothing downstream re-guesses them.

  3. Immutable versions

    Each prepared file is a numbered, immutable version. A change is a new version, never an edit in place.

PDF pages stay byte-exact · a Word file converts once, then you review every page

Preparation

Marks land on measured geometry.

MARK — RECTx 164.20 y 96.00w 306.00 h 91.80SELECTED, MEASURED, CONFIRMED0,0DETAIL A — SCALE 2:1W 306.00 PTH 91.80
Fig. 02 — GEOMETRYOrigin: bottom-leftRe-measured at sendLayer 02/08

  1. The measured box

    A mark is a rectangle in PDF user space, measured against the page's real size. The model can select a measured box. It never invents one.

  2. The confirmation

    A person confirms every placement before it counts. An unconfirmed suggestion never reaches the send.

  3. Covered text

    A mark that covers body text is refused with the exact covered passage, and only the sender can overrule it.

Coordinates in PDF points · origin bottom-left · re-measured at send

Answers

Ask the document a question. Get the exact passage back.

ANSWER — CITES P. 4NO MATCH, NO CITATION
Fig. 03 — ANSWERSPassage + pageNo match, no citationLayer 03/08

  1. The cited answer

    Ask a factual question and get the exact passage that answers it, with its page.

  2. The grounding rule

    An answer with no matched passage and page is not shown as a citation.

  3. The boundary

    Ask Octo answers and prepares. It cannot rewrite, draft, or replace document text, and its output never enters the signed bytes.

Deterministic passage selection · the page number is stored with the answer

The send

Sending is a measured transaction.

SERVER-MEASURED DIGESTSHA-256 OVER PAGES + MARKSATTENDED CONFIRMATIONA PERSON, THIS TRANSACTIONBOTH REQUIREDONE USESENDMISMATCH — REFUSED, NOT WARNEDNO BEARERAUTHORITYDIGEST + ATTENDED ACT
Fig. 04 — TRANSACTIONSOne digest, one sendNo bearer authorityLayer 04/08

  1. The server's digest

    The send digest is recomputed on the server from the stored pages and confirmed marks. A mismatch is a refusal, not a warning.

  2. Single use

    The digest is locked and consumed once, inside the send transaction.

  3. No bearer authority

    A bearer credential alone never authorizes a send or a signature. A binding act needs the transaction digest plus an attended confirmation, or an explicit mandate that covers that digest.

Geometry re-measured server-side · one digest, one send

Signing

Built for the person signing, too.

CONSENT — RECORDED FIRSTIDENTITY — VERIFIED ADDRESSGLYPHS — EVERY CHARACTER COVEREDSIGNED — MARK 1 OF 2ADOPTION METHODSTYPEJohn SmithDRAWUPLOADGLYPH PREFLIGHTREFUSES ON .NOTDEF
Fig. 05 — SIGNATURESigns in the browserAccounts are freeLayer 05/08

  1. The free account

    Signer accounts are free. The account proves control of the invited address and gives every returned document one place to live.

  2. The verified address

    Every signing authorization resolves through a verified address. An unverified alias is never authoritative.

  3. The glyph preflight

    A typed signature renders only from faces that cover every character. The seal refuses rather than substituting glyphs.

Nothing to install · the other side signs in the browser

The seal

One signature covers every byte you approved.

ONE SIGNATURE — WHOLE BYTE RANGERFC 3161 TIMESTAMPPAdES B-TSIGNATURE BLOCK
Fig. 06 — THE SEALPAdES B-TRefuses, never degradesLayer 06/08

  1. The flatten

    The approved pages are flattened and hashed. What is sealed is exactly the file a person approved — a model never mutates the signed bytes.

  2. The signature

    One detached CAdES signature over the whole byte range, with an RFC 3161 signature timestamp. PAdES B-T.

  3. The refusal

    The seal refuses rather than degrades: a glyph that cannot render stops the seal, and confidence is a measurement, never a constant.

Validated independently by pyHanko · check it in a normal PDF reader, offline

The record

The record cannot quietly lose a step.

EVENT 0041H(PREV) + BODYEVENT 0042H(PREV) + BODYEVENT 0043H(PREV) + BODY/VERIFYNO ACCOUNT NEEDEDSHA-256 OVER EACH EVENT AND ITS PREDECESSORCONTENT-ADDRESSED STORAGE — NEVER OVERWRITTEN
Fig. 07 — THE LEDGERHash-linkedPublic checkLayer 07/08

  1. The chained ledger

    Each event is linked to the one before it. Remove or change a step and the chain shows it.

  2. The stored file

    Evidence writes are content-addressed and never overwritten. The ledger and the proof manifest show a deletion or a replacement.

  3. The public check

    Anyone can check a sealed file with no account, and even offline.

SHA-256 over each event and its predecessor · /verify needs no account

Payment

Get paid right inside the document.

$ PAYMENT MARKNAMES ONE PAYEREVERYONE SIGNSTHE SEAL LANDS FIRSTCHECKOUT OPENSFOR THE NAMED PAYERPAY NOWYOUR STRIPEACCOUNTFEE 0.5% · CAPPED AT $25 · EVERY PLANTHE PAYER PAYS YOU, NOT OCTODOC
Fig. 08 — GET PAIDOn your Stripe accountAfter the sealLayer 08/08

  1. The Payment mark

    Place a Payment mark on the page and the person it names pays you through Stripe after everyone signs.

  2. After the seal

    Checkout opens only after the seal lands, for the person the mark names. The signature never waits on the money.

  3. The flat fee

    On each payment, OctoDoc's fee is 0.5 percent, capped at $25, on every plan. The payer is charged the amount you set and nothing more.

Paid on your own Stripe account · the payer pays you, not OctoDoc

Features

What OctoDoc does, and what it refuses to do.

Prepare a document, send it, and sign it — with answers that point at the page, a signer surface that costs nothing, and a record you can check without asking us. Built first for independent contractors, agencies and startups; sized for any team that wants the same candor.

Who it is for

Built for small teams first. Open to every team.

The early work went where agreements are constant and the paperwork is nobody's job: independent contractors, agencies and studios, and startups sending their first contracts and offer letters.

Where we started

A contractor or agency sends statements of work, master agreements and change orders every week, and the signed file is what lets the invoice go out. A startup sends offer letters, contractor agreements and mutual NDAs while nobody owns the paperwork. Those are the jobs the upload path, form catalog, and pricing were shaped around.

Who else it fits

Nothing here is capped by company size. Larger firms use the same sending, the same seal and the same free signer accounts, and add senders as the team grows. The security posture publishes every control and its evidence so a reviewer can check without a sales call.

The document that answers

Every supported answer quotes one exact passage and names its page.

Ask Octo answers supported factual questions from the document you uploaded, while you prepare it and while the other side reads it.

Ask the file

Ask a factual question and get the exact passage that answers it, with its page. Open its page and read the surrounding terms yourself.

The refusal is the feature

An answer with no matched passage and page is not shown as a citation. A general chatbot in another window can produce a fluent answer about any PDF. It cannot bind its answer to this stored passage and page, or refuse because no passage matched.

Start with the file

Upload a PDF or Word file, or choose a source-checked reusable PDF form. The PDF stays visible while you prepare fields and signers.

One account, every document

Every document you have sent or signed, with its versions, in one account.

Get paid after signing

Place a Payment mark on the page and the person it names pays you through Stripe after everyone signs. On each payment, OctoDoc's fee is 0.5 percent, capped at $25, on every plan. The payer is charged the amount you set and nothing more. Signing never waits on payment.

For the person signing

The other side of the table is a first-class user.

Most signing products are built for the sender alone. The person asked to sign gets a link, a box, and no way to ask anything. OctoDoc treats that person as the second customer.

Signing costs nothing

Signer accounts are free. No plan, no card, no trial that converts into a charge. An account exists so the record can name who acted, not so anyone can bill you.

Your questions have a destination

Ask a supported factual question before you sign and get the exact passage and page that answer it. Ask the sender directly when the document cannot answer; OctoDoc will not send the question automatically.

Your documents are not training data

Every model request requires zero-data-retention and prompt-training opt-out. That is an application control on every generated-text request, and executed zero-data-retention terms on the two closed-set judgments, not a promise in a terms update.

You keep the sealed file

Every party can download the sealed PDF, its evidence archive, and the terminal proof file from their account once assembly completes. What you signed does not live behind someone else's subscription.

Why signing uses an account

A forwarded signing email is not enough to sign. Signing needs an account that has confirmed the invited address. Signing requests sent to any address you have verified appear in one account.

Ask Octo identifies itself as software on every signer surface. Ask Octo reports what the document says and where. It is software, not a lawyer, and it is not a substitute for the advice of an attorney.

Compared

Where OctoDoc differs from the typical e-signature suite.

No vendor is named because plans change; the left column describes the category's common practice, and every line in the right column is a registered, supportable claim or a published decision.

The person signing

A place to collect a mark. Questions leave the product and go to email.

A free account, a cited answer on the page, and the sealed PDF to return to.

AI answers

A fluent paraphrase with no obligation to show where it came from.

An answer quotes the page it came from, or it is not shown as a citation.

Checking the record

A signing record that lives in the vendor's account and is shown on request.

One signature covers every byte you approved. Anyone can check it in a normal PDF reader, offline.

Documents and model training

Training permissions have arrived by terms update, mid-relationship.

Every model request requires zero-data-retention and prompt-training opt-out.

The middle column describes common practice across the category, not any single product. Verify any vendor fact against that vendor's current published plans before relying on it.

Pricing

Priced per workspace, never per person.

Free sends with no monthly limit. Team is $99 a workspace each month, or $950 a year, and keeps signed records for 7 years. Membership is free on both plans, however many people your workspace holds, and signer accounts are free.

What scales with price

Document retention, the sending pace of a new workspace, and administration.

What never scales with price

How many files you send each month, free signer accounts, the number of people in your workspace, the number of marks on a file, the review step before signing, and access to the signed PDF.

Free

$0No monthly send limit

Sending

Sends each calendar month
No limit
Sending pace for a new workspace
5 on its first day, then 10 a day and 25 a week, until it is 14 days old with 3 sealed files
People in your workspace
Unlimited
Receiving, signing and verifying
Unlimited
Signers
Up to 10 per file, always free
Marks per file
Unlimited
Payments after signing
0.5% per payment, capped at $25

Preparation and review

Ask Octo
Unlimited
Reusable PDF forms
Unlimited

Records and administration

Document retention
At least 1 year

Team

$99/workspace/moOr $950 a year, a 20% discount

Sending

Sends each calendar month
No limit
Sending pace for a new workspace
No limit
People in your workspace
Unlimited
Receiving, signing and verifying
Unlimited
Signers
Up to 10 per file, always free
Marks per file
Unlimited
Payments after signing
0.5% per payment, capped at $25

Preparation and review

Ask Octo
Unlimited
Reusable PDF forms
Unlimited

Records and administration

Document retention
7 years
Get StartedTalk to us about a larger teamFree with no monthly send limit

Form catalog

Choose the exact form you need.

Search by keyword, or jump to a category from the rail. Every choice names its issuer and links to the source we reviewed, and this is the same catalog New Document searches.

70 source-checked forms open inside the same private preparation path as your own PDF.

70 reusable forms

Business & tax

Employment & HR

Health & privacy

Property & housing

  • HUD Form 9548

    U.S. Department of Housing and Urban Development

    Sales contract for HUD property disposition.

    3 pages · 50 fillable fields · Issuer source

  • HUD Form 9548-G

    U.S. Department of Housing and Urban Development

    Lead-based paint addendum for 203(k) rehabilitation financing.

    1 page · 12 fillable fields · Issuer source

  • HUD Form 92900-A

    U.S. Department of Housing and Urban Development

    Addendum to the uniform residential loan application.

    4 pages · 46 fillable fields · Issuer source

  • HUD Form 92561

    U.S. Department of Housing and Urban Development

    Borrower's contract about hotel and transient use of property.

    1 page · 7 fillable fields · Issuer source

  • HUD Form 92544

    U.S. Department of Housing and Urban Development

    Warranty of completion of construction.

    2 pages · 17 fillable fields · Issuer source

  • HUD Form 92541

    U.S. Department of Housing and Urban Development

    Builder's certification of plans, specifications, and site.

    3 pages · 81 fillable fields · Issuer source

  • HUD Form 9548-B

    U.S. Department of Housing and Urban Development

    Discount sales addendum to a HUD sales contract.

    4 pages · 21 fillable fields added by OctoDoc · Issuer source

  • HUD Form 92051

    U.S. Department of Housing and Urban Development

    Compliance inspection report for FHA-insured construction.

    2 pages · 97 fillable fields added by OctoDoc · Issuer source

  • HUD Form 92300

    U.S. Department of Housing and Urban Development

    Mortgagee's assurance of completion, in its five-part set.

    5 pages · 107 fillable fields added by OctoDoc · Issuer source

Payments & claims

Government & procurement

Choose a formSee preparation

Source review

The source stays visible.

OctoDoc stores an exact reviewed copy, verifies its digest before use, and keeps the issuer link beside the choice.

Exact bytes

The catalog file must match its reviewed SHA-256 before OctoDoc creates a private file.

Current requirements

Issuers can change forms and filing rules. Open the linked source and confirm the current requirements before use.

Using a form

One preparation path.

A catalog form follows the same field preparation, signer assignment, review, send, signature, return, and verification path as an uploaded PDF.

Your decision

OctoDoc does not choose a form or interpret its requirements. It is software, not a lawyer, and it is not a substitute for the advice of an attorney.

Product preview · 27 seconds

What the video shows
  1. Start from a reviewed form. Jordan Wu at Northwind Labs prepares a form for Dana Reyes at Acme Industries.
  2. Pick a reviewed form. OctoDoc checks its source before it becomes your file.
  3. Add the signer. Auto-fill places a mark on each field the form defines.
  4. Confirm every mark, then send. The PDF and signing order are then frozen.
  5. Your decision. OctoDoc does not choose a form or interpret its requirements. It is software, not a lawyer, and not a substitute for the advice of an attorney.

Agents and the CLI

Review the file from your terminal.

The OctoDoc CLI inspects files you already hold with no account. Signed in, it prepares, sends and signs from the same account as the web, and a person authorizes every binding act.

Local tools

Three local tools, one install.

Install the CLI with one command, add it to the agent you already use, then run three local commands on files you provide.

Install

curl -fsSL https://octodoc.org/install | sh

For macOS on Apple silicon and Linux on x86-64. The script installs nothing unless the download matches its published SHA-256.

Sign in

octodoc login

Opens your browser to approve this computer. Login never creates an account; the local tools below need none.

  1. Review

    Inspect exact PDF bytes without an account, network request, or model call.

  2. Summarize

    Request a cited model summary after choosing the party whose perspective matters.

  3. Verify

    Compare a sealed PDF with an independently obtained digest, or replay a local ledger bundle.

Review locally

octodoc <file.pdf> review [--json]

The result records the exact digest, page geometry, fields, structural signature facts, fonts, and signability reasons.

Choose machine output

The default output is TOON. Add --json only when another program needs JSON.

Both formats describe the same local result. Structured output goes to stdout; progress and disclosures use stderr.

Add it to Claude Code

claude plugin marketplace add 8bittts/OctoDoc-Pluginclaude plugin install octodoc@octodoc

One skill that drives the command line above, from a public repository. It declares no server of its own, and does nothing until the command line is installed.

Open in Claude Code

Add it to Codex

codex plugin marketplace add 8bittts/OctoDoc-Plugincodex plugin add octodoc@octodoc

The same bundle, from the same repository, read through the portable manifest beside the first rather than a second copy.

Walkthrough · 29 seconds

What the video shows
  1. Review reads the PDF you hold: its digest, pages and form structure.
  2. Every suggested mark is measured from the file and starts unconfirmed.
  3. Verify checks a sealed file against its published digest and signature field.

Model boundary

A model call stays explicit.

Summarization is separate from deterministic review. It sends bounded canonical document text through Vercel AI Gateway and labels every model-selected result.

Disclosed network command

octodoc <file.pdf> summarize --party <role> [--json]

The command requires a supported party perspective. Its cited summary is model output and is not a substitute for reading the complete document or for the advice of an attorney.

Verification

Verify the evidence you already hold.

The local verifier checks evidence you already possess. It does not look up a hosted OctoDoc record.

Sealed PDF

octodoc verify --sealed <file.pdf> --sha256 <hex>

Obtain the digest independently. The structural signature-field result is not a certificate, trust, revocation, or legal-validity verdict.

Ledger bundle

octodoc verify --ledger <bundle.json>

The verifier checks the bounded bundle, hash chain, Merkle proof, and RFC 3161 evidence against the selected local trust anchors.

Authority

Local inspection is not signing authority.

Local inspection creates no OctoDoc account state and grants no signing authority. Machine identity alone never authorizes a send or signature.

See the browser signing flowRead the authority modelAsk a question

Need a document signed? Use the supported browser product. The local tools on this page never place or confirm a mark, choose a party, or execute a binding act. Read the security boundary.

Slack

Ask about your files in Slack.

A workspace owner adds the OctoDoc app to Slack. Each person links their own account, and with a separate consent the app answers in their direct messages. Preparing, sending and signing finish on the web.

Product preview · 38 seconds

What the video shows
  1. Ask about your files in Slack. Jordan Wu at Northwind Labs links Slack once. Signing still happens on the web.
  2. A workspace owner adds the app from OctoDoc and approves four permissions.
  3. Say list to see the files waiting on you or out for signature.
  4. Say status and a file name for its details and a link.
  5. Ask a question and get a cited passage from that file.
  6. Follow a file in its thread. Say stop to end the updates.
  7. Prepare, send and sign on the web. Slack answers only in your own direct messages, after a separate consent.
Add OctoDoc to Slack

Linking stores only what the Slack section of the Privacy Policy lists. Read what Slack stores.

Security

What you control, and what you can check.

The sealed file, the record, where data lives, and how each is handled. Built for a security review you can deep-link.

The sealed file

The sealed file is yours to verify.

One signature covers every byte you approved. Change anything later and the signature breaks. Check it in a normal PDF reader, offline, with no account and nothing of ours in the path.

The seal is a detached CAdES signature over the whole file, applied in-process when the document is sealed. The signing identity lives as a function environment secret.

What a reader sees: the signature covers the document, and it carries an RFC 3161 timestamp from DigiCert attesting when it was made. The issuer is self-managed, so a PDF reader will not mark it as trusted automatically — verification uses the proof file and the CLI instead.

Before seal, OctoDoc checks every mark for missing font glyphs. When an already-out legacy authored request reaches its last-signer seal, OctoDoc also compares its extracted text with its frozen source text. A failed check produces no artifact.

Validated by an independent library in CI — the code that seals never verifies its own output

We do not say court-admissible and we do not say tamper-proof. We name what the artifact is and let your counsel draw the conclusion.

The record

The record cannot quietly lose a step.

Each event links to the one before it. Remove or change a step and the chain shows it.

The ledger is written through one bounded database function. There is no update path and no delete path for a tenant. A missing step is visible, not deniable.

Chain heads are anchored to an external RFC 3161 timestamp authority, DigiCert, on a five-minute schedule, and each response is archived with its certificate chain and a per-file audit path. The signing path fetches its own RFC 3161 timestamp from the same authority on every seal.

The ledger never goes to a logging or analytics vendor. Neither do document bytes or party personal data. No observability vendor is connected today.

Where data lives

Where your documents live.

One United States region. Private storage. Content-addressed writes that refuse overwrite.

Every browser-facing surface is HTTPS only. The domain is submitted to the HSTS preload list and every response carries a preload Strict-Transport-Security header; once the listing ships in browsers, plain HTTP is refused before a request is made. Document bytes sit in private object storage. A browser reaches them only with a scoped, expiring grant. Bytes pass through the application only while a file is prepared, flattened or sealed.

Evidentiary writes are tenant-prefixed, content-addressed and refuse overwrite. A duplicate finalize converges on one artifact, and a replacement is detectable.

OctoDoc records how a person reads a file — time on each page and how far they scroll — only after they allow it. A browser's Global Privacy Control signal counts as a no. OctoDoc takes no device, canvas, font or TLS fingerprint from anyone, whether or not they allow reading measurement. Signing itself records the IP address and user-agent string as evidence, and section 3.2 of the privacy notice lists every field it keeps.

An organization’s region is fixed at creation and cannot change later. Retention and deletion — including what survives an erasure request and why — live in the privacy notice, not in a summary that can go stale.

Privacy notice, sections 5 and 7 — published, indexable, no account required

Model calls

What a model can see — and what it can never sign.

Every model request requires zero-data-retention and prompt-training opt-out.

That control is set on every model call the application makes: zero-data-retention required, routing restricted to the providers named for that call. Anthropic, through the Vercel AI Gateway, receives every generated-text request, and the response names the host that served. TypeSafe receives two closed-set judgments and answers each with a probability, under executed zero-data-retention terms. The send-policy check itself reaches no model: it is a fixed set of rules run over the outgoing file's own text. The Vercel and Anthropic agreements covering these model surfaces were executed on 1 September 2026 and are filed with OctoDoc's own records.

Nothing a model produces can reach the signed bytes. The bytes that are flattened, hashed and sealed are exactly the file a human approved. The server re-measures the stored PDF before accepting mark placement, and send refuses an unconfirmed suggestion.

Ask Octo is deterministic for a signer, and for a sender except that one judgment breaks a tie its own ranking cannot. Its answers and citations live beside the document, and an answer with no matched location is not shown as a citation. It does not advise or create an automatic sender handoff.

Tenant isolation

One organization cannot reach another.

Row-level security is the floor. Application code never relies on it alone.

Every tenant table has row-level security enabled and forced, including for the table owner. The administrative role that can bypass those policies holds no table privilege, so a direct table read fails instead of succeeding for every tenant. Application code reaches tenant data only through bounded functions that take the organization as an argument. Zero affected rows is treated as failure, never as success.

The platform operator is not a data gate. Our console sees aggregate counts only — not tenant identifiers, personal data, document content, hashes, IP addresses or user agents. Support that truly needs customer data goes through a consent-bounded flow, or it does not happen.

Every route that serves document bytes, party names or a hash is excluded from search indexing in four independent layers. The exclusion list is declared once so those layers cannot disagree.

Questionnaire

Security questionnaire answers.

Short answers a diligence reviewer can deep-link. Each points at a published surface rather than inventing a claim.

  • Where is the product hosted?

    Application and API on Vercel. Database, Auth and private object storage on Supabase in us-west-2. Outbound mail through Resend. Model calls through the Vercel AI Gateway to Anthropic under zero-data-retention routing.

    Source

  • Can we choose an EU or UK data region?

    No. One United States region is fixed when the organization is created. Multi-region is not offered.

    Source

  • Is data encrypted in transit and at rest?

    HTTPS only on every browser-facing surface; the domain is submitted to the HSTS preload list and every response carries a preload Strict-Transport-Security header. Object storage and the database use the provider's at-rest encryption. We make no separate customer-managed key claim in this version.

    Source

  • How is one customer isolated from another?

    Every tenant table has row-level security enabled and forced. Application code reaches tenant data only through bounded functions that take the organization as an argument. Zero affected rows is treated as failure.

    Source

  • Do you train models on customer documents?

    Application control: every generated-text model call requires zero-data-retention routing and prompt-training opt-out, restricted through the Vercel AI Gateway to Anthropic. The send-policy check is a fixed ruleset and calls no model. The two closed-set judgments (the launcher's routing and a sender question's tie-break) go to TypeSafe under executed enterprise zero-data-retention terms and the vendor's published no-training commitment, and return a probability rather than text. An organization can also decline model processing, which covers scanned-page reading, the launcher and the tie-break.

    Source

  • Can AI change what gets signed?

    No. Proposals, answers and citations live beside the document. The bytes that are flattened, hashed and sealed are exactly the file a human approved. Unconfirmed mark suggestions are refused at send.

    Source

  • What does the digital signature on the PDF mean?

    One detached CAdES signature covers the whole sealed file. Change the bytes and the signature breaks. The issuer is not on Adobe's trust list in this version, so Acrobat will not mark the certificate as trusted. We report that honestly.

    Source

  • Do you have SOC 2, ISO 27001 or HIPAA?

    No. None of those reports or a business associate agreement is held. Do not send protected health information through OctoDoc.

    Source

  • Have you had a penetration test?

    No external penetration test is booked or published yet.

    Source

  • Do you support SSO or SCIM?

    No single sign-on and no SCIM in this version. An organization has two roles and no more: one owner, and members. Membership is free and unlimited, so nothing is billed per person.

    Source

  • How are signers authenticated?

    Default is an emailed link to a free account that must verify the invited address. A sender can require a separately delivered access code for an ordinary commercial file, but the code is sender-issued and is refused for employment and consumer files. SMS and government-ID verification are not in this version.

    Source

  • Who are your subprocessors?

    The published subprocessor register on the Trust Center and in the DPA is the only list. It is versioned and cannot disagree with the privacy notice.

    Source

  • How long do you keep documents?

    Hosted access runs for the published retention period: at least one year from the seal for a File sealed on the Free plan, and at least seven years for one sealed on a paid plan. Retention and deletion, including what survives an erasure request, are in the privacy notice. Separately, a sealed PDF you hold validates from the file itself, without an account and without OctoDoc. No surface promises hosting without end.

    Source

  • Do you offer a DPA?

    Yes. The data processing agreement is published and indexable without an account.

    Source

  • Where is the status page?

    status.octodoc.org on an independent host. It is named in the sender terms contact table, not as an availability warranty.

    Source

  • Can OctoDoc staff read our documents?

    The operator console sees aggregate counts only — not tenant identifiers, personal data, document content, hashes, IP addresses or user agents. Support access that needs customer data is consent-bounded.

    Source

  • Can a counterparty verify a sealed file without an account?

    Public verification is open at octodoc.org/verify with no account: paste a digest, or choose a file and it is hashed in the browser for a live comparison. A counterparty can also open the sealed PDF offline, read the signing-record pages, and compare the published SHA-256. The security posture page explains the seal.

    Source

  • Do you carry cyber or E&O insurance?

    No. No cyber or errors-and-omissions policy is bound, and no certificate of insurance is published.

    Source

Subprocessors

Who else can touch your document.

One register. The privacy notice and data processing agreement render the same list.

  • Vercel (including AI Gateway and Sandbox)

    Application hosting, document processing, isolated Word conversion and transport for model calls

    US · Document content: Yes — during Word conversion, preparing, flattening or sealing, and as bounded model context under required zero-data-retention routing

  • Supabase

    Postgres, authentication and private object storage

    US, us-west-2 · Document content: Yes — including page bytes in private Storage

  • Cloudflare

    Authoritative DNS, the reverse proxy in front of Supabase authentication, database and storage, and inbound email routing

    US · Document content: In transit only — every Storage upload and download crosses the reverse proxy, which terminates TLS and stores nothing

  • Resend

    Account email, signature requests, reminders, sealed-copy delivery and inbound attachment intake on agents.octodoc.org

    US · Document content: Document names and email content, plus a PDF emailed to the inbound address, which Resend holds until OctoDoc fetches it

  • Stripe

    Subscription billing, and the payments a signer or copy party makes to a workspace's own connected Stripe account on a sealed file

    US · Document content: No

  • Anthropic

    Extractive CLI summaries, routed-page transcription and the platform reachability probe

    US · Document content: Yes — bounded document content, and a rasterised page IMAGE for a page with no readable text layer, routed by the Gateway under required zero-data-retention and prompt-training opt-out controls

  • TypeSafe

    Typed judgments only: launcher intent routing and near-tie reranking of a sender's document question, never generated text

    US · Document content: Yes — the typed launcher request and bounded candidate passages of a document, under executed enterprise zero-data-retention terms and the vendor's published no-training commitment

  • Timestamp authorities

    RFC 3161 timestamp tokens from DigiCert on every seal and on five-minute ledger anchors

    US · Document content: Hash only

At least 30 days’ notice before a subprocessor is added or replaced. You may object and terminate the affected subscription for a prorated refund if we proceed. Authoritative register: version 2026-09-23, effective 23 September 2026. The full current register is also in the Trust Center, the privacy notice and the data processing agreement.

Security contact

Ask a specific question.

A pointed question gets a faster answer than a blank questionnaire — but we will complete a questionnaire, including the rows that are no.

Privacy and data protection: privacy@octodoc.org. Security incidents and vulnerability reports: security@octodoc.org. Every other address, and what each one answers, is on the contact page.

OctoDoc is unrelated to other businesses using the word octodoc, including a commercial printer and an unrelated consumer AI application.

Contact

Write to a person.

Five addresses, each with a question it answers. No form, no queue number, and no address collected before you have asked anything.

Who answers

Five addresses, five questions.

Pick the address that matches the question. The four specialist addresses are the ones our published instruments already name, so none of them is a marketing alias that routes somewhere else.

General

The general address, for anything that is not one of the four below — what OctoDoc does, whether it fits how you work, or a question about the company.

hello@octodoc.org

Support

A document, an account or a send that is not behaving. Support hours are 09:00 to 18:00 US Eastern, Monday to Friday.

support@octodoc.org

Security

A vulnerability report or a security incident. Send it here rather than to support, so it reaches the right person first.

security@octodoc.org

Privacy

A data protection question, a subject access or erasure request, or a review of what we hold.

privacy@octodoc.org

Legal

Contract questions, legal notices, and litigation support or a subpoena marked for the Records and Evidence Officer.

legal@octodoc.org

A pointed question gets a faster answer than a blank questionnaire — but we will complete a questionnaire, including the rows that are no. The security posture and the Trust Center already answer most of what a review asks, and both are public.

What to send

Tell us enough to answer once.

Four details turn a first message into something we can act on.

What you were doing
The page or command, and what you expected instead of what happened.
When it happened
A timestamp with a time zone. It is what turns a report into something we can find in a log.
A file reference, not the file
The file name or the identifier from its URL is enough for us to locate it.
How to reach you back
The address you want the answer sent to, if it differs from the one you are writing from.

Do not attach the document

Email is not the place for a document or for personal data. Send the file reference and we will find it. A document that reaches us as an email attachment sits in a mailbox, outside the access controls and the record that the product keeps around it — which is the one thing OctoDoc exists to avoid. If a report genuinely needs a page, say so and we will arrange a route for it.

Answered already

Some of it is already published.

Several questions have a published answer that is more exact than a reply would be.

How signing works
The whole path from upload to sealed file, with what each step records.
What OctoDoc keeps
The subprocessor register, the data flow, retention and the measures behind them.
Building against it
The account-free local review, summarize, and verify tools.
Which form to use
The reusable PDF form registry, searchable by keyword and grouped by category.
How it worksTrust CenterDeveloper guideReusable PDF forms

About

About OctoDoc

We are a small team building the signing system of record — the document that answers. We move fast on purpose, and we build the checks that let us.

Read the paper

An agent can meet a price limit while accepting an unexpected commitment. Follow a hypothetical supplier renewal through the whitepaper: the terms, the authority to act and the record both sides keep. Open it in OctoDoc to try the document reader, or read the typeset page.

View in OctoDocRead the typeset page

Octo, a soft lavender octopus with a rounded mantle and eight short arms, raising one arm in greeting

Why

Why we exist

Signing software solved delivery and stopped there. A file arrives, somebody signs it, and the words inside stay a mystery to at least one party at the table. The person with the least information is usually the one being asked to commit.

OctoDoc exists to close that gap. The document holds itself open, answers questions from its own pages with the passage quoted and the page named, carries the record of how every signature came to be, and can be checked against its own digest by anyone, offline, without an account and without asking us. Our customers should not have to take our word for anything, and they do not.

We build it quickly and in public view. Real documents, real signers and real feedback tell us what is right far faster than any amount of planning does, so we get the smallest useful thing in front of people and let them redirect us. Speed is not impatience here. It is how we find out.

Octo

Meet Octo

Meet Octo. They are the small lavender clerk who lives inside OctoDoc, and they are the shape of the whole idea. An octopus has eight arms and keeps two thirds of its neurons inside them — each arm tastes, touches and decides for itself while the animal thinks about the larger problem. Many things at once, one mind behind them. That is the company as much as the character.

Octo grew out of the name rather than out of a mood board. Octo is eight, eight arms is eight jobs, and a document that can hold itself open, read itself back and prove its own history needs about that many. The lavender is the product’s own accent color, so Octo is quite literally made of the same material as the interface they live in.

Register

Octo is a clerk, not a lawyer

Octo is friendly. Octo is also, in the way of good clerks everywhere, slightly pedantic — they will read the whole thing. Octo quotes one exact passage and names its page, then refuses when no passage answers your question. They point at the document rather than tell you what to do about it. That distinction is the entire job. Octo will never advise you, and Octo will never say whether to sign.

Arms

What the eight arms do

Each arm does one job well while you do yours — from the browser or from the private command line:

The intake arm
brings in your PDF or reviewed Word conversion, or starts from a source-checked reusable PDF form.
The answering arm
answers questions about the document from the document, with citations.
The placing arm
keeps every mark at the exact position a person confirms.
The sending arm
routes the file to the people who sign and the people on copy.
The watching arm
records how every signature came to be, in an append-only ledger.
The sealing arm
flattens, hashes and cryptographically seals the finished file.
The checking arm
verifies a sealed file against its digest, offline, with no account.
The eighth arm
holds the coffee. Every good clerk keeps one arm free.
Octo holding a single printed page steady in two front arms
Two arms to hold it open, six left over. This is the part paper was never good at.

Moods

A day in the life

Octo has one expression for every stage a document goes through. They are not decorations — each one marks a moment where something real happens to your file.

  • Octo, a soft lavender octopus, with their head tilted and one arm curled up beneath their face

    Curious

    A new file just landed.

  • Octo holding a single page open in two front arms and reading it closely

    Reading

    Every clause, before you ask about one.

  • Octo sitting upright with one arm folded across in front of them and their eyes narrowed

    Thinking

    Working out which clause your question actually points at.

  • Octo sitting squarely upright with every arm planted and both eyes wide and round

    Listening

    Your question matters more than Octo's answer.

  • Octo holding a single page up beside them with one arm, turned outward

    Presenting

    Here is the exact line. Here is where it lives.

  • Octo holding a page in one arm and a slim black pen in another, reviewing it

    Reviewing

    Octo proposes. A person decides.

  • Octo resting a pen on a page laid flat on the ground

    Signing

    Only ever your signature, never Octo's.

  • Octo with two arms thrown up high on either side, delighted

    Sealed

    The file is sealed and the record is written.

Rules

What Octo will never do

Octo reads an uploaded file or reusable PDF form, answers, places and seals. Octo does not decide. Octo never creates or revises document text. No proposed mark becomes authoritative until a person confirms its exact position. The bytes that get hashed and sealed are the ones a human approved, and nothing else.

Octo answers only from the pages in front of them. Ask a question the file does not cover and Octo will say so rather than guess, because a confident wrong answer about a document you are about to sign is the worst thing a clerk can produce. Octo does not send the question to the sender. Contact the sender directly when you need an answer the document cannot supply.

Octo never invents signing authority or substitutes their identity for yours. A saved credential alone never authorizes a signature. A person authorizes the exact transaction in the browser, or an explicit mandate must cover that exact act. The record of how is written as it happens. Octo is flexible. Evidence is not.

Octo settled low and wide with every arm splayed flat on the ground, eyes narrowed, at rest
Off duty. The record keeps itself once the file is sealed.

Principles

How we work

Speed is the point. We build, put it in front of real users, listen, and change it. A decision made in an hour and corrected next week beats a decision made perfectly in a month, because the month never tells us whether we were right. Four working rules protect that speed, and none of them is a brake:

Ship to learn, not to be done
The purpose of a release is the signal it returns. We prefer the smallest version a real person can react to, then we change it based on what they tell us.
Build the guardrail, then move fast inside it
We go quickly because the system catches us, not because we are individually careful. Every automated check here fails closed — one that cannot run reports a failure, never a pass.
Prove it, do not assume it
A safeguard is not finished until somebody has broken the thing it protects and watched it object. We treat a silent run as unproven rather than as good news.
Say what is true
We report what ran and what did not, and we make no claim this product cannot keep. It is the same discipline as the evidence we ask a buyer to check for themselves.

The pattern underneath all four is the same one the product is built on. We would rather be caught by a check than trusted on our word, and so would the person on the other side of a signature.

Close

Prepare. Sign. Keep.

That is us. Eight arms, one document, and a strong opinion about paper. If Trust sent you here, consider it a small gift for reading the fine print.

If the way we work sounds like the way you want to work, we would like to hear from you — whether you are weighing us up as a supplier or wondering what it is like to build here. Write to hello@octodoc.org, or see every address on the contact page.

FAQ

Straight answers to practical questions.

What can I start with?

Upload a PDF or Word file, or choose a source-checked reusable PDF form. OctoDoc keeps uploaded PDF pages exact. It asks before converting a Word file to PDF, then requires you to review every page before preparation.

Can Ask Octo change my document?

No. Ask Octo can answer questions with citations and help you prepare measured fields. It cannot rewrite, draft, or replace document text. Its output never enters the signed bytes.

Why does every signer need a free account?

The account proves control of the invited email and gives the signer one place to return to every document — even when different companies use different addresses. Nothing to install. Signers never pay.

Can a signer download or print before signing?

Yes. The signer can read every page in the browser and download or print before the final action and after the file is sealed.

What happens if someone makes a mistake?

Each signer gets a review-and-correct step before the final action. Missing required fields, an expired invitation or a stale document version stops the seal instead of producing a partial result.

What does sealed mean in OctoDoc?

Sealed means every required person has signed, only approved fields are flattened into the frozen PDF, those bytes are digitally signed, and the result is stored once and returned to everyone. We describe that cryptographic result. We do not promise that a court will accept a particular agreement.

Do you train AI on my documents?

No. Our published terms state that OctoDoc does not use the content of your documents to train, fine-tune, evaluate or benchmark any machine-learning model, whether our own or a third party's, and that prohibition is unqualified as against us. Every model request requires zero-data-retention and prompt-training opt-out. Routing is restricted to the providers named for each call: Anthropic through the Vercel AI Gateway for generated text, and TypeSafe for two closed-set judgments that answer with a probability; the send-policy check is a fixed ruleset and calls no model. Our sub-processor register names both and states exactly what each handles.

What can I not send through OctoDoc?

Wills, codicils, testamentary trusts, family-law matters, negotiable instruments, documents of title and a PDF that already carries a signature. The exact outgoing PDF is checked before send by a fixed set of rules, never a model, and nine further categories in our published US ruleset send with a recorded note. A refusal is product policy, not a claim that an electronic signature there is void. Download the ruleset at /octodoc-policy-ruleset-v2.0.json.

What does OctoDoc cost?

Free sends with no monthly limit; a new workspace sends up to 5 files on its first day, then 10 a day and 25 a week, until it is 14 days old with 3 sealed files. Team is $99 a workspace each month, or $950 a year at a 20% discount, and keeps signed records for 7 years. Membership is free on both plans, however many people your workspace holds, and signers never pay. The plan comparison shows every price.

Can more than one person sign?

Yes. Add each signer in the order they should sign and assign only the fields they need. OctoDoc sends the file to one signer at a time in that order. Each person gets their own bounded session on the same frozen document.

Can someone receive the document without signing it?

Yes. Add them as a copied party. They get read-only access to the final signed document, with no fields and no signing authority.

Where does the signed PDF go?

After the last signer finishes, OctoDoc seals the file once. The sender and every signer can download the same signed PDF. Copied parties get read-only access.

Who is OctoDoc for?

OctoDoc is built first for independent contractors, agencies and studios, and startups sending contracts and offer letters. It is sized for any team that wants the same candor.

What are reusable PDF forms?

They are source-checked forms whose issuer and reviewed source are named beside the choice. OctoDoc stores an exact reviewed copy and verifies its digest before use.

Can I use a reusable form like an uploaded PDF?

Yes. A catalog form follows the same field preparation, signer assignment, review, send, signature, return and verification path as an uploaded PDF.

Can local tools prepare or sign a file for me?

No. The account-free local tools inspect files you already hold. They do not create, prepare, send or sign a file, and they grant no signing authority.

Where does OctoDoc store my data?

OctoDoc uses one United States region, private storage and content-addressed writes that refuse overwrite.

Can I verify a signed PDF offline?

Yes. One signature covers every byte you approved. Change anything later and the signature breaks. You can check it in a normal PDF reader, offline, with no account and nothing from OctoDoc in the path.

What should I do with a suspicious signing invitation?

The invitation names the sending organization and the document. If either is unfamiliar, do not continue from the link.

How do I contact OctoDoc?

Choose the published address that matches your question. The contact page explains what to send so the team can act on it.

Prepare. Sign. Keep.

Send your first document free.

Get StartedSee the whole path

You choose the source pages. You prepare the fields. Everyone gets the same signed PDF back.