Projects / Documenso

Documenso + minidauth documents sealed at rest, opened for the reader, signed by a quorum

A signed document is a promise, and the database that holds it knows the parties, the terms and the signatures. In this fork of Documenso, the open source DocuSign alternative, those fields are sealed before they reach Postgres, open only for a signed-in user a quorum granted the role, and each completion is threshold-signed by the Tide network so no operator can forge it.

Open the fork Upstream Documenso

Run end to end

What gets sealed

Documenso is the open source DocuSign alternative. These fields are stored as ciphertext, and nothing on the server can decrypt them.

Documents
Title.
Recipients
Name.
Emails to signers
Subject and message.
Signatures and fields
The typed or drawn signature, and the text a signer entered.

How it's wired

  1. Sealed on write

    A Prisma client extension seals the chosen fields before they reach Postgres and opens them again on the way out.

  2. Opened per user

    Each authenticated request runs as its signed-in user; a recipient opening a signing link opens the document on the owner's reading authority once their token is verified.

  3. Gated by a quorum role

    A field opens only if minidauth's quorum grant says that user holds the reading role. Revoke it and the same view goes dark.

  4. Signed by a quorum

    On completion the Tide ORK cohort threshold-signs a statement about who signed what and when. The signature verifies against the vendor key; edit the row and it stops verifying.

The key that seals these fields exists only as shares across the Tide network, and 14 of 20 nodes have to cooperate to use it. It is never on the Documenso server.

Details that matter

  • The sidecar holds no reading identity and no signing key of its own. Opening and signing are delegated per user and gated on a quorum-granted role.
  • With no reader in the request, a field simply stays sealed, so there's never an open decryption service to abuse. Signing is best-effort and never blocks a person from signing.
  • Every inbound value is sealed, so plaintext never reaches a sealed column. Every completed signature is verifiable against the vendor key, and tampering the stored row breaks it.

Status and running it

A proof of concept, off unless MINIDAUTH_SEAL_URL is set, so an unconfigured checkout behaves exactly like upstream Documenso. The fork's README covers setup against a running minidauth.

Want to do the same for another app, or stuck running this one? Join the Discord and I'll help you out.

Other projects: Formbricks · Twenty · Cal.diy · Medusa · Rocket.Chat · Chatwoot · Firefly III · Integrations