eIDAS-qualified e-signature platform with KYC & blockchain audit

An e-signature platform for regulated agreements

Chaindoc is an e-signature platform built for businesses that cannot treat a signature as just a click. It folds three jobs that used to live in separate products — signing an agreement, verifying who is on the other end, and collecting payment — into one regulated flow. A document goes out, the recipient proves their identity, they sign, and money moves, all in the same place. The signer never leaves the flow to prove who they are or to pay what they owe.

The platform serves four regulated sectors: real estate, healthcare, insurance, and IT services. These are industries where a contested signature is not an inconvenience but a legal and financial exposure. A lease, a consent form, an insurance policy, a vendor contract. Each one has to hold up if someone later disputes it, and in each one the cost of a signature that cannot be defended is measured in lawsuits, not annoyance.

What sets Chaindoc apart is the assurance baked into every signature. Signing is eIDAS- and ESIGN-qualified, so a document carries real legal weight in both the EU and the US. Identity is established through KYC before anyone signs, not bolted on afterward. And every signature writes a hash to a blockchain audit trail, so the record of who signed what, and when, cannot be quietly rewritten. The result is a signing flow that produces evidence, not just a PDF with a name typed at the bottom. That is the shift Chaindoc is built around: turning a signature from a formality into proof that survives scrutiny.

The compliance challenge: eIDAS, ESIGN, and KYC

Before Chaindoc, getting a regulated agreement signed and paid for meant stitching together three products. Signing lived in one tool. Identity verification ran through a second. Payments went through a third. Each had its own login, its own data, its own version of the truth. When a question came up later, whether about the right person, real agreement, or an altered file, the answer had to be reconstructed across three systems that were never designed to talk to each other.

The first challenge was legal standing. An e-signature only carries weight when it meets a defined standard. eIDAS in the EU and the ESIGN Act in the US both set the bar, and qualified electronic signature status under eIDAS is the highest tier. Reaching it requires a qualified certificate and a verified signer identity, not just a checkbox and a typed name. The platform had to produce signatures that clear that bar by default.

Identity was the second challenge. KYC and AML rules in these sectors demand real identity assurance, with document and liveness checks rather than a self-declared name. The hard part was not running a check. It was binding the verified identity to the signature itself, so the proof of who signed travels with the document forever. A KYC pass that lives in a separate system, disconnected from the signature it was meant to back, is worth little when an agreement is challenged months later.

Third came audit-trail integrity. A signed agreement is only as trustworthy as the record behind it. If the signing vendor's database can be edited, the audit trail is a promise, not proof. Chaindoc needed tamper-evidence that did not rest on trusting any single party's word.

The last challenge was reach. Real estate, healthcare, insurance, and IT services each have their own documents and rules. A real-estate disclosure and a healthcare consent form share almost no language, yet both need the same proof underneath. Building a separate product for each sector would have been slow and impossible to maintain. The platform had to flex across all four without a rebuild per sector, which meant getting the shared foundation right before the first document was ever sent.

What we built: KYC signing with an on-chain audit trail

We built one signing flow that handles identity, signature, and payment end to end. A sender prepares a document. The recipient verifies their identity through built-in KYC before they can sign. They sign under eIDAS/ESIGN-qualified terms. At the moment of signing, a SHA-256 hash of the document is written to an on-chain audit trail. If money is owed, Stripe Connect moves it in the same session. Role-based access control governs who can send, sign, view, and administer, so a healthcare admin and an insurance signer see only what their role allows.

Built-in KYC is what makes the flow different from a generic signing tool. Identity verification is not a separate step a client wires up with another vendor. It runs inside the same screen the signer is already on, and the verified identity is bound to the signature it produces. By the time a document is signed, the question of who signed it is already answered.

The on-chain audit trail is the part clients keep coming back to. Every signature produces a hash anchored to the chain, which means anyone can later confirm the signed file has not changed since the moment it was signed. There is no need to trust Chaindoc's own records. The math does the trusting. For a regulated business, that removes a quiet risk most signing tools carry: a record that is only as honest as the vendor holding it.

We delivered this in 22 weeks with one squad. The timeline below shows how the work was sequenced, front-loading the compliance and vendor decisions that everything else depended on. Nothing about the signing flow could be designed in earnest until the eIDAS and ESIGN requirements were mapped and the KYC and payment vendors were chosen, so those calls came first.

The first three weeks went to mapping eIDAS and ESIGN requirements and choosing the KYC and payment vendors, because those choices shaped everything downstream. The middle stretch built the signing experience, the access model, the audit timeline, and a design system that holds across sectors. Engineering then wired up the REST API, Stripe Connect, the SHA-256 hashing pipeline, and webhooks. The final four weeks were spent on ISO 27001 and CSA STAR audit prep, mobile and web signing, and a soft launch.

Architecture: e-signature API, webhooks, and SHA-256 audit

Chaindoc exposes a documented REST API, an electronic signature API that lets clients drop signing into systems they already run. A real-estate CRM or a healthcare records system can trigger a signing request without sending a user off to a separate app. Webhooks keep those systems in sync. When a document is sent, viewed, signed, or paid, the host system hears about it in near real time and updates its own records.

Payments run on Stripe Connect, which suits the split and marketplace cases these sectors generate. A platform can route a payment to the right party, take a fee, and settle to multiple accounts, all tied to the agreement that triggered it. Money and signature stay connected rather than living in separate ledgers.

The audit trail rests on a hybrid on-chain and off-chain design, and this distinction matters. The documents themselves are stored off-chain. Only a SHA-256 hash of each signed document is written on-chain. A hash is a fixed-length fingerprint: change a single character in the file and the hash changes completely. Putting the full document on a blockchain would be slow, costly, and a privacy problem, since chains are hard to redact. Putting only the hash on-chain keeps the sensitive content private and editable for storage purposes while still anchoring an immutable proof of the exact file that was signed. To verify, you re-hash the document and compare it to the on-chain entry. A match proves the file is untouched.

Security posture was mapped to ISO 27001 and CSA STAR from early in the build rather than retrofitted. That framing shaped how access control, logging, and data handling were designed, so the audit prep in the final weeks confirmed work already done instead of forcing a scramble. Role-based access control, the audit timeline, and the hashing pipeline were all part of that same design conversation, which is why the security model and the product model line up instead of fighting each other.

Taken together, the REST API, webhooks, Stripe Connect, the SHA-256 hashing pipeline, and the two compliance frameworks form one coherent stack. Each piece earns its place by removing a separate tool a regulated business would otherwise have to run and reconcile on its own.

Results across four regulated sectors

Chaindoc is live across all four regulated sectors it was built for: real estate, healthcare, insurance, and IT services. The same platform handles a lease, a consent form, a policy document, and a vendor contract without a separate build behind each one.

The experience holds up under real use. Median draft-to-signed time stays fast enough that signing stops being the bottleneck it used to be, even with KYC running inside the flow. Identity verification, signature, and the on-chain hash all happen in one pass, so adding assurance did not cost speed.

The part clients value most is the record. Every party to an agreement gets a tamper-proof account of who signed, what they signed, and when. Because the proof lives in an on-chain hash rather than a single company's database, no one has to take Chaindoc's word for it. If a signature is ever questioned, the document can be re-hashed and checked against the chain on the spot. That changes the conversation in a dispute from argument to verification.

Running across four regulated sectors on one platform also proved the architecture out. The shared foundation absorbed real estate, healthcare, insurance, and IT services without the per-sector forks the original brief was determined to avoid. What started as a way to merge three tools into one flow has become the system these businesses sign and get paid on every day.

E-signature for healthcare, insurance, real estate, and IT

One platform, four sets of documents and rules. The signing flow, KYC, payments, and audit trail stay the same underneath, while each sector gets the agreements and controls it actually needs. The shared core is why the same team could cover this much ground in 22 weeks. What changes from sector to sector is the paperwork on top, not the proof beneath it.