DPTCloud
Back to articles
Technology Insight

Self-Hosting Docuseal on a VPS: Building a Secure, Independent Digital Signature Platform for Small Businesses

June 3, 2026

Introduction: The Cost of Digital Compliance for Small Businesses

In today's fast-paced digital economy, the ability to execute agreements quickly and securely is a core operational requirement. For years, electronic signature platforms like DocuSign, HelloSign, and Adobe Sign have been the standard-bearers for corporate documentation. However, for small and medium-sized enterprises (SMEs), these SaaS solutions present a double-edged sword: escalating subscription costs and growing concerns over data sovereignty.

As transaction volumes grow, per-user or per-envelope pricing structures can quickly turn a critical utility into a heavy financial burden. Furthermore, storing sensitive corporate contracts, employee NDAs, and customer agreements on third-party servers exposes businesses to compliance vulnerabilities under stringent data protection frameworks. Fortunately, the open-source ecosystem offers a robust, enterprise-grade alternative: Docuseal. By deploying Docuseal on a Virtual Private Server (VPS), your business can establish an independent, secure, and infinitely scalable digital signature infrastructure, eliminating recurring monthly fees while retaining 100% control over your data.

Why Choose Docuseal as a Self-Hosted DocuSign Alternative?

Docuseal is a powerful, developer-friendly, open-source platform designed to replicate the core workflows of commercial e-signature platforms. When hosted on your private infrastructure, it bridges the gap between cost efficiency and enterprise-level compliance. Here is why small businesses are increasingly migrating to self-hosted Docuseal:

  • Absolute Data Ownership: Your contracts never leave your infrastructure. This is critical for businesses operating in regulated sectors like finance, legal, healthcare, or government contracting.
  • Uncapped Scalability: Unlike SaaS platforms that meter usage via "envelopes" or charge steep premiums for additional users, a self-hosted platform allows unlimited document signing, unlimited templates, and unlimited users, constrained only by your VPS resources.
  • Seamless Integration: Docuseal comes equipped with a robust REST API and webhooks, allowing tech-savvy businesses to integrate signing workflows directly into internal CRMs, ERPs, or custom applications.
  • Modern User Experience: It features an intuitive drag-and-drop document builder, mobile-optimized signing interfaces, and automatic email reminders that mirror the user experience clients expect from premium tools.

Prerequisites for VPS Deployment

Before beginning the installation process, ensure you have the following technical components ready:

  1. A Reliable VPS Provider: A basic virtual server from providers such as DigitalOcean, Linode (Akamai), Vultr, or Hetzner. For small to medium operations, a specification of 2 vCPUs, 2GB or 4GB RAM, and 40GB SSD storage running Ubuntu 22.04 LTS or 24.04 LTS is highly recommended.
  2. A Fully Qualified Domain Name (FQDN): A dedicated domain or subdomain (e.g., sign.yourcompany.com) pointed to your VPS IP address via an A record.
  3. Docker and Docker Compose: The most efficient and stable way to deploy and maintain Docuseal is via containerization.
  4. SMTP Credentials: An external email service (such as SendGrid, AWS SES, Mailgun, or your internal corporate mail server) to handle automated signature requests and notifications.

Step-by-Step Installation Guide: Deploying Docuseal via Docker

Note: It is strongly recommended to access your server via SSH using non-root user credentials with sudo privileges to maintain standard system security protocols.

Step 1: System Update and Docker Installation

First, log in to your VPS and update the local package index to ensure all system software is current:

sudo apt update && sudo apt upgrade -y

Next, install Docker and its dependencies if they are not already present on the system:

sudo apt install docker.io docker-compose-plugin -y
sudo systemctl enable --now docker

Step 2: Configuring the Directory Structure and Docker Compose

Create a dedicated directory to keep your Docuseal installation organized and navigate into it:

mkdir ~/docuseal && cd ~/docuseal

Create a docker-compose.yml file using your preferred text editor (such as nano):

nano docker-compose.yml

Paste the following optimized configuration block into the file. This setup configures the Docuseal core application along with a dedicated, secure PostgreSQL database instance for reliable data persistence:

version: '3.8'

services:
  db:
    image: postgres:15-alpine
    container_name: docuseal-db
    restart: always
    environment:
      POSTGRES_USER: docuseal_user
      POSTGRES_PASSWORD: YourSuperSecurePasswordHere
      POSTGRES_DB: docuseal_production
    volumes:
      - postgres_data:/var/lib/postgresql/data

  app:
    image: docuseal/docuseal:latest
    container_name: docuseal-app
    restart: always
    ports:
      - "127.0.0.1:3000:3000"
    depends_on:
      - db
    environment:
      - DATABASE_URL=postgresql://docuseal_user:YourSuperSecurePasswordHere@db:5432/docuseal_production
      - SECRET_KEY_BASE=GenerateALongRandomHexKeyHere
      - PORT=3000
    volumes:
      - docuseal_data:/data

volumes:
  postgres_data:
  docuseal_data:

Save and close the file. Remember to replace YourSuperSecurePasswordHere and generate a unique sequence for SECRET_KEY_BASE to ensure production-level security.

Step 3: Launching the Containers

Execute the following command to download the required container images and initialize the services in detached mode:

sudo docker compose up -d

Verify that both containers are running successfully without errors:

sudo docker compose ps

Securing Your Platform with Nginx and Let's Encrypt SSL

Running an electronic signature platform over unencrypted HTTP exposes sensitive documents to interception. To prevent this, we will configure Nginx as a reverse proxy and secure it with a free, automated SSL certificate from Let's Encrypt.

Step 1: Install Nginx and Certbot

Install the Nginx web server alongside the Certbot utility and its Nginx integration module:

sudo apt install nginx certbot python3-certbot-nginx -y

Step 2: Configure the Nginx Server Block

Create a new Nginx configuration file tailored for your digital signature portal:

sudo nano /etc/nginx/sites-available/docuseal

Insert the following configuration layout, replacing sign.yourcompany.com with your actual subdomain:

server {
    listen 80;
    server_name sign.yourcompany.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Extended timeouts for handling larger PDF uploads securely
        client_max_body_size 50M;
        proxy_read_timeout 600s;
        proxy_connect_timeout 600s;
    }
}

Enable the site configuration by establishing a symbolic link to the active sites directory and restart Nginx:

sudo ln -s /etc/nginx/sites-available/docuseal /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

Step 3: Generate the Let's Encrypt SSL Certificate

Run Certbot to request, deploy, and configure automated renewals for your SSL certificate:

sudo certbot --nginx -d sign.yourcompany.com

Follow the interactive on-screen prompts to complete the deployment. Certbot will automatically rewrite your Nginx configuration to enforce a strict HTTPS redirect, ensuring all administrative actions and client interactions are securely encrypted.

Post-Installation: Initial Setup and Hardening

With the server infrastructure securely in place, you can now finalize the platform deployment via the graphical user interface:

  1. Admin Account Creation: Navigate to https://sign.yourcompany.com in your browser. You will be greeted by the initial configuration wizard. Create your primary administrative account using a strong password.
  2. Configure SMTP Settings: Navigate directly to the system settings and input your SMTP credentials. Test the connection to guarantee that the platform can send outbound automated signing request notifications and fully executed execution receipts to external signers.
  3. Enable Two-Factor Authentication (2FA): For corporate deployments, enforce multi-factor authentication across all internal users to protect document templates and historical audit logs from unauthorized access.

Conclusion: Embracing Digital Sovereignty

Deploying Docuseal on a private VPS offers small businesses a sophisticated, cost-effective escape path from predictable SaaS subscription cycles. By taking ownership of your e-signature pipeline, your enterprise gains total data control, ensures uncompromised regulatory alignment, and builds long-term operational resilience. As digital transactions continue to form the backbone of modern commercial activity, self-hosting critical utilities like Docuseal represents a proactive, strategically sound investment in your company's digital sovereignty.

Self-Hosting Docuseal on a VPS: Building a Secure, Independent Digital Signature Platform for Small Businesses | DPTCloud