DPTCloud
Back to articles
Technology Insight

Self-Hosting DocuSeal on a VPS with Cloudflare R2: A Secure, Cost-Effective Document Signing Solution for Businesses

June 4, 2026

Introduction: The Cost and Security Challenges of Enterprise Document Signing

In the modern corporate landscape, digital document signing has transitioned from a convenience to an absolute operational necessity. Contracts, onboarding forms, non-disclosure agreements (NDAs), and internal approvals drive business velocity. However, relying on mainstream Software-as-a-Service (SaaS) e-signature platforms presents two major pain points for growing enterprises: escalating subscription costs and data sovereignty concerns.

As organizations scale, per-user or per-document pricing models can quickly balloon IT budgets. Furthermore, storing sensitive financial, legal, and personnel documents on third-party cloud servers frequently conflicts with strict data compliance regulations such as GDPR or local data privacy laws. To mitigate these risks, forward-thinking enterprises are turning to self-hosted alternatives.

This comprehensive guide explores how to build a robust, enterprise-grade document signing infrastructure by deploying DocuSeal—a premier open-source digital signature platform—on a Virtual Private Server (VPS), backed by Cloudflare R2 for secure, cost-optimized, and highly available document storage.

---

Why DocuSeal and Cloudflare R2? The Architectural Advantage

Before diving into the deployment process, it is essential to understand why the combination of DocuSeal and Cloudflare R2 serves as an ideal architecture for internal document signing.

1. DocuSeal: The Open-Source Powerhouse

DocuSeal offers an intuitive, sleek user interface that rivals major commercial platforms. It supports PDF form fields, automated signing workflows, multi-user signing sequences, and comprehensive audit trails. By self-hosting DocuSeal, you retain complete control over the application environment, enabling seamless integration with internal identity providers (IdPs) and corporate databases without recurring license fees.

2. Cloudflare R2: Zero Egress Fees Storage

While running DocuSeal on a VPS handles the application logic, storing signed PDFs directly on the local server disk poses scalability and reliability risks. If the server experiences drive failure, critical legal documents could be lost forever.

Integrating Cloudflare R2 object storage solves this elegantly. R2 is fully S3-compatible, boasting exceptional durability and availability. Crucially, Cloudflare R2 charges zero egress bandwidth fees. This means your application can retrieve, view, and distribute documents millions of times without incurring unpredictable bandwidth surcharges, making it vastly more cost-effective than legacy cloud storage providers.

---

Prerequisites and Technical Requirements

To successfully execute this deployment, ensure you have gathered the following components:

  • A Dedicated VPS: Minimum 2 vCPUs, 2GB RAM, running a clean installation of Ubuntu 22.04 LTS or newer.
  • A Fully Qualified Domain Name (FQDN): (e.g., sign.yourcompany.com) pointed to your VPS IP address.
  • A Cloudflare Account: To manage DNS, SSL/TLS, and create an R2 storage bucket.
  • Docker and Docker Compose: Installed on the host server to facilitate containerized deployment.
  • SMTP Configuration: Credentials from a reliable email delivery provider (e.g., SendGrid, Amazon SES, or Mailgun) to handle document signing invitations and notifications.
---

Step-by-Step Deployment Guide

Step 1: Setting Up the Cloudflare R2 Bucket

First, log into your Cloudflare dashboard and navigate to the R2 Object Storage section.

  1. Click on Create Bucket and assign it a unique name (e.g., corporate-docuseal-storage).
  2. Once created, navigate to the bucket settings and take note of your S3 API Endpoint.
  3. Go to the R2 overview page, click on Manage R2 API Tokens, and generate a new token with Edit permissions. Securely save the Access Key ID and Secret Access Key; you will need these for your environment configuration.

Step 2: Configuring Docker Compose for DocuSeal

Connect to your VPS via SSH. Create a dedicated directory for your deployment and navigate into it:

mkdir -p /opt/docuseal && cd /opt/docuseal

Create a file named docker-compose.yml using your preferred text editor and define the services. Below is an enterprise-ready configuration that links DocuSeal with a PostgreSQL database and passes the Cloudflare R2 credentials:

Note: Ensure you replace the placeholder values with your actual system credentials.

  • PostgreSQL Database: Used to manage audit trails, user access logs, and template metadata.
  • DocuSeal Application: Configured via environment variables to utilize S3-compatible storage.

Within the configuration, specify the key object storage parameters:

  • AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY from your Cloudflare R2 API Token.
  • AWS_BUCKET matching your R2 bucket name.
  • AWS_ENDPOINT pointing directly to your Cloudflare R2 S3 API URL.

Step 3: Deploying the Services and Nginx Reverse Proxy

Launch the containers in detached mode by executing the following command:

docker compose up -d

Verify that both containers are running successfully using docker compose ps. Next, configure Nginx as a reverse proxy to route external traffic securely from your domain (sign.yourcompany.com) to the internal port utilized by the DocuSeal container.

To protect sensitive legal data in transit, it is mandatory to enforce SSL/TLS encryption. Use Let's Encrypt and Certbot to obtain a free, automated SSL certificate:

sudo certbot --nginx -d sign.yourcompany.com

Certbot will automatically update your Nginx configuration to enforce a secure HTTPS connection with modern TLS protocols.

---

Post-Deployment Configuration and Best Practices

With the infrastructure live, navigate to your domain via a web browser to complete the initial setup wizard. Create your master administrator account and immediately implement the following configurations:

1. Configure SMTP for Secure Document Delivery

Navigate to the admin settings pane and input your corporate SMTP server details. Since DocuSeal relies on email to dispatch signing links, ensure your sending domain utilizes valid SPF, DKIM, and DMARC records to prevent sensitive signature notifications from landing in spam folders.

2. Implement Multi-Factor Authentication (MFA)

Because an internal document signing platform holds authority over corporate contracts, enforcing MFA for all staff accounts is non-negotiable. Ensure that access controls are strictly monitored and reviewed regularly.

3. Automated Backup Routines

While your documents are safely stored in Cloudflare R2, the structural metadata—such as user permissions, document templates, and signing histories—resides in the PostgreSQL database on your VPS. Establish a nightly cron job to back up the database volume and sync it to a separate secure location.

---

Conclusion: Security, Cost Efficiency, and Autonomy

By self-hosting DocuSeal on a VPS and backing it with Cloudflare R2, your organization successfully breaks free from restrictive SaaS pricing structures while elevating its security posture. You retain 100% ownership over your corporate documents, audit logs, and signature workflows. This architecture delivers an enterprise-grade, highly scalable digital signature solution that guarantees compliance, performance, and predictability for years to come.