Electronic Signature Recommendations

Question

My department is currently looking at accepting e-signatures on our contracts.  However, we would like the signature to actually look like a wet signature, not just a typed name, we would also like some sort of validation that the name on the form is actually the person who signed it (i.e. someone isn't signing the CEOs name).  My manager was currently at a conference where she talked to someone from RPost.  She asked me to look into it.  I have discovered that there are a lot of e-signature companies out there.  How do you know which one is the best, and which one will work the best with Adobe forms?  Any information, or recommendations you can provide would be greatly appreciated.

Answer 1

Following up on Gregor’s post, I wanted to offer some additional insight related to security in general, and to DocuSign’s efforts specifically. Please know that while I work as DocuSign’s Chief Security Officer, my interest is in giving you information to help you make the best decision for your needs. So here goes!
SAS 70 Type II reports, soon to be SSAE 16, measure and independently assess standard service controls within an organization – no formal certification exists, just the resulting report.  These are industry-standard examinations conducted by an impartial, third party auditing firm.  Customers find these audit reports useful in evaluating the scope of an organization’s security controls and how well an organization performs in independent testing.
DocuSign consistently performs extremely well in these audits.  We not only have a SAS 70 Type II enterprise-level examination performed (that includes our electronic signature service, software development, operations, security, authentication options, end-to-end encryption, and anti-tampering methodologies), we also partner with an industry leading, professional data center firm that has SAS 70 Type II examinations performed on its security controls.  This firm is a global organization specializing in resilient physical and environmental security controls vital to protecting important and continuous production platforms.  
Our data centers are commercial grade – which means that the significant data center controls in place include a constant guard presence, priority power and fuel contracts, durable HVAC systems, and seamless fail-over capabilities to another secure datacenter facility in the event of a regional disaster (to ensure business continuity for your company information, documents, and signature transactions).  It’s also important to note that our data centers are co-located to further ensure regionally distributed response times. Both commercial grade status and co-location are great questions to inquire about when considering any electronic signature solution.
Additionally, I would advise considering the following criteria when looking at potential partners:
·       Years in business with customer organizations similar to your business.
·       Those with extensively tested and redundant infrastructures, including 3rd party code reviews.
·       Strong authentication options, and superior encryption key management processes to protect the confidentiality and integrity of your, and your customers’ data.
·       Responsive customer service and professional development capabilities to understand, integrate, and deliver to your specific needs and requirements.
·       An organization with a strong privacy policy and practices, including security awareness training and protection of personal information.
·       Compliance with related industry security standards, such as PCI DSS.
I know I speak for everyone at DocuSign when I state that our efforts and our scope of testing and validation attest to DocuSign’s commitment, diligence and the due care we provide our customers in safeguarding the availability, integrity, and security of your documents and signatures.
Should you have any additional questions about security, testing or DocuSign specifically, please don’t hesitate to ask. Thanks.
Joan Ross
Chief Security Officer at DocuSign
www.DocuSign.com