OmniSign
Security & Infrastructure · Available · v0.1.0
OmniSign provides embedded, purpose-bound signing inside the suite: PDF render + PAdES signing, CAdES-BES/T seals with RFC3161 timestamps, async outbox worker with retention, contract push-back (e.g. into OmniQuip), sealed-blob storage, NDA sessions bound to visits (nda:visit:<id>), capability-token session auth and metering. Wedge is not a DocuSign clone — it is cryptographic sealing where the suite needs it (gate NDAs, hire contracts, delivery proofs) with a LAWtrust AeSign upgrade path for ECTA suretyship-grade documents.
Business problem
Gate NDAs, hire contracts and proof-of-delivery need cryptographic non-repudiation without forcing users into a separate eSign SaaS and without losing POPIA residency.
Core capabilities
- ▸PDF render + PAdES sign
- ▸CAdES-BES/T with RFC3161 timestamp
- ▸Async outbox drain + retention
- ▸Contract push-back into hire/yard flows
- ▸Sealed-blob storage
- ▸NDA sessions purpose-bound to visits
- ▸Eureka capability-token session auth
- ▸Metering
Architecture
Stateless signing workers draining an outbox; sealed blobs gated by Eureka ed25519 tokens purpose-bound to the originating visit/contract. Push-back via ledger clients.
Deployment: Containerised microservice co-deployed with portfolio APIs.
Licensing: Included in suite; metered per seal.
Evidence & confidence
Confidence: high
- MOBISEC-Portfolio-Executive-Summary.md §3 (Production v0.1)
- OmniSign src layout
At a glance
- Platforms
- Web · API
- Stack
- .NET · PostgreSQL · QuestPDF / iText · RFC3161 TSA · Eureka · Docker
- Integrations
- OmniVisit · OmniQuip · OmniFleet · Eureka · LAWtrust AeSign
- Maturity
- Production (high confidence)
Target customers
- · MobiSec suite tenants (OmniVisit / OmniQuip / OmniFleet)
- · SMEs needing embedded signing
- · Partners via LAWtrust AeSign
Roadmap
LAWtrust AeSign PKI bridge for suretyship-grade ECTA compliance; batch seal API.